Most companies have AI pilots. Far fewer have AI in production.
The gap is rarely the model. It is data nobody cataloged, identity never designed for non-human actors, governance that exists as a document rather than as a control, and cost nobody can attribute to a feature. Those are architecture problems.
Engagements
Most relationships start with the two-week readiness assessment. It is designed to be a small, bounded first purchase that leaves you with something useful either way.
Enterprise AI Readiness Assessment
A scored picture of where you actually are across eight domains, which of your initiatives are buildable now, and a 90-day roadmap.
Cloud Well-Architected Review
One Azure subscription or landing zone against the five Well-Architected pillars. Every finding names the control it failed and the artifact that showed it, and cost findings are stated in dollars a month rather than as "consider optimizing".
Enterprise Architecture Health Check
Applications, integration, data, cloud, security, IAM, DevOps and technical debt, with a current-state assessment and a modernization roadmap.
AI / Agent Architecture Accelerator
Design of an enterprise agent platform: LLM gateway, workload identity, governed retrieval, tool registry, guardrails, evaluation and per-call cost control.
Architecture Governance Accelerator
Principles, standards, review lanes, ADR-as-Code, exception management and policy-as-code gates. Governance that runs in a pipeline rather than in a meeting.
The Well-Architected and IaC gates draw on a control catalog and framework mappings I maintain as code, so your engagement starts from a working set rather than a blank page.
Fractional Chief Architect / CTO
Senior architecture leadership on a monthly retainer, for organizations that need the judgment without another full-time executive.
Cloud & modernization architecture
Landing zone design, migration architecture, and well-architected review across Azure and AWS. Usually scoped from a health check.
How I assess
Three things that make the output worth acting on.
Against evidence, not interviews
Every finding is tied to an artifact I asked to see: the configuration where model names live, the permission set an agent actually holds, a monitoring dashboard with real values in it. Executives describe the intended state. The systems describe the real one.
Readiness follows your weakest domain
Not your average one. An organization strong in seven domains and absent in one cannot ship, and an averaged score hides exactly that. I lead with the binding constraint and what it blocks.
Feasibility is capped by reality
A use case needing retrieval over unstructured content is not feasible while that content is uncataloged, however much the sponsor wants it. You get a prioritized matrix of what is buildable now, what needs specific remediation, and what is not this year.
The Well-Architected Review in detail
Two weeks against one Azure subscription or landing zone. The five pillars, assessed against a control catalog I maintain as code rather than against a questionnaire.
What you get
A scored reading per pillar
Reliability, security, cost optimization, operational excellence and performance efficiency, each scored separately rather than averaged into one number that hides the weak one.
Findings that cite their evidence
Every finding names the control it failed and the artifact that showed it. You can check any of them without taking my word for it.
Cost findings in dollars
Stated as dollars a month against named resources, not as "consider optimizing". One module default I found in my own work would have committed a tenant to $2,944 a month nobody asked for.
A remediation order
Ranked by severity with rough effort bands, so the first week after the readout has an obvious starting point.
What it is not
Scope discipline is what keeps this at two weeks and a fixed price, so the exclusions are stated rather than discovered.
Not remediation
I find and rank. Changing Terraform, Bicep or ARM, or touching your tenant, is separate work.
Not a security audit
Penetration testing and compliance certification are different engagements with different qualifications behind them.
One subscription
The one named in the statement of work. A second is a second engagement, priced the same.
Azure, for now
The control catalog and tooling are Azure-first. AWS and GCP go on this page when they are real, not before.
Why the findings are checkable
The catalog behind this review maps each control to the Azure Well-Architected Framework and, where I have verified it, to the Microsoft Cloud Security Benchmark, NIST 800-53, PCI-DSS and the HIPAA Security Rule. Where a mapping is not verified it says so and states what settling it would take, because a compliance claim I cannot defend is worse to you than an admitted gap.
What the assessment delivers
Two weeks, five stakeholder interviews, one live executive readout.
How engagements work
Fixed price, fixed scope
You know the cost before the work starts, and the statement of work says what is excluded as clearly as what is included.
You own the deliverables
I retain my own templates and methods, and reuse them on your behalf rather than rebuilding them at your expense.
No production data
Assessment is performed against your systems in place. I do not request or receive production data, which keeps your security review short.