fix(agents): restrict deploy RBAC pre-flight to roles with CogSvc data plane access

cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check.go

@@ -45,6 +45,16 @@ const (
 
 	// AI-specific roles that grant agent management access.
 	roleAzureAIDeveloper = "64702f94-c441-49e6-a78b-ef80e0188fee"
+
+	// Cognitive Services User: backward-compat alias for Foundry User.
+	// Assigned by older Bicep provisions (AZURE_PRINCIPAL_ID flow); has the same
+	// Microsoft.CognitiveServices/* dataActions as Foundry User and is accepted as equivalent.
+	roleCognitiveServicesUser = "a97b65f3-24c7-4388-baec-2e87135dc908"
+
+	// Foundry Owner: full Foundry project management + Microsoft.CognitiveServices/* dataActions.
+	// The code comment on sufficientAIUserRoles already recommends this role; include it so users
+	// with Foundry Owner are not falsely flagged as missing the data-plane role.
+	roleFoundryOwner = "c883944f-8b7b-4483-af10-35834be79c4a"
 )
 
 // sufficientACRRoles lists every role that grants enough ACR access to build
@@ -66,13 +76,19 @@ var sufficientACRAbacRoles = []string{
 	roleContainerRegistryRepositoryContributor, // superset of RepositoryWriter
 }
 
-// sufficientAIUserRoles lists every role that grants enough Foundry Project
-// access to create and run agents.
+// sufficientAIUserRoles lists roles whose dataActions cover Microsoft.CognitiveServices/*,
+// specifically the AIServices namespace required for Foundry agents (agents/write).
+//
+// Excluded intentionally:
+//   - roleOwner / roleContributor: management-plane only, zero dataActions
+//   - roleAzureAIDeveloper: dataActions cover only OpenAI/Speech/ContentSafety/MaaS,
+//     NOT the AIServices.* namespace used by Foundry agents; Azure docs state
+//     "For Foundry project access, use the Foundry User or Foundry Owner roles instead"
 var sufficientAIUserRoles = []string{
-	roleOwner,
-	roleContributor,
-	roleAzureAIUser,
-	roleAzureAIDeveloper,
+	roleAzureAIUser,           // 53ca6127-... Foundry User: dataActions Microsoft.CognitiveServices/*
+	roleCognitiveServicesUser, // a97b65f3-... backward compat: same dataActions, assigned by older Bicep
+	roleAzureAIProjectManager, // eadc314b-... Foundry Project Manager: dataActions Microsoft.CognitiveServices/*
+	roleFoundryOwner,          // c883944f-... Foundry Owner: dataActions Microsoft.CognitiveServices/*
 }
 
 // sufficientRoleAssignWriteRoles lists every role that grants
@@ -86,6 +102,7 @@ var sufficientRoleAssignWriteRoles = []string{
 	roleRBACAdministrator,
 	roleAzureAIProjectManager,
 	roleAzureAIAccountOwner,
+	roleFoundryOwner, // c883944f-...: includes Microsoft.Authorization/roleAssignments/write
 }
 
 // CheckDeveloperRBAC verifies that the currently authenticated developer has the required

cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_check_test.go

@@ -51,6 +51,8 @@ func TestDeveloperRBACRoleConstants(t *testing.T) {
 
 	// AI roles
 	assert.Equal(t, "64702f94-c441-49e6-a78b-ef80e0188fee", roleAzureAIDeveloper)
+	assert.Equal(t, "a97b65f3-24c7-4388-baec-2e87135dc908", roleCognitiveServicesUser)
+	assert.Equal(t, "c883944f-8b7b-4483-af10-35834be79c4a", roleFoundryOwner)
 }
 
 func TestSufficientRoleLists(t *testing.T) {
@@ -61,10 +63,16 @@ func TestSufficientRoleLists(t *testing.T) {
 	assert.Contains(t, sufficientACRRoles, roleContainerRegistryTasksContributor)
 	assert.Contains(t, sufficientACRRoles, roleContainerRegistryRepositoryContributor)
 
-	assert.Contains(t, sufficientAIUserRoles, roleOwner)
-	assert.Contains(t, sufficientAIUserRoles, roleContributor)
-	assert.Contains(t, sufficientAIUserRoles, roleAzureAIUser)
-	assert.Contains(t, sufficientAIUserRoles, roleAzureAIDeveloper)
+	// sufficientAIUserRoles must contain only roles whose dataActions cover AIServices.*
+	assert.Contains(t, sufficientAIUserRoles, roleAzureAIUser)           // Foundry User: CogSvc.*
+	assert.Contains(t, sufficientAIUserRoles, roleCognitiveServicesUser) // backward compat: CogSvc.*
+	assert.Contains(t, sufficientAIUserRoles, roleAzureAIProjectManager) // Foundry Project Manager: CogSvc.*
+	assert.Contains(t, sufficientAIUserRoles, roleFoundryOwner)          // Foundry Owner: CogSvc.*
+	// Owner/Contributor have no dataActions and must NOT be treated as sufficient
+	assert.NotContains(t, sufficientAIUserRoles, roleOwner)
+	assert.NotContains(t, sufficientAIUserRoles, roleContributor)
+	// Azure AI Developer only covers OpenAI/Speech/ContentSafety/MaaS — NOT AIServices.*
+	assert.NotContains(t, sufficientAIUserRoles, roleAzureAIDeveloper)
 
 	// Role-assignment write: Owner, UAA, RBAC Admin, Foundry Project Manager, Foundry Account Owner;
 	// Contributor must NOT be included.
@@ -73,6 +81,7 @@ func TestSufficientRoleLists(t *testing.T) {
 	assert.Contains(t, sufficientRoleAssignWriteRoles, roleRBACAdministrator)
 	assert.Contains(t, sufficientRoleAssignWriteRoles, roleAzureAIProjectManager)
 	assert.Contains(t, sufficientRoleAssignWriteRoles, roleAzureAIAccountOwner)
+	assert.Contains(t, sufficientRoleAssignWriteRoles, roleFoundryOwner) // Foundry Owner has roleAssignments/write
 	assert.NotContains(t, sufficientRoleAssignWriteRoles, roleContributor)
 
 	// ABAC ACR roles: Owner, RepositoryWriter, RepositoryContributor; AcrPush must NOT be included.

cli/azd/extensions/azure.ai.agents/internal/project/developer_rbac_query.go

@@ -64,8 +64,8 @@ type DeveloperRBACResult struct {
 	PrincipalDisplay string
 
 	// HasSufficientAIRole is true when the principal has at least
-	// one of `sufficientAIUserRoles` (Owner, Contributor, Foundry
-	// User, Azure AI Developer) on the project scope.
+	// one of `sufficientAIUserRoles` (Foundry User, Cognitive Services User,
+	// Foundry Project Manager, or Foundry Owner) on the project scope.
 	HasSufficientAIRole bool
 
 	// ProjectScope is the full ARM resource ID of the Foundry