Azure Policy External Evaluation (ARG) authoring

Procedure for authoring and testing an enforcement Azure Policy that queries Azure Resource Graph (ARG), utilizing the new External Evaluation features. Follow the workflow below when the user asks for a policy whose decision depends on ARG data.

The output of the procedure is a folder containing: a policy-definition.json, a test-flow.http, and an EXPLANATION.md. The policy assignment body lives inline in the .http file (see step 4 below). A secondary goal of this procedure is to help users learn about the new External Evaluation feature.

The procedure never provisions anything in the user's subscription; the only Azure side-effects are read-only ARG queries via az graph query.

Knowledge files referenced throughout — read them as needed:

• knowledge/01-overview.md — what External Evaluation + ARG is and known feature limits
• knowledge/02-policy-artifacts-shape.md — canonical JSON for definition + assignment, field by field, with locks and leeway
• knowledge/03-rest-flow.md — Token API REST contracts, response shapes, the 403 to expect

Also available: templates/ (canonical skeletons) and examples/ (worked end-to-end scenarios).

Rules