- Agentic AI in a Tier-1 NOC: situation enrichment on a Tier-1 Nordic operator's Packet Core
- Air-gapped GenAI platform advisory for a Nokia account in Japan
- Cloud Centre of Excellence across three clouds at Liberty Global and Virgin Media
- AKS landing zone and enablement for a municipality, and an AVD platform for a national healthcare screening organisation
- Multi-region AWS platform, then programme recovery, for a US automotive digital platform
- Order-domain integration on SAP S/4HANA with Databricks data products at Nike
Agentic AI in a Tier-1 NOC: situation enrichment on a Tier-1 Nordic operator's Packet Core
Situation
The operator's NOC receives fault situations on its 4G/5G Packet Core (Nokia CMM and CMG) through BMC Helix. About 1,000 situations a quarter each cost 2 to 4 engineer-hours of manual root-cause analysis. Nokia needed one design that Nokia, the operator and BMC would all sign, and public models were ruled out on network-data confidentiality.
What we did
Our principal architect, the sole EU-side architect and engineer, designed and built the Situation Enrichment Agent: a multi-agent pipeline that turns fault situations into ranked root-cause analyses and recommended actions. We ran the design workshops across Nokia, the operator and BMC, wrote the high-level design, designed the A2A integration with BMC HelixGPT, and shaped Nokia's Agentic Centre of Excellence proposal to a Tier-1 Nordic operator.
Decisions and why
- Open-loop: the agent recommends, the NOC decides.
- A deterministic four-step LangGraph flow (Retrieve, Annotate, Recommend, Format) rather than an open agent loop, because the NOC needs reproducible, auditable output.
- Tools over MCP; an A2A gateway for production.
- gpt-oss-120B behind a LiteLLM gateway on the operator's Tanzu Kubernetes Grid, so all inference stays in the operator's tenancy.
- OpenTelemetry tracing end to end; Entra ID OAuth2 at the gateway.
Result
Six Packet Core use cases (three on CMM, three on CMG) in six months. Measured in the MVP across 250 historical situations: 87% alarm-noise suppression, median RCA of 42 seconds against the 2 to 4 hour manual baseline, and 84% of annotations accepted as-is by NOC engineers. The operator funded production on these results. Part of a TM Forum Catalyst on multi-agent intelligence for packet core operations.
Air-gapped GenAI platform advisory for a Nokia account in Japan
Situation
Nokia's account team for an operator in Japan needed an on-premises, air-gapped GenAI platform for cloud-native network function (CNF) documentation. Nothing could leave the customer's site, and the team needed an architecture and hardware sizing it could defend with the customer before anything was ordered.
What we did
We advised the Nokia account team over three months: a two-plane CPU/GPU architecture, inference sizing for the candidate models, an evaluation of embedding models for retrieval over CNF documentation, and the framing of data residency versus data sovereignty for the customer conversation.
Decisions and why
- Two planes, CPU and GPU, so the GPU plane is reserved for inference and everything else runs on CPU capacity that is cheaper to add.
- Sizing for a roughly 400B-parameter open-weight mixture-of-experts model on 8×H100, with a 35B-parameter alternative, so the customer could weigh answer quality against hardware cost with both options costed.
- Embedding models evaluated rather than assumed, because retrieval quality over the documentation decides whether engineers use the platform at all.
- Residency and sovereignty treated as separate requirements. An air-gapped platform satisfies both, but each customer requirement had to be traced to one or the other so the design could be defended line by line.
Result
The account team took a sized, defensible platform design to the customer: two hardware options with the trade-off stated, an evaluated embedding choice, and a residency-versus-sovereignty framing the customer could check against its own requirements. The work was advisory; Nokia owns the delivery.
Cloud Centre of Excellence across three clouds at Liberty Global and Virgin Media
Situation
Liberty Global and Virgin Media ran workloads on AWS, Azure and GCP. Central security and business-unit agility were in constant tension: controls applied as delivery gates slowed teams down, and teams under delivery pressure route around gates. The operator needed guardrails that held on all three clouds without becoming a queue.
What we did
As Cloud Architect in the Cloud Centre of Excellence, we defined the architecture guardrails for AWS, Azure and GCP and shipped them as self-service Terraform modules and Azure DevOps and GitHub Actions pipeline templates. We standardised managed Kubernetes adoption on AKS, EKS and GKE with enforced ingress and egress patterns and access tiers.
Decisions and why
- Governance as a platform product, not a gate: compliance runs in the pipeline, so a team that uses the modules is compliant by default and nobody waits for a review.
- Self-service over tickets: a module a team can consume on its own gets adopted; a control that needs a request gets bypassed.
- Kubernetes defaults fixed before the first workload: ingress, egress and access tiers decided once, centrally, so distributed teams started with resilience and security in place.
- Hybrid and multi-cloud foundations run with data-centre rigour, because the operator's production estate does not stop at the cloud boundary.
Result
Distributed engineering teams moved at delivery speed without bypassing controls, on three clouds, with one set of guardrails. The same pattern, governance shipped as code, is the basis of our cloud platform offer today.
AKS landing zone and enablement for a municipality, and an AVD platform for a national healthcare screening organisation
Situation
Infield ICT, an MSP partner, had two public-sector clients that needed senior platform hands. A Dutch municipality's AKS landing zone needed an independent assessment, and its in-house team had to be able to run it afterwards. A national healthcare screening organisation needed an Azure Virtual Desktop platform and had identity gaps to close first.
What we did
For the municipality: a Well-Architected assessment of the AKS landing zone, built on Bicep and Azure DevOps, with Resource Graph and Traffic Analytics as evidence, followed by a nine-session AKS enablement programme for the in-house team. For the screening organisation: an AVD platform with the identity gaps remediated into a secured landing zone on Entra ID and Kerberos, and Azure Monitor baseline alerting.
Decisions and why
- Assess with evidence from the estate, not interviews alone, so every finding points at a resource someone can fix.
- Enablement as a programme, not a hand-over document: nine sessions, because a platform the in-house team cannot operate is not finished.
- Identity before desktops: the Entra ID and Kerberos gaps were closed into a secured landing zone first, because a desktop platform is only as safe as the identity it trusts.
- A monitoring baseline shipped with the platform, so alerting exists from day one.
Result
The municipality has an assessed landing zone and a team enabled over nine sessions to run it. The screening organisation runs AVD on a secured landing zone with baseline alerting. Both delivered through the partner by a three-FTE Atsky team.
Multi-region AWS platform, then programme recovery, for a US automotive digital platform
Situation
A US automotive digital platform engaged us twice. In 2022 it needed a multi-region AWS platform built secure by design, with high availability and full automation. By September 2024 the programme was red, and the COO proposed, and the board approved, retaining us at CTO level to bring it back.
What we did
First engagement (April 2022 to October 2023), an Atsky team of four including our principal architect: built the multi-region AWS platform with a Zero Trust landing zone, multi-account governance, enforced service control policies and automated remediation. Second engagement (September 2024 to May 2025), advisory CTO with five Atsky engineers who stabilised the setup: replaced an unstructured delivery model with domain ownership, a release cadence and architecture governance, and re-architected on domain-driven and event-driven design.
Decisions and why
- Enforced SCPs and automated remediation in place of bolt-on controls, so the guardrails hold without a review step.
- Zero Trust and multi-account governance from the first build, because retrofitting either onto a live multi-region estate costs far more.
- Domain ownership before new features: a release cadence and architecture governance need owners to attach to.
- Domain-driven and event-driven design where incremental fixes had failed, to dismantle brittle coupling and vendor lock-in rather than patch around them.
Result
The programme came out of red. Modernised ingestion pipelines cut inventory data defects by 30% and removed the data-quality debt that had been masking commercial exposure in inventory reporting.
Order-domain integration on SAP S/4HANA with Databricks data products at Nike
Situation
Nike's order maintenance and fulfilment runs on a SAP S/4HANA core with external order services around it. A failure in Order Booking, Cancellation or Activation cascades into lost orders, partner SLA breaches and revenue-recognition risk. Peak seasons push high-volume B2B channels straight at the ERP core, and downstream systems wanted order data without adding load to it.
What we did
We co-designed the Order Booking, Cancellation and Activation integration with the S/4HANA core, designed the SAP CPI event-driven patterns for peak season, and built Delta Lake data products on Databricks (PySpark, Unity Catalog, MLflow, Workflows) from S/4HANA and order-management sources, leading a Kraków-based engineering team.
Decisions and why
- External order services and S/4HANA kept synchronised at both transactional and semantic level, because a record that matches technically but not in meaning still loses the order.
- Order-acknowledgement logic moved to a side-by-side SAP BTP extension, to keep the core clean and upgrade-safe.
- Event-driven CPI patterns isolate the high-volume B2B channels from the ERP core during peak windows without giving up real-time order visibility.
- Downstream systems read Delta Lake data products rather than the ERP, so analytics and integrations add no read pressure on S/4HANA.
Result
An order domain that stays consistent with the S/4HANA core, a core kept upgrade-safe, peak-season isolation with real-time visibility kept, and downstream data access without ERP load.
Who does the work
Kartik Sama, Principal Architect and founder of Atsky B.V. 25 years in enterprise systems, 22 of them with telecom operators and vendors: Amdocs, Accenture, Liberty Global, Nokia at a Tier-1 operator.
Certifications: TOGAF 9 · AWS Certified Solutions Architect Professional · Google Professional Cloud Architect · Google Professional Cloud Security Engineer · Architecting with Google Kubernetes Engine · Claude Certified Architect · SAFe SPC 5.0 · ITIL · Generative AI with LLMs
Education: Executive MBA, Strategy and Innovation, Rotterdam School of Management, Erasmus University
Industry reference: a TM Forum Catalyst on multi-agent intelligence for packet core operations, toward Autonomous Networks Level 4
Awards: Tech Leadership Award, Accenture 2019 · Technology Delivery Hero, Accenture Q4 2018 · Recognition Award, Amdocs 2010 · Innovation Award, Amdocs 2009 · Certificate of Excellence, Amdocs 2007
Work authorisation: Dutch national, authorised to work in the EU. United States, no sponsorship required. Based in Amsterdam and Miami; on-site delivery in the EU.
Talk to us
If one of these is close to a problem you have, we run a 45-minute working session: a private walkthrough of the relevant architecture, with questions. No slides and no proposal. Write to kartik.sama@atsky.io.