Cloud Authoring Assistants

Writing an Azure deployment template or a restrictive Access Control Policy from scratch takes specialist Azure and security knowledge, and for most Lab Developers the hardest part is knowing where to start. The Cloud Deployment Template Assistant and the Cloud Access Control Policy Assistant put a chat panel inside the editor you're already working in, so you can describe what the lab needs in plain language and get a working draft to refine. This article covers where the two assistants appear, how to prompt them well, and what you still need to check before a generated template or policy goes into a lab.

Best Practices for the Cloud Authoring Assistants

Treat generated output as a first draft, not a finished artefact. The assistants remove the blank-page problem; they don't remove your responsibility for what the lab deploys or what it allows. Everything below follows from that.

Give the assistant the facts it can't see. It knows your template type, but not your lab's intent. State the resources, the SKUs and regions you want, and the names your instructions refer to. A prompt like "create a template with a small Linux VM and a virtual network" produces something generic; naming the SKU and the resource names your instructions use produces something you can actually deploy.
For policies, start from what the lab actually does. The best input is a real inventory of the resources the lab creates, not a description from memory. See "Generating a policy from lab content" below.
Check generated policies against the ACP criteria before you save them. A generated policy can look complete and still be far more permissive than a security review will accept. The criteria a policy has to meet — and the resource types that must be restricted explicitly — are set out in Azure Access Control Policy Creation and Access Control Policies Best Practices. Read the output against those rather than assuming the assistant has applied them.
Iterate in the chat rather than starting over. Both assistants can enhance, correct and extend what's already in the editor. Asking for a fix to the current template is cheaper and usually better than regenerating from a longer prompt.
Keep the editor and the chat in step. If you hand-edit the template or policy after generating it, sync those edits into the chat context before your next prompt, or the assistant will reason about a version that no longer exists.
Check generated Bicep against the Bicep guidance. Authoring considerations for Bicep in Studio, including how templates are compiled at lab launch, are covered in Use Bicep in Azure Cloud Slice Labs.
Test the result, don't just read it. For templates, launch the lab and confirm deployment succeeds. For policies, try to create a resource the policy should block — a syntax error can stop a policy applying at all, which looks identical to a policy that permits everything.

Who Uses the Assistants, and When

Lab Developers use both assistants in Skillable Studio while building or maintaining a cloud lab. Learners never see them.

Reach for them when:

You're starting a new cloud lab. A prompt describing the environment gets you a template to work from in minutes rather than hours.
You're writing your first ACP. Policies are the part of cloud lab authoring most likely to stall a new developer, and the assistant gives you a structurally correct starting point to tighten.
Something has changed underneath you. Azure introduces new resource types and Skillable's security standards evolve. Rather than reworking a policy by hand, ask the assistant to update the existing one.
A deployment or policy isn't behaving. Paste the error, or describe what deployed when it shouldn't have, and ask for a fix.
You're building a sandbox with few or no instructions. The Cloud Access Control Policy Assistant can work from a conversational description alone when there's no instruction set to draw on.

The assistants are not a substitute for review. Any lab with cloud orchestration, a resource group, and a non-exempt ACP is automatically flagged for a Cloud Security Review, and a generated policy is judged by exactly the same standards as a hand-written one.

How the Assistants Work in Skillable Studio

Both assistants appear as a chat panel beside the editor, sharing the page with the template or policy you're working on. The panel is resizable with a draggable splitter and follows your light or dark theme.

Availability

The panel only appears when all of the following are true. If any is missing, it's hidden entirely rather than disabled.

AI features are enabled for your organization.
You hold the Organization Cloud Slice Lab Developers role, which grants the permissions needed to build cloud labs.
The Cloud Platform for the template or policy is set to Azure.

There is no separate permission for the assistants themselves. If you can create resource templates and access control policies, and your organization has AI features enabled, the panel is available to you on Azure.

Skillable Studio supports Microsoft Azure, Amazon Web Services and Google Cloud Platform for cloud labs. The assistants work with Azure only — in both ARM JSON and Bicep. With AWS or GCP selected, the editors behave exactly as they did before, with no chat panel.

Cloud Deployment Template Assistant

You can reach the template editor two ways, and it makes no difference to how the Cloud Deployment Template Assistant behaves:

Admin → Cloud Services → Resource Templates → + Create Resource Template, or
Lab Profile → Cloud tab → Resource Templates → + Create Template

The assistant is context-aware. It picks up the template type you've selected — ARM JSON or Bicep — and keeps that context current as you change it, so you don't need to state the language in your prompt. Switching between ARM JSON and Bicep mid-conversation updates the assistant rather than leaving it generating the wrong syntax.

To generate a template, describe what the lab needs to deploy. When the assistant produces a result, Use This Template becomes active and inserts the generated script straight into the editor in one click. Nothing is written to the editor until you choose to insert it.

Selecting Use External Template replaces the editor with a URL field, and the assistant doesn't apply.

For a sense of what finished output looks like, see Sample Resource Template and Parameters Example.

Cloud Access Control Policy Assistant

Entry points mirror the template editor:

Admin → Cloud Services → Access Control Policies → + Create, or
Lab Profile → Cloud tab → Access Control Policies → + Create Policy

The Cloud Access Control Policy Assistant tracks the policy already in the editor, and its prompt text adapts accordingly — you'll be prompted differently depending on whether you're starting from an empty editor or refining an existing policy. As with templates, generated output stays in the panel until you select Use This Policy, which inserts it into the editor.

Generating a policy from lab content

A policy is only as restrictive as the inventory behind it, so the most reliable way to generate one is to give the assistant the actual content of the lab rather than a description of it. Three approaches, roughly in order of how good the result tends to be:

Paste a resource scrape. Run the lab to completion in Azure, then collect the resources it created from Resource Explorer and paste that list into the chat. This is the same collection step described in Azure Access Control Policy Creation — open Resource Explorer, expand down to the resource group's Resources node, select all and copy — except that instead of building the policy from that list by hand, you hand the list to the assistant. Because a scrape reflects what the lab genuinely provisions, including resources created as side effects that nobody would think to mention, it produces the tightest policies. Note the VM sizes from the scrape and ask for VMs to be restricted to those SKUs.

Paste the lab instructions. Copy the instruction set into the chat and ask for a policy covering what the instructions tell learners to create. Useful when the lab isn't built yet, or when you want the policy to reflect the intended scope rather than an existing deployment. It will miss resources the instructions don't name explicitly, so expect to tighten the result.

Describe it in the chat. For a sandbox or playground with little or no instruction content, describe the scope conversationally — "learners should be able to create storage accounts and small Linux VMs in UK South, nothing else". Fastest, and the loosest, so treat the output as a starting point to constrain.

Whichever route you take, read the generated policy against the ACP rules before saving it, and test it by attempting to create something it should block.

Next Steps

A generated template or policy doesn't reach learners until the lab passes review. Any Lab Profile with a cloud platform, a cloud resource group and a non-exempt ACP is flagged automatically, and changes to a resource template or an ACP invalidate an existing approval — so editing either with an assistant means the lab needs reviewing again. Read Cloud Security Review for what the review covers and how to request one, and Cloud Security Standards for the criteria your policy is judged against.