AI-103: Developing AI Apps and Agents on Azure

A system-assigned managed identity eliminates the need for stored credentials such as access keys, satisfying the keyless-credentials requirement. Scoping the managed identity to the project (rather than the whole Foundry resource) keeps the identity's permissions and blast radius as narrow as possible, which aligns with least privilege. For Key Vault access, Azure RBAC is the modern, recommended authorization model over the legacy access-policy model; the built-in 'Key Vault Secrets User' role grants only the ability to read (get/list) secret contents, without granting rights to manage the vault or other object types, making it the least-privileged role assignment needed for the agent's managed identity to retrieve secrets.