Enterprise API and Tooling Governance
APIs as products. Extensions as a
marketplace.
Governance as the
control plane.
A unified runbook for governing APIs, VS Code extensions, MCP servers, and Copilot agents through one integrated control plane.
Agenda
Three parts. From sprawl to a governed control plane.
PART IThe sprawl, the unified vision, and the integrated platform architecture.
PART IIThe three hubs: Azure API Center, VS Code Private Marketplace, Copilot governance.
PART IIISecurity, integration scenarios, the Day 0 to Day 2 operational runbook.
Part I
I
The sprawl and the unified vision.
Why enterprise development environments accumulate compounding risk, and the architecture that closes the loop.
Problem · Three converging risks
APIs, extensions, MCP, agents: nothing is governed end-to-end.
01 · Security
Unvetted tooling.
Extensions and MCP servers installed ad hoc may exfiltrate code or credentials. The IDE becomes the soft target.
02 · Compliance
Data leaving the perimeter.
Sensitive data reaches AI model APIs without authorization. Audit teams cannot prove what left, when, and to whom.
03 · Productivity
Shadow APIs and duplication.
Developers cannot discover what exists, so they rebuild. They use deprecated APIs and burn time on tooling setup.
Architecture · Integrated control plane
Three hubs. One developer workstation. Nothing reaches it unvetted.
Part II
II
The three hubs in detail.
API Center, Private Marketplace, Copilot governance: same design principle, different artifact category.
Hub 01 · Azure API Center
One register for every API in the organization.
Inventory
Every API, every version.
Definitions, environments, deployments. CLI and CI/CD registration. Custom metadata for ownership and classification.
Linting
Style at the gate.
Spectral rules at registration time. Block APIs that violate organizational design standards before they ship.
Shadow API
Dev Proxy discovery.
Detect undocumented APIs the developer call. Surface them to the catalog before they become production debt.
APIM sync
Runtime feeds inventory.
Azure API Management catalog flows upstream automatically. Gateway truth and inventory truth converge.
Hub 02 · VS Code Private Marketplace
A curated marketplace under enterprise control.
Architecture
Stateless container, object storage backing.
Deploy in any region. Serve internal and rehosted public extensions. Air-gap deploys keep developers productive without network egress.
Policy
AllowedExtensions decides what installs.
Group Policy on Windows, Intune on macOS and managed devices. Bootstrap install ensures every dev opens a curated VS Code on day one.
Hub 03 · Copilot governance
MCP, agents, prompts, skills: each artifact category has a governance contract.
MCP servers
Approved tool surface.
Registered MCP servers in .vscode/mcp.json, distributed via the marketplace. Trust model documented per server.
Extensions
Marketplace apps.
Copilot extensions reviewed for data flow. Allowlist enforced at the GitHub Enterprise organization level.
Custom agents
Repo-scoped behavior.
.github/agents/ files version-controlled with the code they govern. Reviewed in the same PR pipeline.
Skills + prompts
Reusable instructions.
Prompt files and skills curated in a shared repo. Approval workflow before they reach the developer fleet.
Part III
III
Security, scenarios, operations.
Threat model, integration scenarios for regulated and air-gapped environments, and the Day 0 to Day 2 sequence.
Scenarios · Three deployments
Same architecture, three deployment shapes.
A · Full integrated
Cloud-connected enterprise.
API design in VS Code, registered to API Center, synced to APIM, consumed from the IDE. Marketplace and Copilot fully online.
B · Air-gapped
No public network egress.
Marketplace rehosts public extensions on internal storage. MCP servers run on internal endpoints. Copilot Enterprise on private link.
C · Regulated
Finance, public sector.
Audit log retention, classification labels, signed artifacts, identity propagation per request. Auditor independent from platform.
Closing thought
Governance is the platform. Build it once.
Three hubs, one control plane. The artifacts change. The contract does not.
Building the future of software development with AI and Agentic DevOps.
Paula Silva | Software Global Black Belt
linkedin.com/in/paulanunes