{
  "diagramName": "Agentic Harness — Production Tier",
  "region": "eastus",
  "viewMode": "2d",
  "services": [
    { "serviceType": "ddos-protection", "displayName": "DDoS Protection", "description": "Standard plan on the production VNet. Front Door Premium origins also benefit." },
    { "serviceType": "front-door", "displayName": "Front Door (prod)", "description": "Premium SKU. Global entry, WAF, TLS, private-link origins to AgentHub + Dashboard." },
    { "serviceType": "api-management", "displayName": "APIM (prod)", "description": "Standard v2 tier. Fronts MCP server with JWT validation, rate limit, quota policies, and version routing." },
    { "serviceType": "container-apps", "displayName": "AgentHub (prod)", "description": "Web host. Multi-replica, KEDA autoscale on SignalR connections + plan executor queue depth." },
    { "serviceType": "container-apps", "displayName": "MCP Server (prod)", "description": "MCPServer Container App. Separate scaling profile from AgentHub." },
    { "serviceType": "static-web-app", "displayName": "Dashboard (prod)", "description": "SPA served behind Front Door with private-link origin." },
    { "serviceType": "azure-openai", "displayName": "Azure OpenAI (prod)", "description": "PTU primary + S1 burst. Polly circuit breaker + provider fallback chain. Private endpoint, public network disabled." },
    { "serviceType": "ai-search", "displayName": "AI Search (prod)", "description": "Standard S2. Vector + BM25. Replicas for HA, partitions for scale." },
    { "serviceType": "aks", "displayName": "Neo4j / KG (prod)", "description": "Neo4j Enterprise on AKS. Causal cluster, zone-redundant, persistent volumes for graph store. ComplianceAwareGraphStore + TenantIsolatedGraphStore on top." },
    { "serviceType": "azure-sql", "displayName": "Azure SQL (prod)", "description": "Plan state. Business Critical, zone-redundant, automated point-in-time restore." },
    { "serviceType": "redis-cache", "displayName": "Redis Cache (prod)", "description": "AgentConversationCache + skill metadata + content safety result cache. Standard C1." },
    { "serviceType": "storage-account", "displayName": "Storage (prod)", "description": "Geo-redundant (RA-GRS) with lifecycle management auto-tiering ingestion staging to Cool after 30 days and Archive after 180. AG-UI artifacts, escalation JSONL audit, ErasureReceipt records." },
    { "serviceType": "key-vault", "displayName": "Key Vault (prod)", "description": "Premium (HSM-backed keys). Private endpoint, RBAC, soft delete + purge protection, customer-managed keys for storage + SQL." },
    { "serviceType": "entra-id", "displayName": "Entra ID", "description": "Identity. Conditional access, MFA enforced for approver roles in escalation flows." },
    { "serviceType": "log-analytics", "displayName": "Log Analytics (prod)", "description": "Centralized observability workspace. 90-day retention, exported to long-term cold storage." },
    { "serviceType": "application-insights", "displayName": "App Insights (prod)", "description": "OTel exporter target. Sampling tuned for prod cost. GenAi semconv attributes from GenAiSemconvRegistry." }
  ],
  "connections": [
    { "source": "DDoS Protection", "target": "Front Door (prod)", "connectionType": "public" },
    { "source": "Front Door (prod)", "target": "AgentHub (prod)", "connectionType": "private-endpoint" },
    { "source": "Front Door (prod)", "target": "Dashboard (prod)", "connectionType": "private-endpoint" },
    { "source": "Front Door (prod)", "target": "APIM (prod)", "connectionType": "public" },
    { "source": "APIM (prod)", "target": "MCP Server (prod)", "connectionType": "vnet-integration" },
    { "source": "Dashboard (prod)", "target": "AgentHub (prod)", "connectionType": "private-endpoint" },
    { "source": "AgentHub (prod)", "target": "Azure OpenAI (prod)", "connectionType": "private-endpoint" },
    { "source": "AgentHub (prod)", "target": "AI Search (prod)", "connectionType": "private-endpoint" },
    { "source": "AgentHub (prod)", "target": "Neo4j / KG (prod)", "connectionType": "vnet-integration" },
    { "source": "AgentHub (prod)", "target": "Azure SQL (prod)", "connectionType": "private-endpoint" },
    { "source": "AgentHub (prod)", "target": "Redis Cache (prod)", "connectionType": "private-endpoint" },
    { "source": "AgentHub (prod)", "target": "Storage (prod)", "connectionType": "private-endpoint" },
    { "source": "AgentHub (prod)", "target": "Key Vault (prod)", "connectionType": "private-endpoint" },
    { "source": "AgentHub (prod)", "target": "Entra ID", "connectionType": "public" },
    { "source": "MCP Server (prod)", "target": "Azure OpenAI (prod)", "connectionType": "private-endpoint" },
    { "source": "MCP Server (prod)", "target": "Key Vault (prod)", "connectionType": "private-endpoint" },
    { "source": "MCP Server (prod)", "target": "Entra ID", "connectionType": "public" },
    { "source": "AgentHub (prod)", "target": "App Insights (prod)", "connectionType": "vnet-integration" },
    { "source": "MCP Server (prod)", "target": "App Insights (prod)", "connectionType": "vnet-integration" },
    { "source": "Neo4j / KG (prod)", "target": "Key Vault (prod)", "connectionType": "private-endpoint" },
    { "source": "Neo4j / KG (prod)", "target": "App Insights (prod)", "connectionType": "vnet-integration" },
    { "source": "App Insights (prod)", "target": "Log Analytics (prod)", "connectionType": "public" }
  ]
}