[Knowledge] frontend-app: ## Advisory Notes — Stage 1: Managed Identity - **[Architec...

Create knowledge/services/frontend-app.md, using the issue's required sections and the build advisory review as the source. Cover the requested managed identity guidance, Terraform and Bicep patterns, applicable Python, C#, and Node.js application code, pitfalls, and production backlog items; done means all eight sections are present and documented.

Knowledge Contribution

Type: New service
File: knowledge/services/frontend-app.md
Status: NEW FILE — this knowledge file does not exist yet and must be created

Context

Advisory Notes — Stage 1: Managed Identity

• [Architectural Trade-off] A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permissions are over-scoped in later stages, every service inherits that exposure. Consider per-service identities for production least-privilege isolation.

• [Security] No resource lock is applied to the managed identity. Accidental deletion would orphan all downstream RBAC assignments and break ev

Rationale

Advisory Notes — Stage 1: Managed Identity

• [Architectural Trade-off] A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permissions are over-scoped in later stages, every service inherits that exposure. Consider per-service identities for production least-privilege isolation.

• [Security] No resource lock is applied to the managed identity. Accidental deletion would orphan all downstream RBAC assignments and break ev

Content to Add

## Advisory Notes — Stage 1: Managed Identity

- **[Architectural Trade-off]** A single shared identity across all Container Apps simplifies wiring but increases blast radius — if the identity's permi

Source

Build advisory review

Required Knowledge File Sections

The new knowledge file MUST include ALL of these sections:

1. Description (one-line summary)
2. When to Use (scenarios and selection criteria)
3. POC Defaults (default SKU, tier, configuration)
4. Terraform Patterns (azapi_resource with RBAC)
5. Bicep Patterns (ARM template resources)
6. Application Code (Python, C#, Node.js — where applicable)
7. Common Pitfalls (deployment failures, misconfigurations)
8. Production Backlog Items (what changes for production)