The installer

One installer, one invocation, run once by your administrator with a configuration prepared at onboarding: your feed mappings, your integration contracts, your policy file, and the names of the mailbox and the library. Each installation generates its own runbook from the installer: what it creates, what it grants, what it verifies, and what your compliance reviewer will find in the template. This page is the standard one.

Before it runs

• An administrator who holds both the Azure resource-group role and the Microsoft 365 rights to grant the scopes below. The installer checks this before it starts.
• GPU quota in your subscription for the Azure Container Apps serverless GPU profile, A100 80 GB.
• Write access to your system of record, confirmed at onboarding: ICE MSP through your Interchange and DIS access, or Sagent's write APIs. It is a prerequisite.
• The credentials for your servicing system, claims tool and imaging system, which the installer takes into your Key Vault.

What it creates

Every resource, in one resource group, from one template:

• A virtual network with subnets for the container environment and the private endpoints, and network security groups that deny all inbound.
• An Azure Container Registry, Premium, with a private endpoint, and the signed image imported into it by digest.
• An Azure Container Apps environment on the consumption plan with two apps: the service on CPU at one replica, and the reader on the serverless GPU profile, scaled from zero by the length of its queue.
• An Azure Storage account with private endpoints for blob and queue.
• Azure Database for PostgreSQL Flexible Server with a private endpoint.
• Key Vault with a private endpoint.
• Log Analytics, with no borrower identifier and no document body in any log.
• A user-assigned managed identity with the roles it needs and nothing else, and the private DNS zones the endpoints need.

What it grants

• To the managed identity: an Exchange Application RBAC role assignment, Application Mail.Read and Application Mail.Send, scoped to the one mailbox, and Lists.SelectedOperations.Selected on the one document library. Nothing broader, and no tenant-wide Graph mail permission.
• To anyone outside your tenant: nothing. There is no role assignment to any outside identity.

What it verifies

Before it starts processing, every access and every connection: each feed location is readable; the system of record's write interface is entitled and accepts a test write; the claims tool and the imaging system are reachable; the mailbox and the library are reachable; the GPU quota is present.

If a prerequisite is missing it says which, stops, and continues from that step when it is run again.

When it starts

It bootstraps the database and starts processing. The first run is the backfill: your existing default caseload, every document read once, then the steady state. Nobody assembles anything by hand, and nothing needs a daily administrator.

The image

A pinned base, the model's weights as layers pinned by digest, and every dependency prepackaged. It is signed with cosign, carries SLSA provenance from an isolated build and a CISA-conformant SBOM, and is scanned for vulnerabilities on every build. Your team can verify the signature and the SBOM before the installer runs.

What it costs to run

It runs on your Azure bill. The reader runs only while a batch of documents is being read and scales to zero between batches; the always-on part is a small CPU service. At East US retail rates on 22 September 2026:

The tested requirement is under $600 a month on a 20,000-loan workload, measured over three real days in a real subscription, with start-up, model loading and shutdown counted as billed time. Each installation generates its own cost report from its measured figures.