Case study
Agent-operated infrastructure, through one toolkit.
The infrastructure behind Phase 3 Benefits is provisioned and run through the SysAdmin Toolkit: custom adapters for each service, operated by agents under one person's direction. Access, the environment, the domain, the pipeline and deployments go through it. SOC 2 and HIPAA readiness follows, with policies grounded in what was actually implemented.
Why one toolkit
One person running the infrastructure for a regulated financial product faces the same work as an operations team: new starters need access, permissions and configuration change, environments get provisioned, builds get deployed. Spread across a dozen consoles, that work is slow to do and hard to describe afterwards.
The SysAdmin Toolkit gives agents one way to do it. Each service has a custom adapter, so provisioning and managing it is work an agent can be directed to do and a person can follow.
What runs through it
An adapter for each service. The breadth is the point: the toolkit is how the infrastructure is operated, not a compliance tool added afterwards.
- People
Access and configuration
Employee provisioning, permission changes and configuration changes, made through the toolkit's adapters instead of by hand in each console.
- AWS
The environment
Provisioned through the toolkit, including the server the product runs on.
- Cloudflare
Domains
Domain management in front of the environment, through the same toolkit.
- GitHub Actions
The pipeline
Set up to run tests, SonarCloud analysis, integration tests against the server and accessibility checks, then deploy to AWS when the run is green.
Policies and evidence are grounded in what the toolkit implemented
Compliance readiness, grounded in the implementation.
- SOC 2 policiesGenerated from the configuration the toolkit implemented, rather than written ahead of it.
- HIPAA policiesFrom the same source, so the policies describe the environment as it was actually built.
- EvidenceCollected as part of operating, so readiness work does not start from an empty folder.
Deploying on green
Deployments go through GitHub Actions. The toolkit set the pipeline up to run tests, SonarCloud analysis, integration tests against the server and accessibility checks, and to deploy to AWS when the run is green.
Because the pipeline is how changes reach production, the release-control policy can describe the pipeline that runs rather than an intention written down in advance.
A policy that describes the pipeline you actually run is easier to keep honest than one that describes the pipeline you meant to run.
This is readiness: the environment, the policies that describe it and the evidence collected while operating it, kept close together.Where judgment sits
The toolkit does the operating. What the environment should be, which controls the product needs and what the policies commit to stays with a person.
Generating a policy from the implemented configuration does not decide whether the configuration is right. Choosing the controls, weighing the trade-offs a regulated financial product can accept and judging whether the evidence is sufficient remained Michael's work. The toolkit took the operating and the reconciliation off his desk, not the responsibility.
If you are about to do this
- Give agents one way to operate every service.
Custom adapters turn a dozen consoles into one toolkit that agents can be directed through and a person can follow.
- Make the pipeline the route to production.
Tests, analysis, integration and accessibility checks before a deploy on green give release control a concrete shape to describe.
- Ground the policies in the implementation.
Policies generated from what is actually configured, with evidence collected while operating, keep readiness close to reality instead of making it a separate project.
Need a leader who can
build with AI?
Let's talk about the product challenge, the team, and the outcomes you need—whether you're improving how your business runs or building something new.