# Andrew Stevens

> Advisor on AI governance, cloud architecture, and security, open to technology leadership and transformation roles (fractional or interim), contract work, and advisory and board roles. Two decades as a founder, CTO, CIO, and CISO, leading teams through the move to cloud, mobile, and now AI. Helps organisations design systems they can govern, and in AI that means agent architectures where it is clear what each agent is allowed to do, under whose authority, what it touched, and how to stop it mid-task. Author of GATE, an open control framework for AI agents. Based in Amsterdam, Netherlands and New York, USA, working across EU and US time zones.

Andrew Stevens works with leadership and engineering teams on AI governance, cloud architecture, and security. Most teams can get an agent working quickly; far fewer can answer, with evidence, what the agent may do, under whose authority, what it touched, and how to stop it. Since 2025 closing that gap has been the centre of his work. He co-founded Sakura Sky, a cloud, data, and AI consultancy, and sits on the board of Distinct Star. Before that, two decades in founder, CTO, CIO, and CISO roles across four continents.

## Services

- AI governance and risk: control frameworks, operating models, and audit evidence aligned to NIST AI RMF, ISO/IEC 42001, and US and EU regulatory expectations.
- Agent and AI platform architecture: agent identity and authority, policy-as-code, runtime guardrails, observability, and spend control.
- Cloud architecture and platform strategy: cloud and data platform architecture across AWS, Google Cloud, and Azure, including multi-cloud and sovereign cloud decisions, platform engineering and SRE maturity, and cost.
- Security leadership: security strategy and programmes for cloud-native and regulated businesses, covering zero-trust architecture, cloud security posture, threat modelling, AI security, and compliance readiness across GDPR, ISO 27001, and sector regulation.
- Reviews and technology due diligence: independent reviews of AI systems moving from pilot to production, and of cloud platforms and security programmes ahead of scale or audit. For investors and acquirers, pre-deal technology diligence across cloud cost and architecture, security posture, platform scalability, and AI readiness, with a findings report and a 100-day plan.
- Board and executive advisory on AI strategy, cloud and cyber risk, risk appetite, and investment.
- Engagement formats: fractional or interim technology leadership, contract (fixed scope), advisory and board roles, speaking.

- Engagements are independent of Sakura Sky and Distinct Star. Any relationship is disclosed before work starts, and no follow-on work is referred without the client's consent.

## Selected Work

Published case studies from engagements Andrew Stevens led or oversaw at Sakura Sky. References and further detail are available on request, under NDA where needed.

- [Xapo Bank: GenAI adoption with governance built in](https://www.sakurasky.com/case-studies/innovation-at-speed-how-xapo-bank-achieved-genai-adoption-in-just-8-weeks/) (banking, AI and governance)
- [API governance framework for SkillsFuture Singapore](https://www.sakurasky.com/case-studies/ssg-api-governance/) (public sector, governance and security)
- [Orbx: immersive simulation on Google Cloud](https://www.sakurasky.com/case-studies/orbx-gke-bigtable/) (simulation, cloud platform)
- [Migrating a live real-time communications platform from AWS to Google Cloud](https://www.sakurasky.com/case-studies/11sight-gcp-migration/) (communications, cloud migration)
- [Starting the San Francisco Giants' move to Google Cloud](https://www.sakurasky.com/case-studies/sf-giants-sports-data-platform/) (sport, data platform)
- [Underground camera feeds in the browser for APC Global Systems](https://www.sakurasky.com/case-studies/apc-global-ip-cameras/) (mining, industrial)
- [All case studies](https://www.sakurasky.com/case-studies/)

## Open Source

Specifications published together with the code that implements them, under open licences, with versioned releases and documented scope limits. These are early projects with a single maintainer, published as reference designs rather than adopted standards; Tollgate is not yet production-ready.

- [GATE - Governed Agent Trust Environment](https://github.com/deterministic-agents) (v1.4, MIT / CC BY 4.0): Twenty controls across four layers for governing agent runtimes - identity and integrity, runtime enforcement, observability and forensics, and orchestration. Ships JSON Schema contracts, OPA/Rego policy and invariant bundles, Python and Rust reference libraries, a conformance runner, and operational runbooks. Informative mappings to NIST AI RMF, ISO/IEC 42001, OWASP AISVS, MITRE ATLAS, and NIST SSDF. Ten repositories. Not a product and not a hosted service.
- [Tollgate](https://github.com/sakura-sky/tollgate) (Rust, MIT): Open-source AI gateway and spend-control proxy for LLM providers. Prices each request by token, reserves budget before the call, and returns a hard 402 before the request reaches the provider. Append-only Postgres ledger, hot counters in Valkey, read-only console, Terraform for Cloud Run. Anthropic and Vertex adapters. Pre-1.0.
- [Arkhe](https://github.com/arkhelang/arkhelang) (Apache-2.0): An ontology language for AI systems. A version-controlled language for declaring what exists in a domain, how it connects, and what may be done to it, by whom, with what trace. The specification is a contract, never a runtime.
- [sql-guard](https://github.com/sakura-sky/sql-guard) (Python): Deterministic policy engine for LLM-generated SQL, multi-dialect via sqlglot.

## Publications

- [The CTO Playbook for Agentic Systems](https://whitepaper.download/ctoplaybook/): Leadership, architecture, and organisational blueprint for AI-native companies: decision rights for agents, the agentic SDLC, and the control architecture that makes autonomy accountable (v1.2, September 2026).
- [The Governed Agent Trust Environment (GATE)](https://deterministicagents.ai/downloads.html): The framework paper behind GATE.
- [The Trustworthy Agentic AI Blueprint](https://whitepaper.download/trustworthyagenticai/): Design principles, missing primitives, and human-in-the-loop patterns for deploying autonomous agents responsibly inside the enterprise.
- [The Executive AI Playbook](https://whitepaper.download/aiplaybook/): Strategy, governance, and execution guide for leadership teams operationalising AI.
- [The Autonomous Horizon](https://www.sakurasky.com/white-papers/autonomous-horizon/): Strategic white paper on the operating model, architecture, and leadership decisions for the autonomous enterprise (2026).
- [Signal-to-Noise](https://sakurasky.com/white-papers/signal-to-noise-checklist/): Practical checklist for evaluating AI security tools.

## Writing

- [All essays at Sakura Sky](https://www.sakurasky.com/author/andrew-stevens/)
- [The Regulatory Stack, Parts 1-6](https://www.sakurasky.com/tags/series-regulatory-stack/): Where AI regulation meets the runtime, and what boards and engineers have to build to close the gap (May 2026).
- [The Missing Primitives for Trustworthy AI Agents](https://www.sakurasky.com/tags/series-missing-primitives/): Long-form series on the primitives required for trustworthy agentic AI (from October 2025).
- [GATE: The Missing Infrastructure Layer for Agentic AI](https://www.sakurasky.com/blog/gate-launch/) (April 2026).
- [The Mythos Ledger, Parts 1-5](https://www.sakurasky.com/tags/series-mythos-ledger/) (April 2026).
- [The Autonomous Horizon, Parts 1-6](https://www.sakurasky.com/tags/series-autonomous-horizon/) (April 2026).
- [Engineering the Trustworthy Autonomous Enterprise](https://www.sakurasky.com/blog/engineering-the-trustworthy-autonomous-enterprise/) (December 2025).
- [Your Most Powerful User Is Your Growing Security Blind Spot](https://www.sakurasky.com/blog/your-most-powerful-user-is-your-growing-security-blind-spot/) (August 2025).
- [GCP Cost Reviews: A Framework To Work With Your FinOps Tooling](https://www.sakurasky.com/blog/gcp-finops-framework/) (January 2025).
- [Embracing Zero Trust for Container Security](https://www.sakurasky.com/blog/embracing-zero-trust-container-security/) (May 2023).
- [EU AI Act: Implications for Data and Cloud](https://www.sakurasky.com/blog/eu-ai-act/) (November 2024).

## Contact

- Email: andrew@andrewjstevens.com
- LinkedIn: https://www.linkedin.com/in/andrewjstevens
- Mastodon: https://mastodon.online/@andrewjstevens
- Open to: technology leadership and transformation roles (fractional or interim), advisory and board roles, and technology due diligence. Also speaking, investment conversations, and pro-bono work in human rights, privacy, and social action.

## Optional

- [Full long-form profile](https://www.andrewjstevens.com/llms-full.txt): Expanded profile, services, frameworks, and role history.
- [Sitemap](https://www.andrewjstevens.com/sitemap.xml)