citadel-governance-hub
Provides access to the layout, conventions, and infrastructure files for the Citadel Governance Hub branch.
Install
mkdir -p .claude/skills/citadel-governance-hub && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/15861" && unzip -o skill.zip -d .claude/skills/citadel-governance-hub && rm skill.zipInstalls to .claude/skills/citadel-governance-hub
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Layout, conventions, and key files of the Citadel Governance Hub (citadel-v1 branch of ai-hub-gateway-solution-accelerator).Key capabilities
- →Bootstrap a new project using `azd init` with a specific template and branch
- →Identify the Infrastructure as Code (IaC) root directory
- →Locate the top-level orchestrator Bicep file
- →Find API definitions within the APIM service modules
- →Identify reusable XML policy fragments for APIM
How it works
This skill provides a guide to the Citadel Governance Hub by mapping its key file paths, APIM policy fragments, and deployment scripts. It specifies the `citadel-v1` branch as the authoritative source and outlines bootstrap procedures.
Inputs & outputs
When to use citadel-governance-hub
- →Init the Citadel project
- →Modify APIM API definitions
- →Update deployment budgets
- →Implement JWT authentication fragments
About this skill
Citadel Governance Hub
Upstream: Azure-Samples/ai-hub-gateway-solution-accelerator@citadel-v1. Branch is ~251 commits ahead of main and rebranded "Citadel Governance Hub". Always reference citadel-v1, never main.
Bootstrap
azd init --template Azure-Samples/ai-hub-gateway-solution-accelerator \
-e citadel-budgets-dev \
--branch citadel-v1
Key paths
| Path | What it is |
|---|---|
bicep/infra/ | IaC root (NOT infra/) |
bicep/infra/main.bicep | Top-level orchestrator |
bicep/infra/modules/apim/apim.bicep | APIM service + fragment registration block |
bicep/infra/modules/apim/apis/ | API definitions (Unified AI Wildcard lives here) |
bicep/infra/modules/apim/policies/ | Reusable XML fragments |
bicep/infra/citadel-access-contracts/citadel-tiers/ | Tier contracts |
bicep/infra/citadel-access-contracts/user-overrides/ | Per-user contract overlays |
bicep/infra/citadel-access-contracts/_shared/budget-seed.bicep | Deployment-script seeder |
src/usage-ingestion-logicapp/ | Logic App workflow JSON (ingestion target) |
validation/citadel-jwt-authentication-tests.ipynb | JWT acceptance harness |
Reusable APIM fragments (already in upstream)
frag-aad-auth.xml— Entra JWT validation pattern.frag-ai-usage.xml— non-streaming usage emission to Event Hub.frag-openai-usage-streaming.xml— SSE streaming usage capture.
Existing Cosmos containers (do not change PKs)
ai-usage-container— PK/productNamemodel-pricingpii-usage-containerstreaming-export-config
What Citadel adds (this fork)
- Anthropic surface (
POST /v1/messages+ SSE). - Pass-through Entra JWT (D1).
- Hybrid tier + per-user × per-model budgets (D2).
- Cosmos containers:
ai-usage-monthly,budgets,user-tier. - Soft + hard budget enforcement with
adminOverridebypass. - PBIX schema extension (no Fabric in POC).
When not to use it
- →The task is not related to the Citadel Governance Hub
- →The task involves modifying the `main` branch of the upstream repository
- →The task is about database schema evolution without API surface impact
Limitations
- →Always reference `citadel-v1`, never `main`
- →Do not change existing Cosmos container Partition Keys
- →The skill focuses on the `citadel-v1` branch of `ai-hub-gateway-solution-accelerator`
How it compares
This workflow provides a specific architectural and file layout guide for the Citadel Governance Hub, detailing its unique branch, IaC structure, and APIM configurations, which is distinct from generic Azure AI hub solutions.
Compared to similar skills
citadel-governance-hub side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| citadel-governance-hub (this skill) | 0 | 3mo | No flags | Intermediate |
| cloud-architect | 6 | 4mo | No flags | Advanced |
| azure-deployment-preflight | 7 | 6mo | Review | Advanced |
| terraform-azurerm-set-diff-analyzer | 5 | 6mo | Review | Beginner |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
cloud-architect
sickn33
Expert cloud architect specializing in AWS/Azure/GCP multi-cloud infrastructure design, advanced IaC (Terraform/OpenTofu/CDK), FinOps cost optimization, and modern architectural patterns. Masters serverless, microservices, security, compliance, and disaster recovery. Use PROACTIVELY for cloud architecture, cost optimization, migration planning, or multi-cloud strategies.
azure-deployment-preflight
github
Performs comprehensive preflight validation of Bicep deployments to Azure, including template syntax validation, what-if analysis, and permission checks. Use this skill before any deployment to Azure to preview changes, identify potential issues, and ensure the deployment will succeed. Activate when users mention deploying to Azure, validating Bicep files, checking deployment permissions, previewing infrastructure changes, running what-if, or preparing for azd provision.
terraform-azurerm-set-diff-analyzer
github
Analyze Terraform plan JSON output for AzureRM Provider to distinguish between false-positive diffs (order-only changes in Set-type attributes) and actual resource changes. Use when reviewing terraform plan output for Azure resources like Application Gateway, Load Balancer, Firewall, Front Door, NSG, and other resources with Set-type attributes that cause spurious diffs due to internal ordering changes.
hybrid-cloud-networking
wshobson
Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.
database-admin
sickn33
Expert database administrator specializing in modern cloud databases, automation, and reliability engineering. Masters AWS/Azure/GCP database services, Infrastructure as Code, high availability, disaster recovery, performance optimization, and compliance. Handles multi-cloud strategies, container databases, and cost optimization. Use PROACTIVELY for database architecture, operations, or reliability engineering.
hybrid-cloud-architect
sickn33
Expert hybrid cloud architect specializing in complex multi-cloud solutions across AWS/Azure/GCP and private clouds (OpenStack/VMware). Masters hybrid connectivity, workload placement optimization, edge computing, and cross-cloud automation. Handles compliance, cost optimization, disaster recovery, and migration strategies. Use PROACTIVELY for hybrid architecture, multi-cloud strategy, or complex infrastructure integration.