Staging App Configuration for a clerk RAG assistant is verified. How should settings move to production safely?

Once staging App Configuration for a clerk RAG assistant is verified, production should receive that same approved settings set through a controlled promotion—typically an App Configuration snapshot or an import of the verified staging configuration into production labels/keys. Promotion preserves what passed clerk UAT (feature flags, endpoint names, model deployment keys, non-secret toggles) and reduces the chance that production drifts from the tested baseline during peak filing hours.

Hand-editing production keys live during peak filing hours with no snapshot is high-risk change management and invites typos that break the RAG assistant for residents and clerks mid-day. Copying secrets into App Configuration labels labeled prod-temp without review conflates secret storage with configuration and skips governance. Overwriting production randomly from a developer's laptop each sprint destroys auditability and reproducibility across municipal environments.

Exam caveat: App Configuration is for configuration and feature flags; secrets still belong in Key Vault with references where appropriate. Labels, soft-delete, and snapshots support safe promotion—but you must still validate which label/key filter is imported so staging-only experiments are not promoted. Key Vault references and RBAC on the production store remain in force after import.

Operational check: Export or snapshot the verified staging set, import into production under the intended label, compare key counts and values (excluding secret material) against the staging checklist, flip any progressive feature flags carefully, and watch clerk RAG error rates and dependency latency for a soak window. Keep the prior production snapshot available for rapid rollback if filing workflows regress.