Black Shard

The platform under your software, and under your agents.

Azure landing zones, managed hosting and delivery pipelines, plus the identity, permission and audit layer that lets AI agents work without holding the keys.

Talk to us about your platform

We design and operate Azure environments in Australian regions: landing zones, networking, identity, secrets in a vault, backups with tested restores, monitoring and patching, and the pipelines that ship to them. The same practice runs our own platforms and our clients'.

Agentic infrastructure

Agentic infrastructure is the layer we add for AI agents: each agent runs under its own identity with scoped tool permissions, every action is logged against the record it touched, secrets never enter a prompt, and a human approval gate sits in front of anything irreversible. We run our own operations on agents built this way and build the same controls for clients.

Azure landing zones and platform engineering

Subscriptions, networking, identity and policy laid out once so every workload lands in a governed place.

What you get

  • Landing zone design and build in Australian regions, with policy applied at the management-group level
  • Identity and access through Entra ID with phishing-resistant sign-in for administrators
  • Secrets in Key Vault, encryption at rest and in transit, and logging to a central workspace

Managed hosting and operations

Dedicated infrastructure per client, patched, backed up, monitored and reported on every month.

What you get

  • Dedicated compute and storage in Azure Australia East, nothing shared between clients
  • Daily backups held in Australia with restores tested on a schedule and the result reported
  • Around-the-clock monitoring with incidents routed to an engineer, and a written monthly report

Delivery pipelines and environments

Continuous integration and deployment with staging, production and rollback, built so a release is routine.

What you get

  • Pipelines that run tests and security checks before anything deploys
  • Staging and production environments with configuration held outside the code
  • Rollback and release records for every deployment

Agent runtime and tool permissions

A runtime for AI agents where each agent holds its own identity and only the tool permissions its job needs.

What you get

  • One identity per agent, with credentials brokered so no agent can read a key
  • Tool permissions scoped to one action each, with authorisation decided in the downstream system
  • A human approval gate in front of destructive, financial or external actions

Agent observability and audit

A record of what each agent read, what it returned and what it did, kept independently of the agent.

What you get

  • Every prompt, retrieval and action logged against the record it touched
  • Dashboards of agent activity, cost and failure rates
  • Retention and access set so the log answers an auditor, a regulator or an insurer

Model and AI endpoint hosting in Australia

AI models and services hosted on Australian endpoints with data residency, no training on client data and retention off where supported.

What you get

  • Azure AI endpoints in Australian regions, with the residency position documented for procurement
  • Content and rate controls in front of every model call
  • Cost visibility per feature and per client

How it is shaped

A platform review or a landing-zone build as a fixed-scope engagement, then managed operation on a monthly fee. Agent infrastructure is scoped with the agents it will run.

Recent work of this kind

  • Aurii

    Clinical software

    Deploys run from GitHub Actions to Azure through workload identity federation, so the pipeline holds no long-lived Azure credential, and a bad release rolls back by moving traffic to the previous Container Apps revision.

    Read the case study

  • Fox Valuations

    Property valuation

    Live at foxvaluations.com.au under an ongoing ICT and growth engagement: hosting, mail, search foundations and the document pipeline run on infrastructure we operate.

    Read the case study

  • Zenith Cardiology

    Hosting, ICT management and security under an ongoing engagement.

The rest of the firm.

Tell us what has to run, and what the agents are allowed to touch.

Brisbane head office.

Open a briefinfo@blackshard.com.au