Saguaro Cloud SystemsCloud, platform and agentic AI engineering

We work inside your systems, not beside them.

Senior engineers, forward-deployed. Agentic systems at the front, and the infrastructure that has to hold them up.

See our workStart a conversation

A recent project

All our work

Media and high-traffic

An AI match-intelligence control room for live sports broadcast, on Azure

Puts AI-written match insight on air for many broadcast partners at once, in English, Spanish and German, each under its own editorial policy. Models on Microsoft Foundry write the words; code computes every number and checks every claim; corrections reach everything already published; every item on air carries a signature from Azure Key Vault. Built for the Microsoft × Premier League developer hackathon.

Read the case study
DeliveredOct 2026
  • Agentic AI
  • Architecture and strategy
  • Cloud cost and performance
  • Cloud infrastructure and migration
  • Custom software engineering
  • Generative AI
  • MLOps and AIOps
  • Security, identity and compliance
Microsoft Foundry · Azure OpenAI · Microsoft Agent Framework · Azure Container Apps · Bicep

What it is built on

AI
Microsoft Foundry
One account and project, keyless: callers present an Entra ID token, and no API key exists.
Azure OpenAI gpt-5-mini
The fast model. Drafts each insight and localises it per partner, behind an alias so a swap is a one-line change.
Azure OpenAI gpt-4.1-mini
The fallback, from a different model family, so a failure in one is unlikely to repeat in the other.
Microsoft Agent Framework
The Analyst and Localizer agents, with every model call and tool call traced.
Model Context Protocol
A private match-data server the agent reads facts through, so it explains from data rather than memory.
Evaluation gate in CI
A pull request that touches the pipeline replays seeded matches through the models, base branch against candidate. One planted lie let through blocks the merge.
Azure
Azure Container Apps
Web, API and MCP server on the serverless Consumption plan. Scales to zero; the API and MCP server are internal only.
Azure Key Vault
An EC P-256 key that signs a provenance record for every item on air. The private key never leaves the vault.
Azure Blob Storage
The spend ledger, claimed atomically with ETag writes; the versioned partner policy book; the signed records.
Microsoft Entra ID
A managed identity per job, each holding one role on one resource. No keys, secrets or SAS tokens anywhere.
Application Insights
OpenTelemetry traces through the Azure Monitor distro, with no prompts or model output recorded.
Log Analytics
Container logs, with a hard daily ingestion cap.
Azure Container Registry
Images pushed and pulled by managed identity only.
Azure Cost Management
Budget alerts, on top of per-model rate limits and a cap on matchday runs per day.
Bicep and Azure Developer CLI
The whole estate as code, with policy tests. One azd up provisions and deploys it.
GitHub Actions
Every merge to main deploys through workload identity federation, with no stored credentials.

We don’t compete on price. We compete on the kind of attention most teams can’t sustain.

How we work with you

Four steps. You get the first two whether or not you end up hiring us.

  1. One call

    We read the system with you

    About ninety minutes, no deck, no discovery invoice. We want the shape of the thing: what runs, what it touches, where it hurts, and which constraint is actually load-bearing. Bring an engineer who knows where the bodies are buried.

    A shared account of the problem, in your words and ours.

  2. Within a week

    You get our assessment in writing

    A written assessment of your system as we understand it, including the parts we think you have wrong and the parts we are unsure about. It says what we would do first and what we would refuse to promise. Written so you can forward it to someone who was not on the call.

    The written assessment. Yours to keep whether or not you hire us.

  3. If it proceeds

    We build it in the open

    We work forward-deployed: in your own repositories and cloud accounts, and on site when the project needs it. Observability and evaluation go in from the first commit, not bolted on before handover. Nothing is demonstrated that you cannot run yourself, and no step depends on us being in the room.

    Working software in your repository, history intact: infrastructure as code for everything that runs, runbooks for the failure modes we actually hit, and the evaluation harness with what it scores.

  4. At the end

    We write the project up

    What it does, the dates it ran between, and the capabilities it required. It goes on the site as a case study you can point a colleague at, and you get the same document for internal use.

    A written handover your team can run from, and a case study written for someone who wasn’t there.

A control diagram: an input summed with a feedback signal, passed through a controller and a process to an output, with a sensor returning the output to the summing junction.

Fig. 12The loop, drawn

Every engagement above is this diagram. The part most teams leave out is the line coming back from the right-hand side: the sensor, and the summing junction that does something with what it reads. A system without that line is not simple, it is open, and open systems are the ones that surprise you in production.

  • 102Feedback path
  • 118Control signal
  • 246Sensor
  • 410Return to summing junction

Problems people call us about

Six of the situations we see often, taken from real projects and anonymised. Some name an industry, some name a problem, because a platform problem arrives the same way in every sector.

Read the full scenarios
  1. 01E-commerce & Direct-to-ConsumerYou've outgrown a WordPress/WooCommerce store and want a fast headless storefront, but you don't want to build and secure your own checkout, and guest purchases (including ones made before an account exists) still have to unlock the right account, with refunds reversing access.Projects in this area
  2. 02Enterprise SaaS & platform teamsAs the fleet grows to hundreds of services across several regions, the platform team becomes the bottleneck: reliability and operational maturity are uneven and invisible, and engineers open tickets for basic questions like 'can this cluster reach that host on that port?'Projects in this area
  3. 03Non-profit & educationYour system of record is a SaaS you can't modify, and it only emits a daily spreadsheet that's a 31-day rolling window rather than a running total, so summing snapshots double-counts and naively diffing them reports 'lost' donors who did nothing.Projects in this area
  4. 04Fintech & regulatedMoney moves through a third-party processor's webhooks, which retry and arrive out of order, so you risk double-provisioning and failing to reverse on refund, and auditors need every discrepancy visible.Projects in this area
  5. 05Media & high-trafficPublic read traffic is spiky and the read path recomputes expensive aggregates or hits a slow upstream on every request; meanwhile large file downloads on poor mobile networks get severed by default request timeouts and full-response buffering, and the public surface must never expose internal fields.Projects in this area
  6. 06Teams adopting agentic AI / LLM assistantsYou want to add an LLM assistant to an existing product or ops workflow, grounded in your own data rather than hallucinating, without runaway model cost, without the model taking a destructive action, and without prompt injection riding in through the data it reads.The full scenario
  • Google Cloud
  • AWS
  • Azure
  • Shared VPC
  • Cloud DNS
  • IPAM
  • Cloud NAT
  • Cloud VPN
  • NGINX
  • Akamai
  • BIND
  • Big-IP
  • OpenTelemetry
  • Prometheus
  • Grafana
  • Datadog
  • Honeycomb
  • Cloud Monitoring
  • PagerDuty
  • Sumo Logic
  • GitHub Actions
  • Tekton
  • Cloud Build
  • Jenkins
  • ArgoCD
  • Kustomize
  • Atlantis
  • Anthos Config Management
  • Kubernetes
  • GKE
  • Cloud Run
  • Azure Container Apps
  • Helm
  • Knative
  • Docker
  • Kyverno
  • Anthos
  • Anthos Service Mesh
  • Cloud Functions
  • OpenShift
  • Terraform
  • Pulumi
  • Bicep
  • Terraform Cloud
  • Ansible
  • Packer
  • Puppet
  • Backstage
  • Nx
  • Moon
  • Renovate
  • release-please
  • PostgreSQL
  • BigQuery
  • Spanner
  • Pub/Sub
  • Kafka
  • Redis
  • Cloud SQL
  • Bigtable
  • Dataflow
  • GCS
  • MySQL
  • MongoDB
  • SQS
  • Memcached
  • Workload Identity
  • Vault
  • Secret Manager
  • Cloud KMS
  • cert-manager
  • Cloud Armor
  • Okta
  • StrongDM
  • Twingate
  • OpenLDAP
  • Burp Suite
  • Metasploit
  • sqlmap
  • OWASP ZAP
  • Nmap
  • Snyk
  • Vertex AI
  • Microsoft Foundry
  • Gemini
  • Azure OpenAI
  • Google ADK
  • Microsoft Agent Framework
  • Claude
  • AutoML
  • Linux
  • KVM
  • OpenStack
  • Slurm
  • VMware
  • Ubuntu
  • FreeBSD
  • OpenHPC
  • NetApp
  • Gluster
  • libvirt
  • Redfish
  • IPMI
  • PXE
  • xCAT
  • Go
  • TypeScript
  • Python
  • Rust
  • Node
  • uv
  • Bash
  • PowerShell
  • Perl
  • Next.js
  • Gin
  • GraphQL
  • Shopify
  • SendGrid
  • Apps Script
  • Apache

Technology we work with

The disciplines, in the order the work runs. Every tool behind them is named in the full index.

The full indexRead the engineering notes
  1. Cloud platforms03Google CloudAWSAzure
  2. Networking09Shared VPCCloud DNSIPAMCloud NAT+5 more
  3. Monitoring and observability08OpenTelemetryPrometheusGrafanaDatadog+4 more
  4. CI/CD04GitHub ActionsTektonCloud BuildJenkins
  5. GitOps04ArgoCDKustomizeAtlantisAnthos Config Management
  6. Containers and orchestration12KubernetesGKECloud RunAzure Container Apps+8 more
  7. Configuration management and IaC07TerraformPulumiBicepTerraform Cloud+3 more
  8. Platform engineering05BackstageNxMoonRenovate+1 more
  9. Data and messaging14PostgreSQLBigQuerySpannerPub/Sub+10 more
  10. Security and identity10Workload IdentityVaultSecret ManagerCloud KMS+6 more
  11. Security testing06Burp SuiteMetasploitsqlmapOWASP ZAP+2 more
  12. AI and machine learning08Vertex AIMicrosoft FoundryGeminiAzure OpenAI+4 more
  13. Systems and virtualisation15LinuxKVMOpenStackSlurm+11 more
  14. Languages and toolchains09GoTypeScriptPythonRust+5 more
  15. Application layer07Next.jsGinGraphQLShopify+3 more
  16. IndexALL121technologies across 15 disciplines, every one named in the full indexOpen the index

Named because we have run them in production.Not because they are the limit. A list like this is a record of what has already shipped; the part of a project worth doing is usually the part that is not on it yet.

Detailed case studies

Most of what we list carries only dates, a sector and a tech stack. Six are written up in full; these two are from other sectors than the project above.

All our work

Systems that hold

Four rules, no supervisor, and a structure that keeps emitting.

LifeB3/S23
Gen 0
Gosper gun · 4 rules · no supervisor

Where to go next

Four pages, and each one is written for a different question. The colour is not decoration: every page on this site carries one of these, and it tells you which chapter you are in before you have read a word.

Got something that has to keep running?

Let’s build it in the open.

One call, about ninety minutes, no slide deck. Within a week you get a written assessment of your system, including the parts we think you’ve got wrong. It’s yours to keep whether or not you hire us.

To start, write a few lines: what the system is, what’s stuck, and when it has to be working.

Start a conversationroot@saguaro.cloud