AI Landing Zone

The problem this solves

Your teams moved fast, which was the right call. The side effect is that model endpoints are being called directly, keys live in config files and pipeline variables, nobody can produce a list of which products use which models, and the first honest answer to "what are we spending on this?" arrives with the monthly invoice.

None of that is a developer discipline problem. It is a missing platform layer.

What I deliver

• API Management in front of every model endpoint - Azure OpenAI first, other providers behind the same contract. One place where policy is enforced, one place to look when someone asks what was called.
• Per-team model allowlists, so which team may call which model at which version is a technical control rather than a wiki page nobody reads.
• Token quotas and chargeback, with usage ingested into a pipeline your finance function can read. Budgets that alert before they are breached, not after.
• Prompt and response logging with retention and redaction agreed with your DPO - the same substrate serves incident response and Article 50 evidence.
• Identity and network isolation: managed identity end to end, private endpoints, no standing keys.
• Everything in Terraform, in your repos, in your pipeline. You own it when I leave.

What you have after 30 days

A working gateway in a non-production subscription with one real team migrated behind it, a usage dashboard showing their spend, and the Terraform modules plus a runbook for onboarding the next team. Not a pilot that needs rebuilding - the production path, with one tenant on it.

What I need from you

A subscription I can build in, one product team willing to be first, and someone from risk or compliance in the room for two of the sessions. That last one is what stops this becoming a platform that has to be retrofitted for audit later.