LOCKEDIN / FORWARD-DEPLOYED ENGINEERING 101
Understand it.
Then build it.
You can be an experienced engineer and still be new to agents. Start with what each thing is and how it helps a person do useful work. Explore 58 original introductions across software, agents, cloud, security and delivery. Start here without a model key; each topic connects to deeper instruction and practice.
A place to start.
Choose a short reading route, or look up a concept below.
- 101UnderstandPlain language, visual walkthrough, vocabulary
- 102Build with guidanceOriginal lessons, examples and knowledge checks
- 103Practise and explainRunnable labs, failure cases and handover
Plan a cloud deployment
Locate the application, its data and the responsibilities shared with a cloud provider.
See the 7-concept route
For engineers moving an application into a customer environment. This route introduces the concepts before provider setup and deeper labs.
- 01The environmentYou are here
- 02NetworkingTrace how a request reaches a service before choosing public or private access.
- 03IdentityDistinguish reaching a service from being allowed to use its data or actions.
- 04Google CloudApply those boundaries to Google Cloud projects, regions and instances.
- 05AzureCompare how Azure subscriptions, resource groups and networks organize the same workload.
- 06AWSCompare AWS accounts, regions, Availability Zones and instances without assuming the services are interchangeable.
- 07Private inferenceDecide which model-serving responsibilities become yours when you operate the runtime.
Bookmark this page to return to this concept. The number shows your place in the reading route; it is not an assessment result.
A deployment and operating environment
What changes when AI runs in a cloud?
A cloud platform provides managed computing, storage, networking and identity services. A managed model endpoint is one service inside that environment. Building AI in a cloud means connecting these pieces into an application with explicit data, access, operational and cost boundaries.
An FDE must design for the customer's actual environment rather than assume every provider exposes the same behavior.
UNDERSTAND THE SYSTEM
A cloud AI system is more than a model endpoint
Cloud platforms supply managed infrastructure and services. You still design where requests run, how identities reach data and models, and how cost and failures are controlled.
Read the connections in plain English
- 01Customer request → Application runtime
The application establishes the caller's scope.
- 02Application runtime → Model service
Send only the required authorized context.
- 03Application data → Application runtime
Retrieve data with its source and permission boundaries.
- 04Operating controls → Application runtime
Apply workload identity, network policy and operational limits.
Check your understanding: Does a managed AI endpoint operate your application for you?
No. The provider operates a service boundary. Your team still owns application behavior, access rules, data flows, evaluation and incident response.
CONNECT IT TO WHAT YOU KNOW
Start with something familiar.
Moving into a managed building saves you from constructing the building. You still choose the rooms, access rules, equipment and operating procedures for your business.
Managed infrastructure reduces some work; it does not establish your application's permissions, quality or compliance. Model access and feature availability vary by region, deployment and account.
Words worth knowing
- Region
- A geographic deployment location offered by a cloud provider.
- Managed service
- A service whose underlying operation is partly handled by the provider.
- Quota
- A provider-enforced limit on resource use.
Useful foundations
Open a definition and diagram here. Your lesson stays in place.
Networking fundamentalsHow does a request reach a private service?
QUICK REFERENCE / 101
How does a request reach a private service?
Networking connects software across machines. DNS resolves a name to an address, routing determines a reachable path, ports identify service endpoints, and TLS protects a connection. A private endpoint restricts reachability; it does not replace the service's identity and access checks.
Many enterprise AI demonstrations fail when moved behind private networks, proxies or restricted outbound access.
Access-control conceptsAuthentication, authorization and tenant isolation
QUICK REFERENCE / 101
Authentication, authorization and tenant isolation
Authentication establishes who or what is calling. Authorization decides what that identity may do. Tenant isolation keeps one organization's data and actions separate from another's. An agent's tool call is a proposed action, not proof of any of these permissions.
An FDE must protect real organizational boundaries even when prompts, retrieved text or tool arguments are hostile.
Packaging and operating softwareWhat are containers and deployment?
QUICK REFERENCE / 101
What are containers and deployment?
An image is a reusable package containing an application's files and startup configuration. A container is one isolated instance created from that image; it can be running or stopped. Docker is a tool for building images and managing containers. Deployment adds the environment, identity, networking, storage and operating decisions needed to run the application.
A laptop demo must survive deployment, restarts and handover to a team that did not build it.
ONE EXAMPLE / FICTIONAL CASE
Follow the connections.
The same maintenance workflow must fit a customer's approved region, private data service and workload identity.
UNDERSTAND THE SYSTEM
A cloud AI system is more than a model endpoint
Cloud platforms supply managed infrastructure and services. You still design where requests run, how identities reach data and models, and how cost and failures are controlled.
See what moves and why.
Read the connections in plain English
- 01Customer request → Application runtime
The application establishes the caller's scope.
- 02Application runtime → Model service
Send only the required authorized context.
- 03Application data → Application runtime
Retrieve data with its source and permission boundaries.
- 04Operating controls → Application runtime
Apply workload identity, network policy and operational limits.
Check your understanding: Does a managed AI endpoint operate your application for you?
No. The provider operates a service boundary. Your team still owns application behavior, access rules, data flows, evaluation and incident response.
Work through it, step by step.
Map the workload
Separate application compute, model inference, source storage and durable review state.
What you have now: A deployment inventory
Bind identity and data
Choose service identities, network paths, retention and regional placement for each component.
What you have now: An explicit boundary map
Prove operation
Test quotas, timeouts, failure recovery, telemetry and cost using the intended deployment configuration.
What you have now: A receiving-team runbook
FROM RECOGNITION TO REASONING
Design one portable workload before choosing a provider.
- 01
List each service responsibility without product names.
- 02
Map the responsibilities to one approved cloud.
- 03
Record one capability you must verify rather than assume.
A responsibility-to-service map and a verification list.
Compare your reasoning when you are ready
Portability starts with explicit contracts. Matching an API shape does not guarantee matching model behavior, IAM, networking or data handling.
Keep notes in your own working copy. Moving through these cards does not record completion.
TURN THE IDEA INTO USEFUL WORK
You can now go deeper.
Managed infrastructure reduces some work; it does not establish your application's permissions, quality or compliance. Model access and feature availability vary by region, deployment and account.
Academy lessons use your existing training access. Free guides stay open.