Forward Deployed Engineer, requirement 8 of 12
Hybrid enterprise integration
I connect AI services to your identity, applications and data, then run them where your policy allows.
The requirementIntegrate AI solutions with enterprise applications, platforms and cloud or hybrid environments.
How I deliver it at a customer
- Decide placement firstI classify every data set and every model call, then pin each component to a named cluster. I deploy the same Helm charts to managed AKS or to AKS on Azure Local, with per-cluster values.
- Wire your identityI wire single sign-on with Authorization Code and PKCE, verify ID token signatures against the published JWKS, and allow only approved email domains. Users, groups and memberships sync from Google Workspace on a schedule, so access follows your directory.
- Point the model gatewayI route every model call through one gateway that holds the provider keys and issues scoped tokens. Each token names the applications allowed to use it, and the gateway applies rate limits and logs every call. Retrieval embeds on a local GPU by default, and I can turn the hosted embedding fallback off.
- Connect the applicationsI attach assistant sessions over stdio MCP through the tool bridge, so an assistant calls the platform tools directly. Your own services call api.onluca.ai/v1 with issued keys. Each key carries per-endpoint scopes and a limit of 120 requests per minute.
- Keep secrets in placeSecrets stay in your Key Vault and reach the pods through the Azure Key Vault CSI driver, using a user-assigned managed identity. Cloudflared dials out from the cluster, so web traffic needs no inbound port.
- Ship and reconcileArgoCD syncs the charts with prune and self-heal, so the running cluster matches the reviewed repository. KEDA scales the action workers on queue depth, and CloudNativePG runs the Postgres state. Grafana and Loki carry metrics and logs. A failed rollout rolls back, and a failed smoke check holds the release and pages me.
Tools I use
| Tool | What it does here | Status |
|---|---|---|
| Multi-provider model gateway | Routes every model call through one place that holds provider keys, issues scoped tokens, applies rate limits and logs each call. A workload moves between hosted and local models by configuration. | Available |
| Hybrid Kubernetes delivery | Deploys the same Helm charts to managed AKS and to clusters on Azure Local. ArgoCD reconciles them, KEDA scales the workers, and CloudNativePG runs the Postgres state. | Available |
| Assistant tool bridge | Gives an assistant session the platform tools over stdio MCP. Every call goes to one server-side endpoint that authorizes it before anything runs. | Early access |
| Luca MCP gateway | Serves the same tool surface to other MCP clients over OAuth. It sits behind a feature flag that ships off by default. | Early access |
| Cloudflare Workers AI | Serves this page's demo at the edge with Llama and bge models, and reports the edge location that handled the request. | Demo only |
Available means shipped and in use. Early access means built but not generally available. Roadmap means designed, not built. Demo only means it powers this public demo, not customer deployments.
Click a question and the demo answers it from this request's own metadata, naming the Cloudflare edge location that served you. It runs on Workers AI as a demo, and each answer says which parts of a real deployment would sit on your own hardware instead.
Open the live demoThe other answers
LLM applications in productionEvery model call goes through one gateway, guardrails run on both sides, and each task gets a measured model choice.Prompt engineeringI write the output shape first, version the prompt, budget its tokens, and compare model replies before shipping.Retrieval-augmented generationGrounded, cited answers over the customer's own documents, with access rules applied before retrieval.AI agents and orchestrationI build agents that call your systems as registered tools, and the workflows that trigger and sequence them.Request classification and routingI build automation that classifies each inbound request, routes it by role, and holds risky changes for human approval.AI workflow orchestrationI design the steps, contracts, and data flows, then ship them as running workflows on customer systems.API and integration designI publish the API contract first, gate it with keys and scopes, then build integrations against it.Prototype to productionI take a prototype through generated test suites and merge review gates to a zero-downtime deploy that rolls back on failure.Approvals and exception handlingI put a person between the agent and the change, with gated tools, a pending queue, expiry, and a record.Evals and output validationI score answers against a versioned rubric, trace failing calls to the integration that broke, and tune latency per call.Client-facing deliveryI turn engineering work into updates that client architects, security leads and business owners can each act on.
Gus IT LLC. Contact gus@gusit.de. Claude is a product of Anthropic PBC. Cloudflare and Workers AI are trademarks of Cloudflare, Inc. Llama is a trademark of Meta Platforms, Inc. Other names are trademarks of their respective owners. Gus IT LLC is an independent engineering firm and is not affiliated with or endorsed by these companies.