AI Governance · Azure · Regulated Enterprise
I build AI platforms that pass the audit.
Twenty years of Azure, AWS, identity and Kubernetes - and the control mappings that make a platform defensible to your risk committee. Most consultancies can write the mapping or ship the Terraform. I do both.
Services
Three ways this usually starts
Each one is scoped to produce something your risk function can read and your platform team can deploy - not a slide deck.
01
AI Landing Zone
An API gateway in front of your model endpoints: model allowlists, per-team token quotas and chargeback, prompt and response logging, tenant isolation. Terraform, from day one. Ends the era of API keys in config files.
What's included →02
AI Act readiness
Inventory what your teams have actually shipped, classify it against the Act, and map the Article 50 duties that already bite to concrete platform controls - with a runway to the December 2027 high-risk deadline.
What's included →03
Identity & Zero Trust review
Entra ID architecture, Conditional Access design, Global Secure Access and workload identity - reviewed against the access-control clauses every framework opens with, and remediated in code.
What's included →Writing
Notes from actually building this
Long-form, specific, and written while the terminal was still open. No gated PDFs.
-
Microsoft 365 Security as Code — Part 3: Running Microsoft365DSC on Linux
Microsoft365DSC was built for Windows, but our pipeline runs on Linux. This is how I made the apply step work without the Windows engine: a small parser for the compiled configuration, a careful Exchange Online session, and the permission problem that looked like a code problem.
-
Microsoft 365 Security as Code — Part 2: One benchmark, four tools
No single tool reaches every setting in the CIS Microsoft 365 benchmark. This is the order in which I choose a tool for each control, a worked example of a setting that no tool exposes, and why the code lives in several repositories with several identities.
-
Microsoft 365 Security as Code — Part 1: Before you write any code
The CIS Microsoft 365 Foundations Benchmark has 160 recommendations, and writing the code is the easy part. These are the decisions that have to come first: which profile you sign up to, what is in scope, what 'done' means, and who accepts the exceptions.
-
Building an AI Landing Zone on Azure — Part 5: Turning tokens into euros
Raw usage records are not a bill. This is the rate card as data, cost computed at query time, the cached/cache-write/reasoning token nuances, and the report that gave finance a monthly AI bill per cost centre.
Is your AI platform defensible?
Thirty minutes, no deck. Tell me what your teams have shipped and where the audit pressure is coming from, and I'll tell you what I'd look at first - whether or not you hire me.