How the platforms fit together
Four representative architectures behind the programs in this portfolio, redrawn from published vendor reference designs. Each map reads left to right: sources, a numbered platform, the people it serves, and the controls underneath.
- 01 · Microsoft Azure — Governed generative AI knowledge assistant
- 02 · Amazon Web Services — Diagnostic data migration from Oracle to AWS
- 03 · Multi-tenant — CoLab: multi-tenant content automation with human-in-the-loop review
- 04 · Google Cloud — Studio ONE: one operating platform for a ceramics studio
Governed generative AI knowledge assistant
A private, identity-bound retrieval-augmented generation (RAG) platform that answers voice and text questions only from approved operating material. Every service is reached over private endpoints, and evaluation sits on the delivery path rather than after it. Related case study: CoCo on Azure.
- Extracted
- Chunked
- Embedded
- Hybrid index
Drag to pan · Ctrl/⌘ + scroll to zoomDrag to pan · Pinch to zoom
Ingest & prepare
Approved documents land in Blob Storage on change. Document Intelligence extracts layout and Functions split content into governed chunks with source metadata.
Knowledge & grounding
Chunks are embedded and written to a hybrid (keyword and vector) Azure AI Search index. Conversation state is kept in Cosmos DB.
Orchestration & models
The agent applies the system prompt and tools, retrieves grounding passages, calls the chat model, and passes inputs and outputs through Content Safety.
Experience & evaluation
Users reach the app only through Application Gateway with WAF. Groundedness evaluations and user feedback gate releases; telemetry flows to Application Insights.
Identity, network & governance
Entra ID and managed identities replace keys, every data service sits behind private endpoints, egress is forced through Azure Firewall, and Policy and Purview hold the evidence.
Diagnostic data migration from Oracle to AWS
A validated, phased move of on-premises Oracle schemas and instrument data to managed AWS services. Schema conversion, change data capture, and reconciliation run as separate, evidenced steps so cutover is a controlled decision rather than a single event. Related case study: Abbott Oracle-to-AWS migration.
- Raw
- Validated
- Curated
Drag to pan · Ctrl/⌘ + scroll to zoomDrag to pan · Pinch to zoom
Convert & migrate
DMS Schema Conversion translates Oracle schemas and PL/SQL; DMS runs a full load followed by change data capture. DataSync and Transfer Family bring instrument and partner files.
Operational store & data lake
Aurora PostgreSQL becomes the system of record. Files move through raw, validated, and curated S3 zones, cataloged in Glue and governed by Lake Formation.
Validate & reconcile
DMS validation compares source and target row by row; Glue Data Quality applies business rules; Step Functions runs repeatable reconciliation and logs each defect.
Serve & cut over
Applications repoint to Aurora behind a Route 53 switch. Validation reports are kept immutable in S3 as the evidence for go and rollback decisions.
Security & operations
IAM, KMS encryption, and Secrets Manager protect data in motion and at rest; CloudTrail, Config, GuardDuty, and CloudWatch provide audit and monitoring.
CoLab: multi-tenant content automation with human-in-the-loop review
One shared platform serving every market in a global campaign as a separate tenant. Each market keeps its own approved claims library and review rules; shared AI services extract claims, validate them against that market's approved sources, and score confidence; and every decision routes to a human reviewer with an immutable audit trail. Labels show Azure and Google Cloud equivalents. Related case study: CoLab content automation.
Drag to pan · Ctrl/⌘ + scroll to zoomDrag to pan · Pinch to zoom
Control plane
Each market is onboarded as a tenant. The identity provider adds the market to every token, and the gateway routes and throttles by market.
Market-isolated data plane
Each market's approved claims library and decision history are kept apart; every query carries a mandatory market filter, and every decision is written to an immutable log.
Shared AI services
Claims are extracted from each asset and validated against that market's approved sources. A confidence score with an explanation sets the route; guardrails and evaluation hold quality.
Route & review
High-confidence claims go to fast-track review and novel claims to senior review. A human makes every decision, with the evidence beside each claim.
Cross-market governance
Application code, not the model, enforces market boundaries. The audit trail, quotas, and policy as code make isolation and every decision provable.
Studio ONE: one operating platform for a ceramics studio
Clay Space ran its studio on twelve tools that did not share data, so staff re-keyed records by hand and members juggled five logins. Studio ONE replaces them with one platform: integrations import history and keep data in sync while each tool is retired, one database becomes the record for households, memberships, firings, and payments, and members, staff, and the owner each get one place to work. QuickBooks and Gusto stay in place and are fed by the platform. Generative AI is deferred to Phase 2. Related case study: Clay Space Studio ONE.
- Import
- Match & de-duplicate
- Unified record
Drag to pan · Ctrl/⌘ + scroll to zoomDrag to pan · Pinch to zoom
Integrate & migrate
Application Integration connects to Sawyer, Acuity, WooCommerce, and the other tools through connectors and webhooks. History is imported once, and sync keeps data current while each tool is retired.
One source of truth
Records are matched and de-duplicated into one Cloud SQL database for households, memberships, bookings, firings, and payments, with a durable ledger and audit log. BigQuery receives a copy for reporting.
Studio ONE platform
Python and Rust services on Cloud Run hold the fourteen modules behind one sign-in, and a Next.js web app serves members, staff, and the owner. A rules engine runs workflows and approvals, and notices go out by email, SMS, and push. Generative AI is deferred to Phase 2.
Use
Members book, pay, and manage their membership in one portal and app; staff run rosters, attendance, and the kiln log; the owner sees the business in one dashboard, and QuickBooks and Gusto are fed by the platform.
Platform foundation
Role-based access, a durable audit log, and human approval gates; no raw card or bank credentials are stored, and the studio owns its data.