Private enterprise AI architecture
Enterprise AI without a public backend.
Elyxir was developed inside Molarisoft as an enterprise service concept. Its architecture had to support AI Search, data access, Microsoft identity, and separate delivery environments without exposing backend data and AI resources publicly.
- Delivery
- Independent development and live paths
- Access
- Private service endpoints
- Authorization
- Managed identity / RBAC
System view
A public-safe view of the architecture.
- SourceGitHub application code
- DeliverySeparate DEV and LIVE workflows
- EdgeCloudflare WAF and rate limits
- AzureIsolated apps and private services
- IdentityEntra ID, Graph, and SharePoint
01
Start with boundaries, not an AI feature list.
Development and live environments used independent GitHub Actions workflows and isolated Azure application environments. Cloudflare guarded each public edge with WAF controls, geographic restrictions, and rate limiting.
Behind that edge, VNet-integrated applications reached AI, search, data, storage, and secrets through private endpoints and private DNS.
02
Use identity instead of embedded trust.
Managed identity and RBAC replaced embedded service credentials. Microsoft Graph connected the application to Entra ID and SharePoint while authorization remained tied to the identity model.
- No public access to backend data and AI resources
- Separate application and private-resource network segments
- Managed identity and RBAC for service authorization
- Entra ID, Microsoft Graph, and SharePoint integration
03
Make review part of the design process.
I worked directly with Microsoft's ISV + Digital Native CoE on AI Search, data architecture, private networking, identity, and token optimization. Microsoft engineers later performed an offline review of the updated network design.
During customer review, I presented the architecture and authorization model, narrowed permissions after feedback, and carried pilot access through approval and successful sign-in. This describes project context, not Microsoft certification or endorsement.
Secure enterprise AI depends less on hiding an application and more on making every delivery, network, identity, and data boundary explicit.