LOCKEDIN / FORWARD-DEPLOYED ENGINEERING 101
Understand it.
Then build it.
You can be an experienced engineer and still be new to agents. Start with what each thing is and how it helps a person do useful work. Explore 58 original introductions across software, agents, cloud, security and delivery. Start here without a model key; each topic connects to deeper instruction and practice.
A place to start.
Choose a short reading route, or look up a concept below.
- 101UnderstandPlain language, visual walkthrough, vocabulary
- 102Build with guidanceOriginal lessons, examples and knowledge checks
- 103Practise and explainRunnable labs, failure cases and handover
Plan a cloud deployment
Trace how a request reaches a service before choosing public or private access.
See the 7-concept route
For engineers moving an application into a customer environment. This route introduces the concepts before provider setup and deeper labs.
- 01The environmentLocate the application, its data and the responsibilities shared with a cloud provider.
- 02NetworkingYou are here
- 03IdentityDistinguish reaching a service from being allowed to use its data or actions.
- 04Google CloudApply those boundaries to Google Cloud projects, regions and instances.
- 05AzureCompare how Azure subscriptions, resource groups and networks organize the same workload.
- 06AWSCompare AWS accounts, regions, Availability Zones and instances without assuming the services are interchangeable.
- 07Private inferenceDecide which model-serving responsibilities become yours when you operate the runtime.
Bookmark this page to return to this concept. The number shows your place in the reading route; it is not an assessment result.
Networking fundamentals
How does a request reach a private service?
Networking connects software across machines. DNS resolves a name to an address, routing determines a reachable path, ports identify service endpoints, and TLS protects a connection. A private endpoint restricts reachability; it does not replace the service's identity and access checks.
Many enterprise AI demonstrations fail when moved behind private networks, proxies or restricted outbound access.
UNDERSTAND THE SYSTEM
A request must find, reach and trust its destination
Networking connects processes across machines. For an HTTPS service, name resolution, routing, connection establishment and TLS each solve a different part of reaching the endpoint.
Read the connections in plain English
- 01Calling service → DNS resolution
Turn the intended hostname into usable addresses.
- 02DNS resolution → Network path
Check the network path and relevant egress rules.
- 03Network path → TLS connection
Verify the expected endpoint instead of disabling certificate checks.
- 04TLS connection → Application API
Encrypted transport does not replace application authorization.
Check your understanding: Does a successful TLS connection prove the caller can read a record?
No. Transport security protects a connection. Application authorization decides which operations and records the caller may access.
CONNECT IT TO WHAT YOU KNOW
Start with something familiar.
A function call stays inside your process. A network call crosses several boundaries, and each can fail independently before your function ever runs.
Reachable, encrypted and authorized are three different properties. A working connection proves none of the other two automatically.
Words worth knowing
- DNS
- Domain Name System: resolves names to network records.
- TLS
- Transport Layer Security: protects the channel; verify certificates and expected peer identity.
- Egress
- Traffic leaving an environment.
Useful foundations
Open a definition and diagram here. Your lesson stays in place.
A software contractWhat is an API?
QUICK REFERENCE / 101
What is an API?
An application programming interface (API) is an agreed way for one piece of software to use another. It specifies operations, inputs, outputs and errors. Some APIs are local functions; a web API exchanges requests and responses across a network.
An agent becomes useful through connections to business systems. Those connections need clear contracts and failure behavior.
ONE EXAMPLE / FICTIONAL CASE
Follow the connections.
The assistant works on a laptop but cannot reach the private procedure service from its deployed worker.
UNDERSTAND THE SYSTEM
A request must find, reach and trust its destination
Networking connects processes across machines. For an HTTPS service, name resolution, routing, connection establishment and TLS each solve a different part of reaching the endpoint.
See what moves and why.
Read the connections in plain English
- 01Calling service → DNS resolution
Turn the intended hostname into usable addresses.
- 02DNS resolution → Network path
Check the network path and relevant egress rules.
- 03Network path → TLS connection
Verify the expected endpoint instead of disabling certificate checks.
- 04TLS connection → Application API
Encrypted transport does not replace application authorization.
Check your understanding: Does a successful TLS connection prove the caller can read a record?
No. Transport security protects a connection. Application authorization decides which operations and records the caller may access.
Work through it, step by step.
Resolve and route
Check the service name, address and allowed network path from the worker's environment.
What you have now: A reachable destination
Establish trust
Verify the TLS certificate and intended hostname. Do not disable verification to make a demo pass.
What you have now: An encrypted, authenticated connection
Authorize the operation
The service checks the caller's identity and permission for the requested records.
What you have now: An allowed application request
FROM RECOGNITION TO REASONING
Draw the path from UI to worker to model and data service.
- 01
Label public and private network boundaries.
- 02
Mark credentials, TLS and outbound destinations.
- 03
Assign DNS failure, TLS failure and permission denial to the correct layer.
A network sketch with three distinct failure diagnoses.
Compare your reasoning when you are ready
A DNS failure happens before an application response. A permission denial means a service was reached but the operation was not allowed. Changing prompts cannot repair either boundary.
Keep notes in your own working copy. Moving through these cards does not record completion.
TURN THE IDEA INTO USEFUL WORK
You can now go deeper.
Reachable, encrypted and authorized are three different properties. A working connection proves none of the other two automatically.
Academy lessons use your existing training access. Free guides stay open.