{
  "nbformat": 4,
  "nbformat_minor": 5,
  "metadata": {
    "kernelspec": {
      "display_name": "Python 3",
      "language": "python",
      "name": "python3"
    },
    "language_info": {
      "name": "python",
      "version": "3.13.0"
    },
    "blog_metadata": {
      "topic": "What Azure’s ‘Brain’ Gets Right About AI Operations: Reliability Is the Killer Enterprise Use Case",
      "slug": "what-azure-s-brain-gets-right-about-ai-operations-reliabilit",
      "generated_by": "LinkedIn Post Generator + Azure OpenAI",
      "generated_at": "2026-08-06T16:40:58.280Z"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "# What Azure’s ‘Brain’ Gets Right About AI Operations: Reliability Is the Killer Enterprise Use Case\n",
        "\n",
        "This notebook turns the blog post into a hands-on validation workbook focused on enterprise AI operations. The emphasis is not on chatbot polish, but on closed-loop reliability: telemetry, routing, bounded action, safety, auditability, and measurable service outcomes such as MTTA and MTTR.\n",
        "\n",
        "The examples below simulate a governed reliability loop in Python so you can test the operating model locally before connecting to real Azure or enterprise systems."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "%pip install -q requests pandas matplotlib"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "import time\n",
        "import json\n",
        "import re\n",
        "import random\n",
        "from uuid import uuid4\n",
        "from dataclasses import dataclass, asdict\n",
        "from typing import Dict, List, Any, Optional\n",
        "\n",
        "import requests\n",
        "import pandas as pd\n",
        "import matplotlib.pyplot as plt"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Baseline metrics and pilot goals\n",
        "\n",
        "The blog argues that reliability is the real proving ground for enterprise AI. Before testing any automation pattern, define the service outcomes you care about and compare baseline metrics with pilot results."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "baseline = {\n",
        "    \"mtta_minutes\": 11,\n",
        "    \"mttr_sev2_minutes\": 96,\n",
        "    \"repeat_incidents_30d_pct\": 18,\n",
        "    \"manual_triage_steps_min\": 5,\n",
        "    \"manual_triage_steps_max\": 8,\n",
        "}\n",
        "\n",
        "pilot = {\n",
        "    \"mtta_minutes\": 6,\n",
        "    \"mttr_sev2_minutes\": 54,\n",
        "    \"repeat_incidents_30d_pct\": 11,\n",
        "    \"manual_triage_steps_min\": 2,\n",
        "    \"manual_triage_steps_max\": 3,\n",
        "    \"false_positive_escalations_reduction_pct\": 27,\n",
        "    \"after_hours_toil_reduction_pct\": 31,\n",
        "}\n",
        "\n",
        "comparison = pd.DataFrame([\n",
        "    {\"metric\": \"MTTA (minutes)\", \"baseline\": baseline[\"mtta_minutes\"], \"pilot\": pilot[\"mtta_minutes\"]},\n",
        "    {\"metric\": \"MTTR Sev-2 (minutes)\", \"baseline\": baseline[\"mttr_sev2_minutes\"], \"pilot\": pilot[\"mttr_sev2_minutes\"]},\n",
        "    {\"metric\": \"Repeat incidents 30d (%)\", \"baseline\": baseline[\"repeat_incidents_30d_pct\"], \"pilot\": pilot[\"repeat_incidents_30d_pct\"]},\n",
        "    {\"metric\": \"Manual triage steps min\", \"baseline\": baseline[\"manual_triage_steps_min\"], \"pilot\": pilot[\"manual_triage_steps_min\"]},\n",
        "    {\"metric\": \"Manual triage steps max\", \"baseline\": baseline[\"manual_triage_steps_max\"], \"pilot\": pilot[\"manual_triage_steps_max\"]},\n",
        "])\n",
        "comparison[\"absolute_change\"] = comparison[\"pilot\"] - comparison[\"baseline\"]\n",
        "comparison[\"relative_change_pct\"] = ((comparison[\"pilot\"] - comparison[\"baseline\"]) / comparison[\"baseline\"] * 100).round(1)\n",
        "comparison"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Closed-loop operations model\n",
        "\n",
        "A core claim in the post is that operational AI needs a loop: observable signals, grounded interpretation, recommended or approved action, and post-action evidence. This cell encodes that loop as structured stages with owners, audit expectations, failure modes, and measurable effects."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "closed_loop = pd.DataFrame([\n",
        "    {\"stage\": \"Collect telemetry\", \"owner\": \"Observability\", \"audit_trail\": True, \"failure_mode\": \"stale or sparse signals\", \"service_effect\": \"faster detection\"},\n",
        "    {\"stage\": \"Detect or prioritize risk\", \"owner\": \"Platform Engineering\", \"audit_trail\": True, \"failure_mode\": \"mis-prioritized incidents\", \"service_effect\": \"reduced false escalations\"},\n",
        "    {\"stage\": \"Generate bounded recommendations\", \"owner\": \"SRE\", \"audit_trail\": True, \"failure_mode\": \"ungrounded advice\", \"service_effect\": \"fewer triage steps\"},\n",
        "    {\"stage\": \"Route to decision-maker\", \"owner\": \"Platform Engineering\", \"audit_trail\": True, \"failure_mode\": \"wrong escalation path\", \"service_effect\": \"lower MTTA\"},\n",
        "    {\"stage\": \"Execute approved action\", \"owner\": \"Service Owner\", \"audit_trail\": True, \"failure_mode\": \"unsafe automation\", \"service_effect\": \"lower MTTR\"},\n",
        "    {\"stage\": \"Measure result\", \"owner\": \"Service Owner\", \"audit_trail\": True, \"failure_mode\": \"no feedback loop\", \"service_effect\": \"repeat incident reduction\"},\n",
        "])\n",
        "closed_loop"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Escalation tiers for governed AI operations\n",
        "\n",
        "The implementation in the post uses explicit tiers to separate summarization, recommendation, bounded automation, and prohibited actions. This is a practical way to define decision rights before introducing automation."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "tiers = pd.DataFrame([\n",
        "    {\"tier\": 0, \"name\": \"Summarization and evidence gathering\", \"human_approval_required\": False, \"automation_allowed\": False},\n",
        "    {\"tier\": 1, \"name\": \"Recommendations only\", \"human_approval_required\": True, \"automation_allowed\": False},\n",
        "    {\"tier\": 2, \"name\": \"Bounded automation with rollback\", \"human_approval_required\": True, \"automation_allowed\": True},\n",
        "    {\"tier\": 3, \"name\": \"Prohibited actions\", \"human_approval_required\": True, \"automation_allowed\": False},\n",
        "])\n",
        "tiers"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Architecture sketch: policy before inference\n",
        "\n",
        "The blog emphasizes that the model call is only one component in a governed chain. This Python representation captures the same flow as the architecture diagram: policy and identity checks, routing, failover, grounding, safety, telemetry, and audit."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "architecture_flow = {\n",
        "    \"User Request\": [\"Policy + Identity Check\"],\n",
        "    \"Policy + Identity Check\": [\"Model Router\"],\n",
        "    \"Model Router\": [\"Primary Model Endpoint\"],\n",
        "    \"Primary Model Endpoint\": [\"Healthy?\"],\n",
        "    \"Healthy?\": [\"Grounding + Tool Calls\", \"Failover Model Endpoint\"],\n",
        "    \"Failover Model Endpoint\": [\"Grounding + Tool Calls\"],\n",
        "    \"Grounding + Tool Calls\": [\"Safety Filters\"],\n",
        "    \"Safety Filters\": [\"Response + Telemetry\"],\n",
        "    \"Response + Telemetry\": [\"Dashboards / Alerts / Audit\"],\n",
        "}\n",
        "\n",
        "for node, edges in architecture_flow.items():\n",
        "    print(f\"{node} -> {edges}\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Reliability-first client with timeout, retry, and fallback endpoint\n",
        "\n",
        "This example validates the reliability pattern from the post. To keep it runnable in a notebook, the code simulates endpoint behavior instead of calling external services, while preserving the same control flow: primary attempts, exponential backoff, and fallback."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "# Reliability-first client with timeout, retry, and fallback endpoint\n",
        "import time\n",
        "import random\n",
        "\n",
        "PRIMARY = \"https://primary.example.ai/infer\"\n",
        "FALLBACK = \"https://fallback.example.ai/infer\"\n",
        "PAYLOAD = {\"prompt\": \"Summarize this incident report in 3 bullets.\"}\n",
        "\n",
        "random.seed(7)\n",
        "\n",
        "def infer(url: str) -> dict:\n",
        "    # Simulated endpoint behavior for notebook validation\n",
        "    if \"primary\" in url:\n",
        "        outcome = random.choice([\"timeout\", \"error\", \"ok\"])\n",
        "        if outcome == \"timeout\":\n",
        "            raise TimeoutError(\"Primary endpoint timed out\")\n",
        "        if outcome == \"error\":\n",
        "            raise RuntimeError(\"Primary endpoint returned 5xx\")\n",
        "    return {\n",
        "        \"endpoint\": url,\n",
        "        \"summary\": [\n",
        "            \"Latency spike detected in payment API.\",\n",
        "            \"Recent deployment and downstream dependency both changed within 30 minutes.\",\n",
        "            \"Recommend dependency health check before rollback.\"\n",
        "        ]\n",
        "    }\n",
        "\n",
        "result = None\n",
        "for attempt in range(3):\n",
        "    try:\n",
        "        result = infer(PRIMARY)\n",
        "        print(f\"Primary succeeded on attempt {attempt + 1}\")\n",
        "        break\n",
        "    except Exception as e:\n",
        "        print(f\"Primary failed on attempt {attempt + 1}: {e}\")\n",
        "        time.sleep(2 ** attempt)\n",
        "else:\n",
        "    result = infer(FALLBACK)\n",
        "    print(\"Used fallback endpoint\")\n",
        "\n",
        "result"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Circuit breaker to stop hammering an unhealthy model endpoint\n",
        "\n",
        "A circuit breaker protects the rest of the system from cascading failure. This example opens the circuit after repeated failures, blocks calls during cooldown, and resets after a successful call."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "# Circuit breaker to stop hammering an unhealthy model endpoint\n",
        "import time\n",
        "\n",
        "failures = 0\n",
        "opened_at = 0.0\n",
        "threshold = 3\n",
        "cooldown_seconds = 5\n",
        "\n",
        "def can_call() -> bool:\n",
        "    return failures < threshold or (time.time() - opened_at) > cooldown_seconds\n",
        "\n",
        "def record_failure() -> None:\n",
        "    global failures, opened_at\n",
        "    failures += 1\n",
        "    if failures == threshold:\n",
        "        opened_at = time.time()\n",
        "\n",
        "def record_success() -> None:\n",
        "    global failures\n",
        "    failures = 0\n",
        "\n",
        "# Simulate a sequence of endpoint outcomes\n",
        "outcomes = [False, False, False, True, True]\n",
        "log = []\n",
        "\n",
        "for i, ok in enumerate(outcomes, start=1):\n",
        "    allowed = can_call()\n",
        "    if not allowed:\n",
        "        log.append({\"step\": i, \"allowed\": False, \"status\": \"blocked_by_circuit\", \"failures\": failures})\n",
        "        time.sleep(cooldown_seconds + 0.1)\n",
        "        allowed = can_call()\n",
        "    if allowed:\n",
        "        if ok:\n",
        "            record_success()\n",
        "            log.append({\"step\": i, \"allowed\": True, \"status\": \"success\", \"failures\": failures})\n",
        "        else:\n",
        "            record_failure()\n",
        "            log.append({\"step\": i, \"allowed\": True, \"status\": \"failure\", \"failures\": failures})\n",
        "\n",
        "pd.DataFrame(log)"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Structured telemetry for latency, token usage, and fallback events\n",
        "\n",
        "The post stresses that if you cannot measure latency, fallback rate, token usage, and action outcomes, you cannot manage the service. This example emits a structured event and then generates a small batch of events for analysis."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "# Structured telemetry for latency, token usage, and fallback events\n",
        "import json\n",
        "import time\n",
        "from uuid import uuid4\n",
        "import random\n",
        "\n",
        "request_id = str(uuid4())\n",
        "started = time.time()\n",
        "used_fallback = False\n",
        "prompt_tokens = 812\n",
        "completion_tokens = 146\n",
        "\n",
        "event = {\n",
        "    \"request_id\": request_id,\n",
        "    \"latency_ms\": int((time.time() - started) * 1000),\n",
        "    \"used_fallback\": used_fallback,\n",
        "    \"prompt_tokens\": prompt_tokens,\n",
        "    \"completion_tokens\": completion_tokens,\n",
        "    \"total_tokens\": prompt_tokens + completion_tokens,\n",
        "}\n",
        "print(json.dumps(event))\n",
        "\n",
        "random.seed(11)\n",
        "events = []\n",
        "for _ in range(25):\n",
        "    p = random.randint(300, 1200)\n",
        "    c = random.randint(80, 220)\n",
        "    fallback = random.random() < 0.16\n",
        "    latency = random.randint(400, 3500) + (700 if fallback else 0)\n",
        "    events.append({\n",
        "        \"request_id\": str(uuid4()),\n",
        "        \"latency_ms\": latency,\n",
        "        \"used_fallback\": fallback,\n",
        "        \"prompt_tokens\": p,\n",
        "        \"completion_tokens\": c,\n",
        "        \"total_tokens\": p + c,\n",
        "    })\n",
        "\n",
        "telemetry_df = pd.DataFrame(events)\n",
        "telemetry_df.head()"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Analyze telemetry: latency, fallback rate, and token usage\n",
        "\n",
        "This cell turns the structured events into reliability indicators. In a real deployment, these metrics should sit beside platform telemetry in the same observability estate."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "summary = {\n",
        "    \"requests\": len(telemetry_df),\n",
        "    \"avg_latency_ms\": round(telemetry_df[\"latency_ms\"].mean(), 1),\n",
        "    \"p95_latency_ms\": round(telemetry_df[\"latency_ms\"].quantile(0.95), 1),\n",
        "    \"fallback_rate_pct\": round(telemetry_df[\"used_fallback\"].mean() * 100, 2),\n",
        "    \"avg_total_tokens\": round(telemetry_df[\"total_tokens\"].mean(), 1),\n",
        "}\n",
        "summary"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "ax = telemetry_df[\"latency_ms\"].plot(kind=\"hist\", bins=10, title=\"Inference Latency Distribution\", figsize=(7,4))\n",
        "ax.set_xlabel(\"Latency (ms)\")\n",
        "plt.show()\n",
        "\n",
        "ax = telemetry_df.groupby(\"used_fallback\")[\"latency_ms\"].mean().plot(kind=\"bar\", title=\"Average Latency by Fallback Usage\", figsize=(6,4))\n",
        "ax.set_ylabel(\"Average latency (ms)\")\n",
        "ax.set_xlabel(\"Used fallback\")\n",
        "plt.show()"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Health probe for AI endpoints with simple SLA-style output\n",
        "\n",
        "The original post includes a PowerShell health probe. This Python version checks endpoint health in a notebook-friendly way by simulating responses and producing SLA-style records."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "from datetime import datetime\n",
        "import random\n",
        "\n",
        "endpoints = [\n",
        "    \"https://primary.example.ai/health\",\n",
        "    \"https://fallback.example.ai/health\",\n",
        "]\n",
        "\n",
        "random.seed(21)\n",
        "health_rows = []\n",
        "for url in endpoints:\n",
        "    healthy = random.choice([True, True, False])\n",
        "    status_code = 200 if healthy else 0\n",
        "    health_rows.append({\n",
        "        \"Endpoint\": url,\n",
        "        \"StatusCode\": status_code,\n",
        "        \"Healthy\": healthy,\n",
        "        \"CheckedAt\": datetime.utcnow().isoformat(timespec=\"seconds\"),\n",
        "    })\n",
        "\n",
        "health_df = pd.DataFrame(health_rows)\n",
        "health_df"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Sequence of primary and fallback routing\n",
        "\n",
        "This example mirrors the sequence diagram in the post. It simulates an app sending an inference request to a router, which tries the primary model first and then falls back if needed, while emitting observability events."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "random.seed(5)\n",
        "\n",
        "sequence_log = []\n",
        "request_id = str(uuid4())\n",
        "sequence_log.append({\"actor\": \"App\", \"action\": \"Inference request\", \"target\": \"Router\", \"request_id\": request_id})\n",
        "sequence_log.append({\"actor\": \"Router\", \"action\": \"Send prompt\", \"target\": \"Primary Model\", \"request_id\": request_id})\n",
        "\n",
        "primary_healthy = random.choice([True, False])\n",
        "if primary_healthy:\n",
        "    sequence_log.append({\"actor\": \"Primary Model\", \"action\": \"Response\", \"target\": \"Router\", \"request_id\": request_id})\n",
        "else:\n",
        "    sequence_log.append({\"actor\": \"Primary Model\", \"action\": \"Timeout / 5xx\", \"target\": \"Router\", \"request_id\": request_id})\n",
        "    sequence_log.append({\"actor\": \"Router\", \"action\": \"Retry on fallback\", \"target\": \"Secondary Model\", \"request_id\": request_id})\n",
        "    sequence_log.append({\"actor\": \"Secondary Model\", \"action\": \"Response\", \"target\": \"Router\", \"request_id\": request_id})\n",
        "\n",
        "sequence_log.append({\"actor\": \"Router\", \"action\": \"Emit latency, errors, fallback metric\", \"target\": \"Observability\", \"request_id\": request_id})\n",
        "sequence_log.append({\"actor\": \"Router\", \"action\": \"Final response\", \"target\": \"App\", \"request_id\": request_id})\n",
        "\n",
        "pd.DataFrame(sequence_log)"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Guardrail check to reject unsafe output before it reaches users\n",
        "\n",
        "The blog makes the architectural point that safety enforcement belongs inline, before output is trusted or executed. This example blocks responses containing simple PII patterns."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "# Guardrail check to reject unsafe output before it reaches users\n",
        "import re\n",
        "\n",
        "response_text = \"Here is the answer with customer email: alice@example.com\"\n",
        "pii_patterns = [r\"\\b[\\w\\.-]+@[\\w\\.-]+\\.\\w+\\b\", r\"\\b\\d{3}-\\d{2}-\\d{4}\\b\"]\n",
        "\n",
        "def is_safe(text: str) -> bool:\n",
        "    return not any(re.search(pattern, text) for pattern in pii_patterns)\n",
        "\n",
        "final_text = response_text if is_safe(response_text) else \"Response blocked by safety policy.\"\n",
        "print(final_text)\n",
        "\n",
        "samples = [\n",
        "    \"System healthy. No customer data present.\",\n",
        "    \"Contact user at alice@example.com for verification.\",\n",
        "    \"SSN observed: 123-45-6789 in payload.\",\n",
        "    \"Rollback approved after dependency checks passed.\",\n",
        "]\n",
        "\n",
        "results = pd.DataFrame({\n",
        "    \"text\": samples,\n",
        "    \"safe\": [is_safe(t) for t in samples]\n",
        "})\n",
        "results"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Prompt handling flow with auth, quota, inference, safety, and audit\n",
        "\n",
        "This Python representation mirrors the second flowchart from the post. It shows how a request should move through authentication, authorization, quota checks, inference, safety scanning, and audit logging."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "def process_prompt(prompt: str, authorized: bool = True, quota_remaining: int = 10) -> Dict[str, Any]:\n",
        "    audit = []\n",
        "    audit.append(\"Authenticate + Authorize\")\n",
        "    if not authorized:\n",
        "        return {\"status\": \"denied\", \"reason\": \"unauthorized\", \"audit\": audit + [\"Audit Log\"]}\n",
        "\n",
        "    audit.append(\"Quota / Rate Limit\")\n",
        "    if quota_remaining <= 0:\n",
        "        return {\"status\": \"denied\", \"reason\": \"quota_exceeded\", \"audit\": audit + [\"Audit Log\"]}\n",
        "\n",
        "    audit.append(\"Inference\")\n",
        "    raw_response = f\"Model response for: {prompt}\"\n",
        "\n",
        "    audit.append(\"Safety + PII Scan\")\n",
        "    if not is_safe(raw_response):\n",
        "        return {\"status\": \"blocked\", \"response\": \"Block / Redact\", \"audit\": audit + [\"Audit Log\"]}\n",
        "\n",
        "    return {\"status\": \"ok\", \"response\": raw_response, \"audit\": audit + [\"Audit Log\"]}\n",
        "\n",
        "process_prompt(\"Summarize payment API incident in 3 bullets.\")"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Alert when fallback rate exceeds a reliability threshold\n",
        "\n",
        "The post includes a simple threshold-based alert for fallback rate. This Python version uses the telemetry generated earlier to determine whether the fallback rate exceeds an enterprise threshold."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "fallback_events = int(telemetry_df[\"used_fallback\"].sum())\n",
        "total_requests = int(len(telemetry_df))\n",
        "threshold = 0.05\n",
        "\n",
        "rate = (fallback_events / total_requests) if total_requests > 0 else 0\n",
        "\n",
        "if rate > threshold:\n",
        "    print(f\"ALERT: Fallback rate {rate:.2%} exceeds threshold {threshold:.2%}\")\n",
        "else:\n",
        "    print(f\"OK: Fallback rate {rate:.2%}\")\n",
        "\n",
        "{\"fallback_events\": fallback_events, \"total_requests\": total_requests, \"rate\": rate, \"threshold\": threshold}"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Simulate incident triage outcomes and service impact\n",
        "\n",
        "The blog's main point is that value comes from reducing ambiguity and improving service outcomes. This simulation creates incident records to compare baseline handling with a governed AI-assisted loop."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "random.seed(42)\n",
        "\n",
        "n = 60\n",
        "rows = []\n",
        "for i in range(n):\n",
        "    severity = random.choice([\"sev2\", \"sev3\"])\n",
        "    baseline_ack = max(1, int(random.gauss(11, 2)))\n",
        "    pilot_ack = max(1, int(random.gauss(6, 1.5)))\n",
        "    baseline_mitigate = max(10, int(random.gauss(96 if severity == \"sev2\" else 70, 15)))\n",
        "    pilot_mitigate = max(8, int(random.gauss(54 if severity == \"sev2\" else 48, 10)))\n",
        "    baseline_steps = random.randint(5, 8)\n",
        "    pilot_steps = random.randint(2, 3)\n",
        "    rows.append({\n",
        "        \"incident_id\": f\"INC-{1000+i}\",\n",
        "        \"severity\": severity,\n",
        "        \"baseline_ack_min\": baseline_ack,\n",
        "        \"pilot_ack_min\": pilot_ack,\n",
        "        \"baseline_mitigate_min\": baseline_mitigate,\n",
        "        \"pilot_mitigate_min\": pilot_mitigate,\n",
        "        \"baseline_steps\": baseline_steps,\n",
        "        \"pilot_steps\": pilot_steps,\n",
        "    })\n",
        "\n",
        "incidents_df = pd.DataFrame(rows)\n",
        "incidents_df.head()"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "impact = {\n",
        "    \"baseline_mtta\": round(incidents_df[\"baseline_ack_min\"].mean(), 1),\n",
        "    \"pilot_mtta\": round(incidents_df[\"pilot_ack_min\"].mean(), 1),\n",
        "    \"baseline_mttr\": round(incidents_df[\"baseline_mitigate_min\"].mean(), 1),\n",
        "    \"pilot_mttr\": round(incidents_df[\"pilot_mitigate_min\"].mean(), 1),\n",
        "    \"baseline_steps\": round(incidents_df[\"baseline_steps\"].mean(), 1),\n",
        "    \"pilot_steps\": round(incidents_df[\"pilot_steps\"].mean(), 1),\n",
        "}\n",
        "impact"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "plot_df = pd.DataFrame([\n",
        "    {\"metric\": \"MTTA\", \"baseline\": impact[\"baseline_mtta\"], \"pilot\": impact[\"pilot_mtta\"]},\n",
        "    {\"metric\": \"MTTR\", \"baseline\": impact[\"baseline_mttr\"], \"pilot\": impact[\"pilot_mttr\"]},\n",
        "    {\"metric\": \"Triage Steps\", \"baseline\": impact[\"baseline_steps\"], \"pilot\": impact[\"pilot_steps\"]},\n",
        "]).set_index(\"metric\")\n",
        "\n",
        "ax = plot_df.plot(kind=\"bar\", figsize=(8,4), title=\"Baseline vs Governed AI-Assisted Pilot\")\n",
        "ax.set_ylabel(\"Value\")\n",
        "plt.xticks(rotation=0)\n",
        "plt.show()"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Decision rights and ownership matrix\n",
        "\n",
        "The post stresses that multi-agent or orchestrated systems fail when authority boundaries are unclear. This matrix makes ownership explicit across observability, platform engineering, SRE, security, and service owners."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "ownership = pd.DataFrame([\n",
        "    {\"function\": \"Signal quality and freshness\", \"owner\": \"Observability Team\"},\n",
        "    {\"function\": \"Routing and action boundaries\", \"owner\": \"Platform Engineering\"},\n",
        "    {\"function\": \"Runbooks and escalation logic\", \"owner\": \"SRE\"},\n",
        "    {\"function\": \"Access and approval controls\", \"owner\": \"Security\"},\n",
        "    {\"function\": \"Business outcome and rollback authority\", \"owner\": \"Service Owners\"},\n",
        "])\n",
        "ownership"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Governance checklist for production readiness\n",
        "\n",
        "A repeated theme in the post is that accountable action is expensive because governance must sit inside the loop. Use this checklist to assess whether a use case is ready for bounded automation."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "governance_checklist = pd.DataFrame([\n",
        "    {\"question\": \"Which data can the system access?\", \"ready\": True},\n",
        "    {\"question\": \"Which actions can it recommend?\", \"ready\": True},\n",
        "    {\"question\": \"Which actions can it execute?\", \"ready\": False},\n",
        "    {\"question\": \"Who approves exceptions?\", \"ready\": True},\n",
        "    {\"question\": \"Where is the decision record retained?\", \"ready\": True},\n",
        "    {\"question\": \"What evidence is required before escalation?\", \"ready\": True},\n",
        "    {\"question\": \"What rollback path is mandatory?\", \"ready\": False},\n",
        "])\n",
        "\n",
        "governance_checklist"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Team self-rating: governed reliability loop maturity\n",
        "\n",
        "The blog ends with a practical question: how close is your team to a governed reliability loop where AI recommendations are grounded, approved, auditable, and tied to MTTR or incident reduction? Run this quick scoring helper to estimate current maturity."
      ]
    },
    {
      "cell_type": "code",
      "metadata": {},
      "source": [
        "criteria = {\n",
        "    \"grounded_in_live_telemetry\": 1,\n",
        "    \"human_approval_defined\": 1,\n",
        "    \"audit_trail_present\": 1,\n",
        "    \"safety_checks_inline\": 1,\n",
        "    \"service_outcomes_measured\": 1,\n",
        "}\n",
        "\n",
        "score = sum(criteria.values())\n",
        "print(f\"Team maturity score: {score}/5\")\n",
        "\n",
        "maturity_levels = {\n",
        "    1: \"Ad hoc assistance only\",\n",
        "    2: \"Some grounding, weak controls\",\n",
        "    3: \"Governed recommendations emerging\",\n",
        "    4: \"Closed-loop operations for narrow use cases\",\n",
        "    5: \"Reliable, auditable, outcome-driven operational AI\",\n",
        "}\n",
        "print(maturity_levels.get(score, \"Unknown\"))"
      ],
      "execution_count": null,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## References\n",
        "\n",
        "- Azure Architecture Center: https://learn.microsoft.com/en-us/azure/architecture/\n",
        "- Microsoft Compliance: https://learn.microsoft.com/en-us/compliance/\n",
        "- Cloud Adoption Framework: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/\n",
        "- Azure Well-Architected Framework: https://learn.microsoft.com/en-us/azure/well-architected/\n",
        "- Cloud Design Patterns: https://learn.microsoft.com/en-us/azure/architecture/patterns/\n",
        "- Azure DevOps MCP Server overview: https://learn.microsoft.com/en-us/azure/devops/mcp-server/mcp-server-overview\n",
        "- Microsoft Defender for Cloud overview: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction\n",
        "- AI strategy guidance: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai/strategy"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {},
      "source": [
        "## Next Steps\n",
        "\n",
        "- Replace simulated endpoints with your internal inference gateway or Azure-hosted model endpoints.\n",
        "- Send structured telemetry into your existing observability platform and track latency, fallback rate, token usage, approvals, and action outcomes.\n",
        "- Start with one narrow, high-frequency use case such as sev-2 triage or noisy alert clustering.\n",
        "- Define decision rights, rollback rules, and prohibited actions before enabling any automation.\n",
        "- Review the design against reliability, security, and operability goals rather than model novelty."
      ]
    }
  ]
}