A city library wants a Python service that answers storytime-program questions using a Microsoft Foundry project. Which integration pattern should the developer implement?

A city library Python service should consume a Microsoft Foundry project the same way other municipal apps consume managed platform services: authenticate with project-scoped credentials and call the project and model endpoints from application code. That pattern keeps model hosting, versioning, quotas, and credential rotation in Foundry while the library service remains a thin client for storytime-program Q&A. Residents get answers from the current deployment without each branch website shipping model binaries. Running the Foundry model inference locally in the Python service with project-scoped credentials abandons managed deployment, bloats the service, and forces every update through a service redeploy instead of a controlled model swap through Foundry. Calling the Foundry control-plane endpoint from the Python service with project-scoped credentials for inference misuses the management plane for data-plane work and is not a substitute for calling the existing storytime model endpoint. Calling the Foundry project and model endpoints from the Python service with subscription-scoped credentials uses an overly broad scope that violates least privilege and risks access beyond the storytime project, and is not the project-scoped credential pattern the Python service should use. On the exam, Foundry app integration means call project/model endpoints with scoped credentials; distractors run inference locally in the Python service, misuse the control-plane endpoint for inference, or call project/model endpoints with subscription-scoped credentials. Caveat: project-scoped credentials still need least privilege, secret store usage, and network controls—calling Foundry does not replace municipal identity or private-networking baselines. Operational check: from the Python service, acquire project-scoped credentials, invoke the storytime model endpoint with a sample patron question, verify the response path and audit logs, and confirm no inference runs locally in the Python service and no FTP shares are shipped with the library website.