What problem does it solve? Manually auditing Azure Policy assignments across subscriptions and management groups is slow and error-prone, and pulling raw REST responses into an AI agent's context wastes tokens. This Skill runs a deterministic Python script that inventories effective policy assignments, classifies their effects, and writes a machine-readable governance-constraints JSON envelope that downstream IaC planning and code generation agents can consume directly. ## Core Features & Use Cases - Batched Policy Discovery: Lists policy assignments (including management-group inherited), definitions, set definitions, and exemptions via parallel Azure REST calls with a cached ARM token. - Effect Classification: Classifies findings as blocker, auto-remediate, or informational, downgrades exempted Deny policies, and filters Defender for Cloud auto-assignments by default. - Schema-Compliant Output: Emits a governance-constraints-v1 JSON envelope with property paths, required tags, allowed locations, and an L0 discovery attestation envelope, plus a Markdown preview artifact. - Use Case: Before generating Bicep or Terraform for a new Azure project, run the discovery script to produce 04-governance-constraints.json so the planning agent knows which policies block deployment, which tags are mandatory, and which regions are allowed. ## Quick Start Ask the agent to run governance discovery for your project by executing the discover.py script with your project name and an output path under agent-output.
