Input
Connector Library
Connects to just about any enterprise data source — chat, ticketing, wikis, document repositories, email — through a library of pre-built connectors or a custom pipeline. Each connector extends a shared adapter base class, normalizes to a standard envelope schema, and writes raw content to the Bronze tier. Thread resolution and delta-query incremental sync prevent re-processing full history on every run.
Extensible connector library · standard envelope
Bronze → Silver → Gold Pipeline — 4 stages
Stage 1 · Silver
Deterministic Pruning
Zero AI inference — system events, bot accounts, short messages, emoji-only content discarded by rule. Eliminates 70%+ of volume before any token-cost service runs.
›
Stage 2 · Gold
Bedrock Guardrails
Named guardrail (4 denied-topic categories: social coordination, sports/entertainment, HR/benefits, personal updates). If it intervenes, the document is archived — zero Claude tokens spent.
›
Stage 3 · Gold
Bedrock Claude Classify
Tool-forced extraction (Claude 3.5 Haiku, upgraded to Sonnet for long docs), temperature=0. Confidence score, operational domain, risk score — deterministic and repeatable.
›
Stage 4
Embed + Index
Embedding model generates vectors; hybrid BM25 + vector search index loaded with semantic reranking enabled.
🔒
Cross-Cloud Data-Minimization Boundary (Today's Design)
PII masking completes before any payload crosses to Bedrock. IAM scoped to InvokeModel / InvokeModelWithResponseStream only. Client data is never stored in AWS — only inference-time text payloads cross the boundary, and credentials are injected from Azure Key Vault at container startup.
PII masked pre-BedrockIAM: InvokeModel onlyNo client data stored in AWSPer-tenant isolation enforced at query time
Serving A
Hybrid Search
BM25 + vector query with Reciprocal Rank Fusion, mandatory server-injected tenant filter, semantic reranking.
RRF · tenant-scoped
Serving B
Operational Blueprint
Pure aggregation over search results — no LLM call. Systems owned, recurring issues, unfinished work, key knowledge holders.
0 LLM calls
Serving C
Grounded Chat (RAG)
Bedrock Claude 3.5 Sonnet, answers restricted to retrieved items only. Explicit "not found in the indexed knowledge base" fallback rather than guessing.
Citation-enforced
Serving D
Handover Brief
Auto-generated Markdown operational handover document for an incoming team member — every claim cited to a source item ID.
Markdown · fully cited
70%+
Pruned pre-AI (zero cost)
2
Bedrock stages, already prod
temp=0
Deterministic classification
0
Client data stored in AWS
As Built (Azure + Bedrock)Azure Container AppsADLS Gen2Azure Key Vault ×3Azure OpenAI EmbeddingsAzure AI Language (PII)Azure AI SearchAWS Bedrock GuardrailsAWS Bedrock Claude 3.5
AWS-Native TargetECS FargateS3 (Bronze/Silver/Gold)Secrets ManagerBedrock Titan/Cohere EmbeddingsAmazon Comprehend (PII)OpenSearch ServerlessDynamoDBSQS
Why the full port is a simplification, not just a swap: today's architecture deliberately isolates AWS to two Bedrock calls, with PII masking, IAM scoping, and Key-Vault-injected credentials built specifically to keep client data from ever landing in AWS. Consolidating onto ECS Fargate + S3 + OpenSearch Serverless + Bedrock embeddings doesn't just relocate services — it deletes that entire cross-cloud boundary, because everything sits inside one account and one VPC. One honest exception: connectors into SaaS platforms with their own OAuth/API layer will always need vendor-specific credentials regardless of hosting cloud — that's dictated by the source system, not a hosting decision, so it doesn't disappear in an AWS port.