Guardrails

1. Resolve the hierarchy from management group through subscription and resource group. Include inherited policy assignments and identify the assignment scope, excluded scopes, exemptions, initiative, definition, parameters, and enforcementMode.
2. Use generate_query, validate_query, then execute_query for assignments and resource inventory. Use the Azure Policy API fallback when Resource Graph does not expose exemptions, compliance state, or definition details.
3. Report Default assignments as enforced only when the resource is in scope and not exempt. Report DoNotEnforce as audit-only. Distinguish deny, audit, modify, append, and deploy effects rather than claiming every assignment blocks deployment.

Evaluate Coverage

4. For SKU and location controls, resolve the effective allowed or denied values after assignment parameters and exemptions. Mark a proposed resource as allowed, denied, audit-only, or unknown.
5. Query inventory for the organization’s exact cost-allocation tag keys. Confirm casing and accepted values. Separate a missing tag, invalid value, inherited tag, and policy remediation that has not completed.
6. Call list_budgets at supported scopes. Build a coverage matrix showing which subscriptions or resource groups have enforced policy, compliant tags, and a budget. Do not treat a parent budget as a child budget unless its scope and filters actually cover that child.

Report

Present the effective assignment, source scope, inheritance, exclusions, exemptions, effect, parameters, compliance evidence, tag gaps, budget coverage, affected resources, confidence, and owner action.

An empty Resource Graph result may reflect permissions or scope visibility. State that uncertainty instead of claiming no guardrails exist.