What you get with every build
Every client system follows the same pattern, so you own it and someone else could take it over.
What you get
You own it
Your system runs in an account named for you, not in my shared platform. The code, the data and the account can be handed to you or to someone else at any time.
It's safe by default
A spending cap, error alarms and a record of every change are built in from the first day. Data stays in US regions, and nothing sensitive sits in code or email.
It’s documented
Runbooks, restore steps and a written map of the system ship with every build, so nothing lives only in my head.
AI with a hand on the brake
AI reads, summarizes and suggests. Rules handle anything that has to be exact, and a person approves anything that matters.
How it fits together
All environments sit under one AWS Organization for billing and policy, but each client gets its own account. Nothing is shared between clients except reusable code.
Colors follow AWS service categories; grey is outside the account; dashed lines are background paths. Swipe the diagram sideways.
Step by step
- Organization-wide guardrail policies apply to every account, including my own: US regions only, with narrow, deliberate exceptions.
- Each client gets a separate account, named for the client, under the Clients group.
- The same tested modules build each environment, usually a production stack plus a sandbox.
- Access is by single sign-on with personal identities. There are no shared root passwords.
Technical details
For your IT person: components, trade-offs and security. Open any section.
The standard kit
| Layer | Service | What it does here |
|---|---|---|
| Accounts | AWS Organizations | A management account for billing and policy only. Internal and client accounts sit in separate groups. |
| Guardrails | Service control policies | A US-regions-only pin with explicit, reviewed exceptions, such as US-only AI inference. |
| Access | IAM Identity Center | Personal sign-ins with short-lived credentials, instead of long-lived keys on laptops. |
| Web | S3 + CloudFront + ACM | Private buckets behind a CDN, TLS 1.2+, security headers and edge functions for routing and gating. |
| Compute | Lambda (function URLs) | Small single-purpose functions, each with its own least-privilege role. |
| Flow | SQS, EventBridge | Queues between intake and processing, dead-letter queues for failures, and schedules for routines. |
| AI | Bedrock, or the client’s own AI tools | Structured extraction with version-controlled prompts, plus deterministic rules for anything that must be exact. |
| Safety net | CloudWatch, SNS, Budgets, CloudTrail | Alarms on errors, a monthly spending cap, an audit log, and alerts to business channels only. |
| Code | Terraform / CloudFormation | Every environment rebuilt from code, a sandbox before production, and backups taken before every change. |
Principles
Want this pattern under your business?
Book a free 30-minute fit call. I’ll sketch what your environment would look like and what it would cost to run.