After twenty years of building infrastructure for other people’s companies, almost none of what I learned is written down anywhere public. This site is where that changes.
What I plan to write about
The theme is narrow on purpose: securing AI workloads on Azure in environments that have auditors. That covers a few recurring problems I keep meeting on engagements:
- Landing zone design for Azure AI Foundry and Microsoft Fabric — private networking, managed identity, and keeping data exfiltration paths closed.
- Identity and access for AI agents. Least privilege stops being simple the moment a model can call tools on your behalf.
- Translating ISO/IEC 27001, NIST CSF 2.0 and FFIEC expectations into Azure Policy, RBAC-as-code and evidence that survives an audit.
- The infrastructure code underneath all of it — tiered Terraform module design, Bicep, and release strategies that reduce production risk rather than adding ceremony.
How it will be published
Every substantial post will come with something you can run: a Bicep or Terraform module, a policy initiative, or a reference topology. The write-up explains the reasoning; the repository holds the implementation.
This site itself is a small example of that. It is a static Astro build hosted on Azure Static Web Apps, provisioned by Bicep and deployed from an Azure DevOps pipeline. The infrastructure code is part of the same repository as the content.
More soon.