Enterprise Azure hub-spoke-hub topology for the AI Citadel Governance Hub, featuring Azure Firewall Premium, API Management, and AI Foundry with environment-specific SKU configurations. Traffic flows from workload agents through the firewall to APIM, then to AI safety/PII services and Azure OpenAI Foundry via private endpoints, with all diagnostics routed to Log Analytics and Sentinel. This architecture demonstrates zero-trust principles, private endpoint enforcement, and centralized governance across development, test, and production environments. Fork this diagram on Diagrams.so to customize DNS zones, firewall rules, or add your own workload spokes. The design leverages Bicep infrastructure-as-code and Entra ID for identity management across all tiers.