deploy-enterprise-rag — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-enterprise-rag (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
az bicep lint --file infra/main.bicep
az bicep build --file infra/main.bicep
az deployment group what-if \
--resource-group rg-enterprise-rag \
--template-file infra/main.bicep \
--parameters infra/main.bicepparamazd init
azd up --environment devaz group create --name rg-enterprise-rag --location eastus2
az deployment group create \
--resource-group rg-enterprise-rag \
--template-file infra/main.bicep \
--parameters infra/main.bicepparamRequired index fields:
| Field | Type | Purpose |
|---|---|---|
| id | Edm.String | Chunk identifier |
| content | Edm.String | Chunk text (searchable, filterable) |
| content_vector | Collection(Edm.Single) | Embedding vector (3072 dims for text-embedding-3-large) |
| source | Edm.String | Source document name |
| page | Edm.Int32 | Page number |
| chunk_index | Edm.Int32 | Position within document |
Enable semantic configuration with "default" profile for reranking.
| Model | Deployment Name | Purpose | SKU |
|---|---|---|---|
| gpt-4o | gpt-4o | Chat completion + grounded answers | Standard (30 TPM) |
| text-embedding-3-large | text-embedding-3-large | Document + query embedding | Standard (120 TPM) |
CRITICAL: Query embedding model MUST match the index embedding model. Mismatch = 0 results.
# Get the app's managed identity
APP_IDENTITY=$(az containerapp show --name app-rag --resource-group rg-enterprise-rag --query identity.principalId -o tsv)
# Assign roles
az role assignment create --assignee $APP_IDENTITY --role "Cognitive Services OpenAI User" --scope /subscriptions/.../openai
az role assignment create --assignee $APP_IDENTITY --role "Search Index Data Reader" --scope /subscriptions/.../search
az role assignment create --assignee $APP_IDENTITY --role "Storage Blob Data Reader" --scope /subscriptions/.../storagepython evaluation/eval.py --config config/guardrails.json
# Groundedness: ≥0.8, Relevance: ≥0.7, Coherence: ≥0.8curl https://app-rag.azurecontainerapps.io/health
curl -X POST https://app-rag.azurecontainerapps.io/api/chat \
-H "Content-Type: application/json" \
-d '{"query": "What is the company policy on remote work?"}'| Issue | Cause | Fix |
|---|---|---|
| 401 Unauthorized | No RBAC role assigned | Assign Cognitive Services OpenAI User role |
| 404 Model Not Found | Deployment name mismatch | Check config/openai.json matches Azure portal |
| 429 Rate Limited | Exceeded TPM quota | Increase capacity or add retry with backoff |
| Search returns 0 | Embedding model mismatch | Same model for indexing AND querying |
| Low groundedness | Chunks too large | Reduce chunk_size in config/chunking.json |
| Bicep lint errors | Missing parameters | Verify main.bicepparam has all required values |
Reference .github/workflows/rag-ci-github.yml for GitHub Actions pipeline.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.