@intentius/chant-lexicon-azure 0.41.20 → 0.44.1

package/src/governance.ts

@@ -0,0 +1,238 @@
+/**
+ * Azure governance authoring (#791, epic #787 C1): the desired-state config
+ * shape the Azure cloud warden reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven management-group tree walker cannot be one. The split mirrors
+ * the AWS/GCP slices (lexicons/{aws,gcp}/src/governance.ts): authoring emits
+ * config (this module, arbitrary cardinality); resources for greenfield
+ * bootstrap are the fixed-shape composites in `composites/landing-zone.ts`;
+ * the warden consumes only the config.
+ *
+ * Azure has no OrganizationRoot analog — the tenant and its root management
+ * group come from Entra ID, never from the resource API. Subscriptions the
+ * tree declares reconcile through Microsoft.Subscription/aliases (existing
+ * ids are placed, missing ones created from `billingScope`); aliases deploy
+ * at tenant scope only (#1545).
+ */
+
+// ---------------------------------------------------------------------------
+// The desired-state config shape the Azure cloud warden consumes
+// ---------------------------------------------------------------------------
+
+/** A custom policy definition, keyed by name in `AzureGovernanceConfig.policies`. */
+export interface PolicyConfig {
+  description?: string;
+  displayName?: string;
+  /** The policy definition mode ("All", "Indexed", …). Defaults to "All". */
+  mode?: string;
+  /** Parameter definitions for parameters used in the policy rule. */
+  parameters?: Record<string, unknown>;
+  /** The policy rule (if/then). */
+  policyRule: Record<string, unknown>;
+}
+
+/** A subscription declared inside a management group. */
+export interface SubscriptionConfig {
+  name: string;
+  /** An existing subscription to place. Omitted: the warden creates one via a tenant-scope alias. */
+  subscriptionId?: string;
+  /** Billing scope for subscriptions the warden creates. */
+  billingScope?: string;
+  workload?: "Production" | "DevTest";
+}
+
+/** One management group: its guardrails, subscriptions, and children, keyed by group id. */
+export interface ManagementGroupConfig {
+  /** Defaults to the group id (the tree key). */
+  displayName?: string;
+  /** Names of policies (from `policies`) assigned to this management group. */
+  policies?: string[];
+  subscriptions?: SubscriptionConfig[];
+  children?: Record<string, ManagementGroupConfig>;
+}
+
+/**
+ * The desired-state governance tree for one Azure tenant. This is the shape
+ * the Azure cloud warden loads as config — the Azure counterpart of
+ * `AwsGovernanceConfig`/`GcpGovernanceConfig`. Cycles map onto the
+ * governance verbs (#790): the management-group/subscription tree is
+ * `org-unit`, policy assignments are `policy-guardrail`, the activity-log
+ * sink is `audit-sink`.
+ */
+export interface AzureGovernanceConfig {
+  tenant: {
+    /** Policy names assigned at the tenant root management group. */
+    policies?: string[];
+    /** Block subscriptions from leaving the tenant (Microsoft.Subscription/policies). */
+    blockSubscriptionsLeavingTenant?: boolean;
+  };
+  /** Top-level management groups under the tenant root, keyed by group id. */
+  managementGroups: Record<string, ManagementGroupConfig>;
+  /** Custom policy definitions, keyed by the names the tree assigns. */
+  policies: Record<string, PolicyConfig>;
+  /** Where audit evidence flows. */
+  auditSinks?: {
+    activityLog?: { workspaceId: string };
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+
+export const DENY_CLASSIC_RESOURCES: PolicyConfig = {
+  description: "Classic (ASM) compute, network, and storage resources cannot be created.",
+  displayName: "Deny classic resources",
+  mode: "All",
+  policyRule: {
+    if: { field: "type", like: "Microsoft.Classic*" },
+    then: { effect: "deny" },
+  },
+};
+
+export const DENY_UNMANAGED_DISKS: PolicyConfig = {
+  description: "Virtual machines and scale sets must use managed disks.",
+  displayName: "Deny unmanaged disks",
+  mode: "All",
+  policyRule: {
+    if: {
+      anyOf: [
+        {
+          allOf: [
+            { field: "type", equals: "Microsoft.Compute/virtualMachines" },
+            { field: "Microsoft.Compute/virtualMachines/osDisk.uri", exists: "true" },
+          ],
+        },
+        {
+          allOf: [
+            { field: "type", equals: "Microsoft.Compute/virtualMachineScaleSets" },
+            {
+              anyOf: [
+                { field: "Microsoft.Compute/VirtualMachineScaleSets/osDisk.vhdContainers", exists: "true" },
+                { field: "Microsoft.Compute/VirtualMachineScaleSets/osdisk.imageUrl", exists: "true" },
+              ],
+            },
+          ],
+        },
+      ],
+    },
+    then: { effect: "deny" },
+  },
+};
+
+/** Allow resource creation only in `locations` ("global" is always excepted). */
+export function locationRestriction(locations: readonly string[]): PolicyConfig {
+  return {
+    description: `Resources may only be created in [${locations.join(", ")}].`,
+    displayName: "Allowed locations",
+    mode: "Indexed",
+    policyRule: {
+      if: {
+        allOf: [
+          { field: "location", notIn: [...locations] },
+          { field: "location", notEquals: "global" },
+        ],
+      },
+      then: { effect: "deny" },
+    },
+  };
+}
+
+/**
+ * The built-in DeployIfNotExists policy "Configure Azure Activity logs to
+ * stream to specified Log Analytics workspace" — the activity-log audit
+ * sink is wired by assigning it, not by declaring diagnostic settings in
+ * every subscription (Microsoft.Insights/diagnosticSettings is not in the
+ * generated surface, and the assignment covers future subscriptions too).
+ */
+export const ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID =
+  "/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f";
+
+/**
+ * The recommended foundation management-group structure. Exported so
+ * callers can extend it rather than restate it.
+ */
+export const FOUNDATION_MANAGEMENT_GROUPS: Record<string, ManagementGroupConfig> = {
+  Security: {},
+  Infrastructure: {},
+  Sandbox: {},
+  Workloads: {},
+};
+
+// ---------------------------------------------------------------------------
+// Authoring
+// ---------------------------------------------------------------------------
+
+export interface LandingZoneConfigProps {
+  /**
+   * Start from the recommended foundation: Security / Infrastructure /
+   * Sandbox / Workloads management groups, `deny-classic-resources` and
+   * `deny-unmanaged-disks` assigned at the tenant root, and subscriptions
+   * blocked from leaving the tenant. Default true; your
+   * `managementGroups`/`policies` merge over it (same-name keys win).
+   */
+  foundation?: boolean;
+  /** Adds a root allowed-locations policy allowing only these locations. */
+  allowedLocations?: string[];
+  /** Management-group tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
+  managementGroups?: Record<string, ManagementGroupConfig>;
+  /** Policy definitions, merged over the foundation's. */
+  policies?: Record<string, PolicyConfig>;
+  /** Extra policy names to assign at the tenant root management group. */
+  rootPolicies?: string[];
+  /** Declare the activity-log audit sink flowing into this Log Analytics workspace (resource id). */
+  activityLogWorkspaceId?: string;
+}
+
+/**
+ * Author the desired-state tree the Azure cloud warden reconciles. Pure.
+ * Throws when the tree assigns a policy name with no definition; only
+ * policies the tree actually assigns are included in the output.
+ */
+export function landingZoneConfig(props: LandingZoneConfigProps = {}): AzureGovernanceConfig {
+  const foundation = props.foundation ?? true;
+  const policies: Record<string, PolicyConfig> = {
+    ...(foundation
+      ? { "deny-classic-resources": DENY_CLASSIC_RESOURCES, "deny-unmanaged-disks": DENY_UNMANAGED_DISKS }
+      : {}),
+    ...(props.allowedLocations?.length
+      ? { "location-restriction": locationRestriction(props.allowedLocations) }
+      : {}),
+    ...props.policies,
+  };
+  const managementGroups = { ...(foundation ? FOUNDATION_MANAGEMENT_GROUPS : {}), ...props.managementGroups };
+  const rootPolicies = [
+    ...(foundation ? ["deny-classic-resources", "deny-unmanaged-disks"] : []),
+    ...(props.allowedLocations?.length ? ["location-restriction"] : []),
+    ...(props.rootPolicies ?? []),
+  ];
+
+  const assigned = new Set(rootPolicies);
+  const collect = (tree: Record<string, ManagementGroupConfig>): void => {
+    for (const node of Object.values(tree)) {
+      for (const p of node.policies ?? []) assigned.add(p);
+      if (node.children) collect(node.children);
+    }
+  };
+  collect(managementGroups);
+  for (const name of assigned) {
+    if (!policies[name]) {
+      throw new Error(`landingZoneConfig: policy "${name}" is assigned but not defined in policies`);
+    }
+  }
+
+  return {
+    tenant: {
+      ...(rootPolicies.length ? { policies: rootPolicies } : {}),
+      ...(foundation ? { blockSubscriptionsLeavingTenant: true } : {}),
+    },
+    managementGroups,
+    policies: Object.fromEntries(Object.entries(policies).filter(([n]) => assigned.has(n))),
+    ...(props.activityLogWorkspaceId
+      ? { auditSinks: { activityLog: { workspaceId: props.activityLogWorkspaceId } } }
+      : {}),
+  };
+}

package/src/index.ts

@@ -6,6 +6,7 @@
 
 // --- Core ---
 export { defaultTags, type TagEntry, type DefaultTags } from "./default-tags";
+export { deploymentScope, isDeploymentScope, type DeploymentScope, type DeployScope } from "./deploy-scopes";
 export { azureSerializer } from "./serializer";
 export { azurePlugin } from "./plugin";
 export { Parameter } from "./parameter";
@@ -16,6 +17,7 @@ export {
   observeResourcesDeepAzure,
   azureDeepNormalizationHooks,
   AZURE_READ_ONLY_NAMES,
+  AZURE_SERVER_COMPUTED_NAMES,
   AZURE_SERVICE_DEFAULTS,
 } from "./deep-observe";
 
@@ -68,8 +70,24 @@ export {
   ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult,
   RedisCache, type RedisCacheProps, type RedisCacheResult,
   PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult,
+  GovernanceFoundation, type GovernanceFoundationProps, type GovernanceFoundationResult,
+  GovernanceBaseline, type GovernanceBaselineProps, type GovernanceBaselineResult,
+  LocationRestriction, type LocationRestrictionProps, type LocationRestrictionResult,
+  ActivityLogSink, type ActivityLogSinkProps, type ActivityLogSinkResult,
 } from "./composites/index";
 
+// Azure governance authoring (#791): the desired-state config the Azure
+// cloud warden reconciles, and the typed landing-zone authoring layer.
+export {
+  landingZoneConfig, locationRestriction,
+  DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS,
+  ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS,
+} from "./governance";
+export type {
+  AzureGovernanceConfig, LandingZoneConfigProps,
+  ManagementGroupConfig, PolicyConfig, SubscriptionConfig,
+} from "./governance";
+
 // --- RBAC role constants ---
 export {
   StorageRoles,

package/src/lint/audit-catalog.ts

@@ -27,4 +27,10 @@ export const azureAuditCatalog: Record<string, RuleMeta> = {
   AZR027: auditRule("AZR027", "merge-worthy", "guidance", "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", { authority: [AZ_SEC] }),
   AZR028: auditRule("AZR028", "report-only", "guidance", "Network interface missing NSG", "Associate an NSG to control traffic.", { category: "best-practice" }),
   AZR029: auditRule("AZR029", "merge-worthy", "guidance", "Managed disk missing encryption", "Enable encryption for data at rest.", { authority: [AZ_SEC] }),
+  AZR030: auditRule("AZR030", "merge-worthy", "guidance", "Resource at unsupported template scope", "Move the resource to a project deployed at a scope its schema supports.", { category: "correctness" }),
+
+  // #793 — governance posture regressions (epic #787 C3).
+  AZR031: auditRule("AZR031", "merge-worthy", "guidance", "Policy assignment not enforced (DoNotEnforce)", "Set enforcementMode to Default so the assigned guardrail applies.", { authority: [AZ_SEC] }),
+  AZR032: auditRule("AZR032", "merge-worthy", "guidance", "Custom policy definition assigned nowhere", "Pair the policy definition with a policy assignment — unassigned it enforces nothing.", { authority: [AZ_SEC] }),
+  AZR033: auditRule("AZR033", "merge-worthy", "guidance", "Subscriptions may leave the tenant", "Set blockSubscriptionsLeavingTenant: true on the Microsoft.Subscription/policies resource.", { authority: [AZ_SEC] }),
 };

package/src/lint/post-synth/azr030.test.ts

@@ -0,0 +1,126 @@
+import { describe, expect, test } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { azr030 } from "./azr030";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ azure: template });
+}
+
+// AZR030 reads deployScopes from the generated lexicon (built by `just
+// _ensure-gen` before tests run), so these cases exercise the real
+// management-group / policy scope metadata (#1545).
+
+describe("AZR030: Resource deployed at an unsupported template scope", () => {
+  test("errors when a tenant-only resource sits in a resource-group template", () => {
+    const ctx = makeCtx({
+      $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Management/managementGroups",
+          apiVersion: "2023-04-01",
+          name: "platform",
+          properties: {},
+        },
+      ],
+    });
+
+    const diags = azr030.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("AZR030");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("tenant");
+    expect(diags[0].message).toContain("resourceGroup scope");
+  });
+
+  test("no diagnostic for a tenant-only resource in a tenant template", () => {
+    const ctx = makeCtx({
+      $schema: "https://schema.management.azure.com/schemas/2019-08-01/tenantDeploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Management/managementGroups",
+          apiVersion: "2023-04-01",
+          name: "platform",
+          properties: {},
+        },
+      ],
+    });
+
+    const diags = azr030.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("errors when a policy definition sits in a resource-group template", () => {
+    const ctx = makeCtx({
+      $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Authorization/policyDefinitions",
+          apiVersion: "2026-06-01",
+          name: "deny-public-ip",
+          properties: { policyRule: {} },
+        },
+      ],
+    });
+
+    const diags = azr030.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("subscription/managementGroup");
+  });
+
+  test("no diagnostic for a policy definition in a subscription template", () => {
+    const ctx = makeCtx({
+      $schema: "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Authorization/policyDefinitions",
+          apiVersion: "2026-06-01",
+          name: "deny-public-ip",
+          properties: { policyRule: {} },
+        },
+      ],
+    });
+
+    const diags = azr030.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("policy assignments deploy at any scope, including resource group", () => {
+    const ctx = makeCtx({
+      $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Authorization/policyAssignments",
+          apiVersion: "2026-06-01",
+          name: "enforce-tags",
+          properties: {},
+        },
+      ],
+    });
+
+    const diags = azr030.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("plain resources stay silent in resource-group templates", () => {
+    const ctx = makeCtx({
+      $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Storage/storageAccounts",
+          apiVersion: "2023-05-01",
+          name: "myStorage",
+          location: "[resourceGroup().location]",
+        },
+      ],
+    });
+
+    const diags = azr030.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/azr030.ts

@@ -0,0 +1,53 @@
+/**
+ * AZR030: Resource deployed at an unsupported template scope
+ *
+ * Errors when a template contains a resource whose ARM schema does not
+ * define it at the template's deployment scope (#1545). The serializer
+ * picks the template $schema from the common scope of all resources; a
+ * template mixing, say, management groups (tenant-only) with virtual
+ * networks (resource-group-only) has no valid single-template scope —
+ * split the project so each scope deploys its own template (linked
+ * deployments cross scopes).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseArmTemplate } from "./arm-refs";
+import { deployScopesFor, scopeForTemplateSchema } from "../../deploy-scopes";
+
+export const azr030: PostSynthCheck = {
+  id: "AZR030",
+  description: "Resource deployed at an unsupported template scope — split scopes into separate templates",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [_lexicon, output] of ctx.outputs) {
+      const template = parseArmTemplate(output);
+      if (!template?.resources) continue;
+
+      const templateScope = scopeForTemplateSchema(
+        (template as Record<string, unknown>).$schema,
+      );
+
+      for (const resource of template.resources) {
+        if (typeof resource.type !== "string") continue;
+        const scopes = deployScopesFor(resource.type);
+        if (scopes.includes(templateScope)) continue;
+
+        const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+        diagnostics.push({
+          checkId: "AZR030",
+          severity: "error",
+          message:
+            `Resource "${resourceName}" (${resource.type}) deploys at ` +
+            `${scopes.join("/")} scope, but this template targets ${templateScope} scope — ` +
+            `move it to a project deployed at a scope its schema supports`,
+          entity: resourceName,
+          lexicon: "azure",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/azr031.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, test } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { azr031 } from "./azr031";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ azure: template });
+}
+
+const SCHEMA = "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#";
+
+describe("AZR031: policy assignment not enforced", () => {
+  test("flags enforcementMode DoNotEnforce", () => {
+    const ctx = makeCtx({
+      $schema: SCHEMA,
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Authorization/policyAssignments",
+          apiVersion: "2023-04-01",
+          name: "deny-classic",
+          properties: {
+            policyDefinitionId: "[managementGroupResourceId('Microsoft.Authorization/policyDefinitions', 'deny-classic-resources')]",
+            enforcementMode: "DoNotEnforce",
+          },
+        },
+      ],
+    });
+
+    const diags = azr031.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("AZR031");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("deny-classic");
+  });
+
+  test("no diagnostic for Default enforcement or an unset mode", () => {
+    const ctx = makeCtx({
+      $schema: SCHEMA,
+      contentVersion: "1.0.0.0",
+      resources: [
+        {
+          type: "Microsoft.Authorization/policyAssignments",
+          apiVersion: "2023-04-01",
+          name: "explicit-default",
+          properties: { policyDefinitionId: "/providers/Microsoft.Authorization/policyDefinitions/abc", enforcementMode: "Default" },
+        },
+        {
+          type: "Microsoft.Authorization/policyAssignments",
+          apiVersion: "2023-04-01",
+          name: "unset",
+          properties: { policyDefinitionId: "/providers/Microsoft.Authorization/policyDefinitions/abc" },
+        },
+      ],
+    });
+
+    expect(azr031.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/azr031.ts

@@ -0,0 +1,41 @@
+/**
+ * AZR031: Policy Assignment Not Enforced (#793, epic #787 C3)
+ *
+ * Flags Microsoft.Authorization/policyAssignments with enforcementMode
+ * DoNotEnforce. The assignment stays visible in the tree while denying
+ * nothing — the Azure shape of a disabled guardrail.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseArmTemplate } from "./arm-refs";
+
+export const azr031: PostSynthCheck = {
+  id: "AZR031",
+  description: "Policy assignment has enforcementMode DoNotEnforce — the guardrail is disabled",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [_lexicon, output] of ctx.outputs) {
+      const template = parseArmTemplate(output);
+      if (!template?.resources) continue;
+
+      for (const resource of template.resources) {
+        if (resource.type !== "Microsoft.Authorization/policyAssignments") continue;
+        const mode = resource.properties?.enforcementMode;
+        if (mode !== "DoNotEnforce") continue;
+
+        const name = typeof resource.name === "string" ? resource.name : String(resource.name);
+        diagnostics.push({
+          checkId: "AZR031",
+          severity: "error",
+          message: `Policy assignment "${name}" has enforcementMode DoNotEnforce — the guardrail is assigned but enforces nothing`,
+          entity: name,
+          lexicon: "azure",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/azr032.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, test } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { azr032 } from "./azr032";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ azure: template });
+}
+
+const SCHEMA = "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#";
+
+function definition(name: string) {
+  return {
+    type: "Microsoft.Authorization/policyDefinitions",
+    apiVersion: "2023-04-01",
+    name,
+    properties: { policyType: "Custom", mode: "All", policyRule: { if: { field: "type", like: "Microsoft.Classic*" }, then: { effect: "deny" } } },
+  };
+}
+
+describe("AZR032: policy definition assigned nowhere", () => {
+  test("flags a definition with no assignment", () => {
+    const ctx = makeCtx({
+      $schema: SCHEMA,
+      contentVersion: "1.0.0.0",
+      resources: [definition("deny-classic-resources")],
+    });
+
+    const diags = azr032.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("AZR032");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("deny-classic-resources");
+  });
+
+  test("no diagnostic when the GovernanceBaseline pairing references it", () => {
+    const ctx = makeCtx({
+      $schema: SCHEMA,
+      contentVersion: "1.0.0.0",
+      resources: [
+        definition("deny-classic-resources"),
+        {
+          type: "Microsoft.Authorization/policyAssignments",
+          apiVersion: "2023-04-01",
+          name: "deny-classic",
+          dependsOn: ["deny-classic-resources"],
+          properties: {
+            policyDefinitionId: "[managementGroupResourceId('Microsoft.Authorization/policyDefinitions', 'deny-classic-resources')]",
+          },
+        },
+      ],
+    });
+
+    expect(azr032.check(ctx)).toHaveLength(0);
+  });
+
+  test("a literal resource-id reference also counts", () => {
+    const ctx = makeCtx({
+      $schema: SCHEMA,
+      contentVersion: "1.0.0.0",
+      resources: [
+        definition("allowed-locations"),
+        {
+          type: "Microsoft.Authorization/policyAssignments",
+          apiVersion: "2023-04-01",
+          name: "locations",
+          properties: {
+            policyDefinitionId: "/providers/Microsoft.Management/managementGroups/root/providers/Microsoft.Authorization/policyDefinitions/allowed-locations",
+          },
+        },
+      ],
+    });
+
+    expect(azr032.check(ctx)).toHaveLength(0);
+  });
+
+  test("a built-in assignment does not cover an unrelated definition", () => {
+    const ctx = makeCtx({
+      $schema: SCHEMA,
+      contentVersion: "1.0.0.0",
+      resources: [
+        definition("deny-unmanaged-disks"),
+        {
+          type: "Microsoft.Authorization/policyAssignments",
+          apiVersion: "2023-04-01",
+          name: "activity-log-sink",
+          properties: {
+            policyDefinitionId: "/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f",
+          },
+        },
+      ],
+    });
+
+    expect(azr032.check(ctx)).toHaveLength(1);
+  });
+});