Notes
Short notes, glossary, and pitfalls
Original educational reminders for Azure cloud and AI reviews, not a record of real production incidents.
Organized on 2026-10-10
Glossary
- VM — Virtual Machine
- Virtual machine; an IaaS boundary closer to operating-system ownership.
- IaaS — Infrastructure as a Service
- Infrastructure as a Service; the user owns more runtime and patching responsibility.
- PaaS — Platform as a Service
- Platform as a Service; more runtime is managed, but identity, network, and data still need design.
- RBAC — Role-Based Access Control
- Role-Based Access Control for least-privilege authorization.
- NSG — Network Security Group
- Network Security Group controlling inbound/outbound rules at subnet or NIC scope.
- DNS — Domain Name System
- Domain Name System; Private Endpoint success often depends on correct private resolution.
- RPO — Recovery Point Objective
- Recovery Point Objective; the acceptable data-loss window measured in time, not the time needed to restore service.
- RTO — Recovery Time Objective
- Recovery Time Objective; target time to restore a usable service.
- RU — Request Unit
- Request Unit; normalized resource cost for Azure Cosmos DB operations. Provisioned throughput is expressed in RU/s; billing depends on the capacity mode.
- RAG — Retrieval-Augmented Generation
- Retrieval-Augmented Generation; retrieval hits do not equal authorization or answer correctness.
- STT — Speech to Text
- Speech to Text; language, noise, and privacy boundaries matter.
- TTS — Text to Speech
- Text to Speech; output experience still needs safety and rights review.
- MLOps — Machine Learning Operations
- Machine Learning Operations across data, evaluation, deployment, monitoring, and rollback.
- WAF — Well-Architected Framework / Web Application Firewall
- Ambiguous acronym: Well-Architected Framework in reviews differs from Web Application Firewall at the edge.
Common pitfalls
Stopped is not deallocated
A stopped VM may still keep billable resources; verify deallocation plus disks, IPs, and backup costs.
Budgets are not hard caps
Budget alerts do not replace quotas, policies, automated shutdown, and cost review.
Private Endpoint does not automatically close public access
Also check service public-network settings, DNS resolution, authorization, and client paths.
Replication is not backup
Replication can sync deletion or corruption; backup, retention, and restore drills are separate capabilities.
Vector indexes are not transactional databases
Retrieval indexes serve recall; they do not replace systems of record, authorization, or audit logs.
RAG is not authorization
Apply permission filters before and after retrieval; a citation does not mean the user may view it.
Model confidence is not a security threshold
Security decisions need verifiable policy, audit, and escalation paths, not model tone.
Offline F1 is not business outcome
Explain offline metrics separately from drift, cost, false positives, UX, and online experiments.
Architecture decision notes
Draw identity boundaries first
Mark people, service principals, managed identities, data-plane permissions, and audit points before compute choices.
Review cost and resilience together
Availability zones, backups, and queues can support resilience when failure modes and recovery are validated. Caches primarily improve performance and add invalidation and consistency risks; they do not automatically improve availability.
AI needs a data contract
RAG, evaluation, and agent tools depend on clear sources, fields, permissions, retention, and failure modes.