The AI Workload

"AI experience" is on every posting and defined on none, which is precisely the opening. The brief is the one a real team writes once the enthusiasm meets the security review: "Stand up an internal assistant on our own Azure OpenAI — private, so no model endpoint sits on the public internet; metered, so we know which team is spending what; and shipped like everything else, so it is not a snowflake somebody built by hand." Most candidates who claim AI experience can screen-share a chat window. This Plate lets you screen-share the infrastructure under it — which is the half the job is actually about.

Microsoft maintains a baseline reference architecture for exactly this: a network-secured, zone-redundant enterprise chat application on Foundry and Azure OpenAI. This Plate is a scoped version — the model resource, the private path, the gateway that meters it, and the pipeline that deploys it — sitting on the web-application pattern you already proved in Plate I.¹

Deliverable

One public GitHub repository: the Azure OpenAI resource and deployment, its private endpoint, the API Management gateway that meters and rate-limits it, a token-spend dashboard, and the pipeline that ships all of it — plus a README that draws the request path and names the reference architecture it scopes from.

Each row is a component of the private AI path, the classes and Plates that taught it, and the evidence a reviewer will demand. The model resource goes in first; the gateway and the dashboard make it safe to share.

Screen-share the infrastructure, not the chat window.

Two boundaries. Scope down and say so: the enterprise baseline adds Foundry Agent Service with its own isolated state stores, AI Search for grounding, Cosmos DB for conversation history, an Application Gateway and WAF for the UI, and Azure Firewall governing all egress — each a README paragraph under "what production adds." A retrieval layer (AI Search grounding your own documents) is the highest-value optional extension if you have time. But keep the load-bearing walls: the private endpoint, the keyless identity, the metering gateway, and the pipeline are the architecture. Drop them and you have a chatbot demo, which the market already has too many of.

Marked against the Well-Architected Framework's five pillars, plus the temperament AI work specifically rewards: cost discipline and security carry extra weight, because a leaked model key spends real money and a public endpoint is a standing invitation.

SecurityWAF pillar · weighted

No public model endpoint, no stored key, a gateway every caller must pass, and a content filter you can account for. A full leak of the repository hands an attacker nothing they can run your model with.

Cost optimisationWAF pillar · weighted

You can name what a conversation costs and why — output priced above input, history compounding, the model choice as a multiplier — and the dashboard makes spend visible by caller before finance asks. AI's bill is the one nobody budgets; you budgeted it.

Operational excellenceWAF pillar

The AI infrastructure is code, shipped by the same gated pipeline as everything else — no snowflake, no hand-built resource, reproducible from the repository.

ReliabilityWAF pillar

The gateway handles throttling gracefully, the app retries transient faults, and the deployment can be repointed to a new model version without touching the application — the indirection from Class Thirty-Four, earning its keep.

Performance efficiencyWAF pillar

TPM is sized to real demand, not fear; the gateway can cache repeated answers; and the token budget is spent where it buys quality, not burned on history nobody needed. Right-sized, not over-provisioned.

The capping deduction is this Plate's non-negotiable: a public model endpoint, or an API key stored anywhere, fails the Security pillar outright — and an AI capstone that fails security is the one an interviewer remembers for the wrong reason. The entire point of the Plate is that you deploy AI the way a company that will be audited deploys it.

This Plate is the one that separates "I've used ChatGPT's API" from "I can run AI in production." The questions probe exactly that gap.

"How does a caller reach the model, and how do you know what it spent?"

Through the API Management gateway on its own key, which meters tokens per caller and enforces a per-key limit; the counts flow to a workbook that charts spend by consumer. Metering at the gateway is the answer that says you have run this at more than one caller.

"Is the model endpoint on the internet?"

No — public network access disabled, reachable only through a private endpoint resolved by a privatelink zone, with local key auth turned off entirely. The app authenticates by managed identity. This is the Class Fourteen pattern, applied to the model.

"What does a conversation cost, and what drives it?"

The token economics from Class Thirty-Five: output priced several times above input, history compounding roughly with the square of the conversation's length, and the model itself an order-of-magnitude multiplier. If you can price a twenty-turn session on a whiteboard, you have already won the question.

"A team's usage spikes ten times overnight. What happens?"

Their key throttles at its own limit without touching production, the dashboard names them before anyone else notices, and an alert fires because a ten-times spike is either a launch or a leak. The blast radius is one caller, by design.

"What did you scope out, and what would production add?"

Your honest note: Foundry Agent Service with isolated state, AI Search grounding, Cosmos DB history, a WAF on the UI, Azure Firewall on egress. Drawing the line to the enterprise baseline, unprompted, is what turns "I built a chatbot" into "I understand the production architecture."