Architecture
Infrastructure requirements for AI agents in a regulated environment
What we specify to your cloud team or infrastructure partners so agents run without compromising on compliance.
The pattern
Cloud architecture isn't our trade — we work with your internal team or specialized partners to implement it. What we bring is the precise specification of what AI agents need to run in a regulated environment: a filtered entry zone (API Management) ahead of any access to agent services, agent services isolated from the AI zone hosting the models (Azure OpenAI, Microsoft Foundry) and the RAG vector store, a separate data zone for the Data Lake and analytics, and a cross-cutting security and governance zone — Key Vault, Defender, Private Endpoints, Log Analytics — that governs all inter-zone traffic without ever routing through the public internet. We arrive with this spec, your cloud team (or ours, via our partners) implements it.
Technical choices
Systematic Private Endpoints between zones: we require it in the spec regardless of who implements it — non-negotiable in regulated industries
Strict separation between the AI zone and the data zone: enables differentiated retention and classification policies, especially for sensitive personal data flowing through the vector store
Agent services and runtime choice (Container Apps, AKS or equivalent) left to your cloud team: we specify the requirement (scalability, isolation), not the implementation
Centralized Log Analytics across all zones: the precondition for a coherent cross-cutting audit that we require, whether the infrastructure is managed in-house or by a partner
Trade-offs we accept
Strict segmentation between zones increases initial deployment complexity — a trade-off we stand behind in our specs given the risk of non-compliance
Working with a third-party cloud team (in-house or partner) adds a coordination point; we document our requirements precisely to limit back-and-forth