Microsoft Foundry SDK for Java 2

Apply the Java 25 baseline first for Java 25 applications. These rules cover the com.azure:azure-ai-projects 2 major line, its separate com.azure:azure-ai-agents integration, and the Foundry v1 service API. The SDK itself supports JDK 8 and later.

Project clients and identity

• Give AIProjectClientBuilder and AgentsClientBuilder a trusted HTTPS project endpoint and an explicit TokenCredential. Keep the resource, project, cloud authority, and credential selection in deployment configuration; never derive them from a request, model output, or retrieved document.
• Use a deliberately selected managed or workload identity for deployed clients. If DefaultAzureCredential is retained, constrain its chain to deployed credentials and reject a missing selection so a developer or environment credential cannot silently become the production principal.
• Declare Azure Identity as an application dependency when using its credentials; the Projects artifact lists it only for tests.
• Grant separate principals the minimum Foundry rights for agent invocation, project administration, connection management, evaluations, and tool execution. Check the actual downstream identity and resource scope; a project role does not authorize a tool's action for an application user.
• Authorize the agent name before passing it to buildAgentScopedOpenAIClient or the async variant. Restrict who can create an agent version, change its default, enable it, or change its endpoint; these operations can change the code and tools reached by an existing application.
• Build RequestOptions, raw