A school-district GenAI lab wants classroom assistants under one governed Foundry resource without mixing every pilot into a single flat project. What structure helps?

Creating child projects under a governed Foundry resource for classroom assistants is the correct structure for a school-district GenAI lab that wants one governed platform boundary without defining separate Foundry projects linked by shared connections for classroom assistants. Parent Foundry resources (or equivalent Azure AI project hierarchies) provide shared governance—identity, networking, policy, and billing context—while child projects give classroom assistants, subject pilots, and lab teams separated configuration and change surfaces. That hierarchy keeps inventories searchable and permissions scoped without forcing the district to proliferate unmanaged subscriptions.

Defining separate Foundry projects linked by shared connections for classroom assistants fails because shared connections only share data access; the projects still lack one governed parent boundary for unified identity, policy, and billing. Provisioning isolated Foundry managed networks for classroom assistants traffic control fails because managed networks only control network traffic; they do not create project structure with separated configuration, scoped permissions, or searchable ownership. Configuring shared Foundry deployments with role-based filters for classroom assistants fails because filters only limit access to a shared endpoint; every pilot still shares one flat deployment surface with shared blast radius and no per-classroom ownership or rollback.

Exam caveat: child projects organize work under a governed parent; they do not by themselves equal production readiness. Choose hierarchical projects when the stem wants structure and governance together, not when the stem only asks for environment isolation of a single app’s experiment versus production.

Operational check: confirm classroom assistants live in child projects under the district’s governed Foundry resource, naming/tags identify school or program ownership, and creators cannot bypass the parent’s network and identity controls.