Owner: DevOps Lead — Abdul Moiz
Contributors: HoD (technical oversight) · CEO (major decisions)
Department: D5 — Infrastructure & Compliance
Entity: PrivateAI
Status: Recommended draft · Pending DevOps Lead (Moiz) review
Version: 0.1 | Last updated: 2026-07-18
Classification: Confidential
⚠️ This is a recommended draft prepared by the BA. Moiz must review
and correct all technical specifics before this is treated as operational.
What this workflow does: Governs the design principles, architecture standards,
access controls, change management rules, and environment structure that apply
across all PrivateAI infrastructure — internal tools (n8n, Wiki.js, databases),
client environments (per-client AWS), and the compliance posture that underpins
every engagement.
What triggers it: Always active — INF-01 is the governance layer that all
other infrastructure workflows (INF-01a, INF-01b, INF-02) operate within. Updated
when architecture decisions change, new compliance requirements emerge, or OPS-O02
ratifies new stack components.
What it produces: A maintained infrastructure architecture document, an access
control register, and a change management log — the single source of infrastructure
truth for PrivateAI.
Why it matters: Every AIe, AIc, and AI Project client engagement runs on
PrivateAI infrastructure. Undocumented, ungoverned infrastructure is a security
liability and a delivery risk — especially as the client base scales. INF-01 is
the foundation that makes infrastructure predictable, auditable, and recoverable.
| Role | Department | Responsibility | CEO? |
|---|---|---|---|
| DevOps Lead (Moiz) | D5 | Primary owner — designs, builds, maintains, and governs all PrivateAI infrastructure | No |
| HoD (Hamza) | D4 | Technical oversight — consulted on architecture decisions that affect delivery workflows | No |
| CEO | D6 | Consulted on major architecture decisions with commercial or compliance implications | Conditional |
| Legal Lead | D6 | Consulted on data sovereignty and compliance architecture requirements | No |
| Principle | What it means in practice |
|---|---|
| Isolation by client | Every client gets its own isolated environment — no shared compute or data between clients |
| Agent-ready by default | All infrastructure components must expose API/webhook/MCP access — no tool deployed that cannot be automated |
| Open-source preferred | Open-source tools preferred over proprietary where functionality is equivalent (per OPS-O02) |
| Least privilege access | Every team member and every agent has only the access they need — no broad permissions |
| Infrastructure as code | All environments provisioned through code — not manual console clicks — so they are reproducible |
| Compliance by design | Data sovereignty, encryption at rest and in transit, and audit logging built into every environment from day one |
| Environment | Purpose | Who has access |
|---|---|---|
| Production — Internal | n8n (hosted), Wiki.js, internal databases | Moiz + HoD |
| Production — Per-client | Isolated AWS environment per client engagement | Moiz + assigned AI Engineer only |
| Staging | Pre-production testing for all builds before client deployment | Moiz + AI Engineers |
| Development | Local or sandbox development environments | AI Engineers (individual) |
Step 1 — Architecture review (triggered by new requirement)
Step 2 — Architecture design
Step 3 — Access control management
Step 4 — Change management
Step 5 — Compliance posture maintenance
| Tool | How it's used | Agent-ready |
|---|---|---|
| AWS | Primary cloud provider — all production and client environments | Yes — confirmed |
| n8n (self-hosted) | Internal automation platform — hosted on AWS | Yes — native |
| Wiki.js (self-hosted) | Knowledge base — hosted at wiki.remap.ai on AWS | Yes — self-hosted |
| Jira | Change management log · infrastructure tasks | Yes — confirmed |
| Google Workspace | Architecture docs · access control register · compliance records | Yes — API + MCP |
| AWS IAM | Access control management | Yes — API |
| Monitoring tool | TBD — pending OPS-O02 | TBD |
| Secret management | TBD — pending OPS-O02 | TBD |
| CI/CD | TBD — pending OPS-O02 | TBD |
| Metric | Type | Target |
|---|---|---|
| Access provisioned within 24h of authorised request (%) | Process | 100% |
| Access revoked within 24h of departure (%) | Process | 100% — coordinated with HR |
| Production changes logged before execution (%) | Process | 100% |
| Zero unauthorised production changes | Lagging | 0 |
| All client environments isolated — no cross-client access | Leading | 100% |
Upstream:
Downstream:
| Version | Date | Description | Author |
|---|---|---|---|
| 0.1 | 2026-07-18 | Recommended draft — infrastructure principles, environment structure, access control, change management, compliance posture governance. Pending Moiz review and correction of all technical specifics. | BA (Hammad Akram) |
← Back to Infrastructure Hub · ← Back to Company Operating System