AI Governance · Cloud Architecture · Security / Amsterdam / New York
Technology leadership for what comes next. Cloud, security, and AI transformation, from first build to governed scale.
Two decades as a founder, CTO, CIO, and CISO, leading teams through the move to cloud, mobile, and now AI. I help leadership teams modernise their platforms, bring security under control, and adopt AI with clear lines of authority and evidence behind it.
Where I work with leadership and engineering teams.
AI governance and risk
Control frameworks, operating models, and audit evidence aligned to NIST AI RMF, ISO/IEC 42001, and US and EU regulatory expectations.
Agent and AI platform architecture
Agent identity and authority, policy-as-code, runtime guardrails, observability, and spend control.
Cloud architecture and platform strategy
Cloud and data platform architecture across AWS, Google Cloud, and Azure, including multi-cloud and sovereign cloud decisions, platform engineering and SRE maturity, and cost.
Security leadership
Security strategy and programmes for cloud-native and regulated businesses: zero-trust architecture, cloud security posture, threat modelling, AI security, and compliance readiness across GDPR, ISO 27001, and sector regulation.
Reviews and technology due diligence
Independent reviews of AI systems moving from pilot to production, and of cloud platforms and security programmes ahead of scale or audit. For investors and acquirers: pre-deal technology diligence across cloud cost and architecture, security posture, platform scalability, and AI readiness, with a findings report and a 100-day plan.
Board and executive advisory
AI strategy, cloud and cyber risk, risk appetite, and investment, for boards and executive teams who need to make those decisions with a clear view of the technical risk.
How engagements run
Fractional or interim
A set commitment each month in a technology leadership role, leading AI, cloud, or security transformation alongside your existing teams, or building the function where none exists yet.
Contract
A defined piece of work, such as an architecture review, a security assessment, or a control framework, with a written deliverable and a clear end point.
Advisory and board
Standing advisory or board roles for organisations making ongoing decisions on AI strategy, risk, and investment.
Speaking
Talks and executive briefings on AI governance, cloud and AI security, and where regulation meets the runtime.
I work inside your existing teams rather than beside them: in your design documents and repositories, with written findings, decision records your engineers own, and a handover that leaves your team running what we built without me.
Published case studies from previous engagements.
- Banking Innovation at Speed: Xapo Bank’s GenAI Adoption, with Governance Built In AI & governance
- Public sector An API Governance Framework for SkillsFuture Singapore's API Platform Governance & security
- Simulation Immersive Simulation on Google Cloud: Orbx Cloud platform
- Communications Migrating a Live Real-Time Communications Platform from AWS to Google Cloud Cloud migration
- Sport Starting the San Francisco Giants' Move to Google Cloud Data platform
- Mining Bringing Underground Camera Feeds to the Browser for APC Global Systems Industrial
References and further engagement detail are available on request, under NDA where needed.
All case studies at Sakura Sky →Two decades leading people and technology through cloud, mobile, and AI.
I have led engineering, product, and security teams through three shifts in the market: the move to cloud, the move to mobile, and now AI. Each one changed what customers expected and what teams had to learn. The leadership work stayed much the same: building teams that could adopt the new platform quickly, keep control of what they already ran, and deliver something the business could stand behind.
That has meant founder, CTO, CIO, and CISO roles across four continents, in regulated wealthtech in Singapore, blockchain asset succession, industrial systems on mine sites, and global media and travel platforms, and now a board seat at Distinct Star. The sectors differed. The recurring work was deciding what a system may do, being able to show afterwards that it did only that, and growing the people who carry that responsibility after I leave.
I co-founded Sakura Sky, a cloud, data, and AI consultancy working across North America, EMEA, and APAC. I also sit on the board of Distinct Star, a permanent-capital partnership backing cloud, data, security, and AI services firms while their founders stay in the business.
Board Member · Distinct Star
A permanent-capital partnership I helped establish, acquiring and backing high-quality cloud, data, security, and AI services firms while founders stay in the business. Long-term strategy, diligence on prospective member companies, and operating perspective at board level.
Co-Founder · Sakura Sky
Cloud, data, and AI consultancy working across North America, EMEA, and APAC. Enterprise AI and platform programmes, hyperscaler partnerships, and repeatable delivery.
Chief Technology Officer · Orbx
Modernised commerce and platform systems across simulation, ecommerce, and digital content. Cloud-native architecture, DevOps and SRE maturity, and the foundations for AI-first systems.
Co-Founder / CISO · HereToday
Blockchain venture for digital legacy and asset succession. Zero-trust architecture, ML-assisted threat modelling, and compliance readiness across GDPR, CCPA, ISO 27001, and emerging digital asset regulation.
Head of Data Security · Canopy
Built cloud security and data governance controls for a regulated wealthtech platform in Singapore. Reported to executive and board stakeholders on risk, resilience, and security strategy.
Co-Founder · Jiku.io
Cross-platform content and commerce for publishers and retailers, including Channel Nine and Pacific Magazines. Product direction, customer delivery, and early-stage growth.
Chief Information Officer · APC Global Systems
Digital transformation across global mining operations: telemetry, edge computing, early ML and computer vision, and IT/OT integration into executive dashboards.
Chief Mobile Officer · HotelsCombined
Owned the mobile roadmap, product, and growth across iOS and Android for a global hotel comparison platform, during its expansion across APAC.
CTO / Head of Product · CarAdvice
Product and technology strategy for one of Australia’s largest automotive media properties, aligning editorial, commercial, and engineering behind a single roadmap.
Every platform shift raises the same four questions.
What is each system allowed to do?
Under whose authority?
What did it touch?
How do you stop it?
I have asked these questions of cloud platforms, security programmes, and mobile products for two decades. Most organisations can answer them for their core systems, even if the evidence takes some finding.
AI agents make them harder, because the system is now taking actions on its own, and most teams I speak with cannot yet answer them with evidence. That gap, more than model capability, is what holds enterprise AI back, and closing it has been the centre of my recent work.
I publish the frameworks openly, with the code.
Everything below is published as a specification plus the code that implements it, under an open licence, with versioned releases, conformance checks, and the scope limits written down. Where a control is only partly automatable, the documentation says so. I would rather people run these and find the holes than agree with me in principle. These are early projects with a single maintainer, published as reference designs rather than adopted standards, and Tollgate is not yet production-ready.
Governed Agent Trust Environment
Twenty controls across four layers for governing agent runtimes: identity and integrity, runtime enforcement, observability and forensics, and orchestration. Ships JSON Schema contracts, OPA/Rego policy and invariant bundles, Python and Rust reference libraries, a conformance runner, and operational runbooks. Informative mappings to NIST AI RMF, ISO/IEC 42001, OWASP AISVS, MITRE ATLAS, and NIST SSDF. Ten repositories. Not a product and not a hosted service.
AI gateway and spend-control proxy
Prices every LLM request by token, reserves the budget before the call, and returns a hard 402 before the request reaches the provider. Per-key and global limits, tokens-to-cost accounting, an append-only Postgres ledger, hot counters in Valkey, a read-only console, and Terraform for Cloud Run. Anthropic and Vertex adapters. Pre-1.0 and openly labelled as such.
An ontology language for AI systems
A version-controlled language for declaring what exists in a domain, how it connects, and what may be done to it, by whom, with what trace. One file in a git repo is the authoritative artifact; compilers emit thin projections for the systems that need them. The specification is a contract, never a runtime. What it refuses to do is part of the design.
Policy engine for LLM-generated SQL
Deterministic policy evaluation for SQL produced by a model, multi-dialect via sqlglot. Answers a narrow question well: whether a generated statement is permitted to run, decided the same way every time, before it reaches the warehouse.
Papers and playbooks.
The CTO Playbook for Agentic Systems
A leadership, architecture, and organisational blueprint for AI-native companies: the roles, decision rights, and control architecture that make agent autonomy accountable.
The Governed Agent Trust Environment (GATE)
The framework paper behind GATE: a reference architecture of controls for governing AI agents, closing the gap between agent capability and operational accountability.
The Trustworthy Agentic AI Blueprint
Design principles, missing primitives, and the human-in-the-loop patterns required to deploy autonomous agents responsibly inside the enterprise.
The Executive AI Playbook
Strategy, governance, and execution: a working guide for leadership teams operationalising AI across regulated and high-growth businesses.
The Autonomous Horizon
A strategic white paper for the executive team: the operating model, the architecture, and the leadership decisions that will define the next decade.
Signal-to-Noise
A practical checklist for evaluating AI security tools, built around the four-stage funnel from finding to actionable vulnerability.
Also forthcoming: Still Dangerous: A Practitioner's Guide to Strength, Composure, and Capability for Executives Over Forty, a book on martial arts.
Long-form on AI governance, cloud & security.
- May, 2026 The Regulatory Stack, Parts 1-6: Where AI regulation meets the runtime, and what boards and engineers have to build to close the gap. Series
- October, 2025 The Missing Primitives for Trustworthy AI Agents, Parts 0-17 Series
- Apr 23, 2026 GATE: The Missing Infrastructure Layer for Agentic AI Essay
- April, 2026 The Mythos Ledger, Parts 1-5: The Firefox Watershed and the New Baseline of Vulnerability Series
- April, 2026 The Autonomous Horizon, Parts 1-6: Beyond Digital Transformation Series
- Dec 01, 2025 Engineering the Trustworthy Autonomous Enterprise Essay
- Aug 20, 2025 Your Most Powerful User Is Your Growing Security Blind Spot Essay
- Jan 27, 2025 GCP Cost Reviews: A Framework To Work With Your FinOps Tooling Essay
- Nov 28, 2024 EU AI Act: Implications for Data and Cloud in Banking, Ecommerce, and Gaming Essay
- Dec 11, 2024 Reflections on the 2024 DORA Report Essay
- May 02, 2023 Embracing Zero Trust for Container Security Essay
From first build to governed scale.
Open to technology leadership and transformation roles, fractional or interim, advisory and board roles, and technology due diligence.
Whether you are starting from a blank page or bringing an existing platform under control, a short note on where you are and where you want to get to is enough to start the conversation. Based in Amsterdam and New York, working across EU and US time zones. Also open to speaking, investment conversations, and pro-bono work in human rights, privacy, and social action.