fai-tune-02-ai-landing-zone — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fai-tune-02-ai-landing-zone (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Optimize landing zone configuration for governance, networking, and cost.
| Dimension | Config | Default | Tune When |
|---|---|---|---|
| Policy strictness | infra/policies/ | Deny public EP | Legitimate exceptions needed |
| NSG rules | infra/network/ | Deny all inbound | App needs specific ports |
| DNS resolution | infra/dns/ | Private zones | New services added |
| RBAC scope | infra/identity/ | Resource group | Over/under privileged |
| Budget alerts | infra/monitoring/ | 50/75/90% | Thresholds too noisy |
# Scan for non-compliant resources
az policy state list --subscription $SUB \
--filter "complianceState eq 'NonCompliant'" \
--query "[].{Resource:resourceId, Policy:policyDefinitionName}" -o table
# Trigger evaluation
az policy state trigger-scan --subscription $SUB# Test latency between hub and spoke
az network watcher show-topology --resource-group rg-spoke -o json
# Verify private endpoint DNS
nslookup oai-prod.openai.azure.com
# Expected: 10.x.x.x (private), NOT public IP# Find over-privileged assignments
az role assignment list --scope /subscriptions/$SUB \
--query "[?roleDefinitionName=='Owner' || roleDefinitionName=='Contributor'].{Principal:principalName, Role:roleDefinitionName}" -o tableresource budget 'Microsoft.Consumption/budgets@2023-11-01' = {
name: 'landing-zone-budget'
properties: {
amount: 5000
timeGrain: 'Monthly'
notifications: {
alert75: { enabled: true, threshold: 75, operator: 'GreaterThan'
contactEmails: ['[email protected]'] }
}
}
}| Issue | Cause | Fix |
|---|---|---|
| Policy blocks legitimate resource | Too strict deny | Add exclusion or custom policy |
| DNS not resolving privately | Zone not linked | Link private DNS zone to VNet |
| RBAC too broad | Inherited from subscription | Scope roles to resource group |
| Budget alerts too noisy | Low thresholds | Adjust to 75/90/100% |
| Practice | Rationale |
|---|---|
| Tune one parameter at a time | Isolate impact of each change |
| Always measure before and after | Evidence-based tuning |
| Use evaluation dataset for comparison | Objective quality measurement |
| Keep previous config for rollback | Instant revert if quality drops |
| Document tuning decisions | Future reference for the team |
| Automate tuning evaluation | Reduce manual effort |
1. Baseline eval → record current scores
2. Change ONE parameter
3. Re-run eval → compare to baseline
4. If improved → keep change, update baseline
5. If regressed → revert change
6. Repeat for next parameterfai-tune-01-enterprise-rag — RAG tuning playbookfai-evaluation-framework — Eval infrastructurefai-inference-optimization — Latency and cost optimization~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.