Uptime is the product.

DR environments drift because nobody updates them alongside what they mirror. Drills were partial, slow and rare.

I audited the DR estate, then had an AI agent build a one-click pipeline: failover, disk resize, database configuration, a 31-script data deploy with a row-count gate, sanity tests and teardown.

The agent added a guardrail unprompted: it refuses to run if any production name appears. Failed runs tear themselves down. Thirteen runs in a week, each defect fixed by change request.

Four recovery blockers fixed during the drill, signed off as audit evidence. The rewritten runbook puts a clean drill near 5h 20m.

Rebuild patching for a mixed Windows and Linux fleet: one schedule, and evidence an auditor can check for every patch. The company's first AI-run infrastructure project.

I proved Ansible patching of Windows over SSH: QA, a test database, then new production hardware.

Then the fence, before the agent got the keys: a key bound to one address and one command, a seven-verb gatekeeper, a non-production allowlist, an audit log, and a cooldown only I can clear.

The agent widened its lane one merged change at a time. Production ran on a schedule or from my hands.

27 legacy scheduled tasks retired, one schedule across QA, stage, production and DR. A cache cluster planned as a 10-hour upgrade took about 3.

Aging SQL Server hardware in a replication-heavy design, with a cloud reporting database downstream. Reseeding that cloud copy was estimated at 16 hours.

I rewrote replication seeding to be backup-based and designed a relink for the cloud subscriber that skips the reseed when the data is byte-identical. A preflight refuses if even a handful of rows differ.

Twelve days of burn-in, validation cutovers, an outside consultancy's review, and a go/no-go gate I held until the evidence was in.

Saturday cutover done the same day, zero failures in the release tests. Seeding went from about 4 hours to about 1.

Infrastructure knowledge lived in heads, stale diagrams and a wiki nobody trusted. An AI that reads bad documents gives confident bad answers.

With my manager I designed a version-controlled repository of infrastructure records: inventory, dependencies, live state, changes and incidents. Nightly read-only collectors run only in CI, so every record has provenance.

Overnight changes become a pull request an AI summarizes in plain English each morning, silent when nothing changed. Drift noise started near 4,400 changed lines on quiet nights; five fixes later it read zero.

It rebuilt a year-old production network diagram in minutes and showed the old one wrong in three places. A preflight skill now cites the record and blocks any change it can't prove safe.

Everyone wanted AI. Nobody had written down which tools were allowed, where data went, or how an agent could ever touch infrastructure.

I wrote the department's AI setup standard and became the intake reviewer: a security review for new vendors, a lighter path for AI features in approved tools. I vetted retention, subprocessors and SOC 2 reports.

I turned down a notetaker because every user could read every transcript, parked my own tool when its sample data had names in it, and moved the AI off my admin identity onto its own least-privilege one.

I brought the controls with the ask for the first AI agent on infrastructure; leadership approved in about 90 seconds. Another department's first request came in mid-afternoon and was live the next day.

New workloads were heading to Azure without a shared foundation: no common policy, naming, networking or production-readiness bar.

As ops-side architect, paired with one developer, I built the landing zone in Bicep: management groups, policy as code, transport security as defaults and deny rules, hub-and-spoke networking with private DNS, GitHub Actions on private runners.

I designed a four-document production-readiness package, vended into every new workload repository automatically, and argued my manager out of one shared database server per tier: one compromised credential would have opened every workload.

Several development teams now self-serve their infrastructure, and the first internal AI workloads reached production through the full path.