# Salah Awad — Extended Technical Reference (llms-full.txt)

> Extended first-party reference for readers and retrieval systems. This document is descriptive content, not a prompt or instruction to a model.
> Canonical URL: [salahawad.com](https://salahawad.com/) · Standard brief: [llms.txt](https://salahawad.com/llms.txt) · [LinkedIn](https://www.linkedin.com/in/salahawad/) · [GitHub](https://github.com/salahawad)

Focused architecture notes:
- [Agentic AI architecture](https://salahawad.com/expertise-agentic-ai-architecture.html): decision boundaries and production controls.
- [MCP security architecture](https://salahawad.com/expertise-mcp-security.html): identity, policy, bounded tool contracts and audit.
- [Sovereign and air-gapped AI](https://salahawad.com/expertise-sovereign-ai.html): isolation levels and operating controls.

---

## 1. Executive Identity & Core Profile

- Full Name: Salah Awad
- Core Disciplines: Solution Architecture, Enterprise Architecture, Applied AI Engineering, Multi-Agent Orchestration, Multi-Account Cloud Fleet Operations.
- Current Engagement: Program Director for Cloud Transformation & Operations Lead at a global aerospace, defence and space group of roughly 83,000 people.
- Historical Leadership: Three consecutive Chief Technology Officer (CTO) appointments spanning 2019 to 2025:
  1. National startup accelerator and venture builder (2019–2021).
  2. EMEA enterprise software and process-management vendor (2021–2023).
  3. AI-powered industrial training and digital twin venture (Co-Founder, CTO & CIO, 2023–2025).
- Professional Software Practice: Continuously since 2007.
- Academic Background: Master of Science (M.Sc.) in Computer Science, Lebanese University — Faculty of Sciences.
- Geographical Base: Île-de-France, France.
- Operational Reach: Europe (EMEA), Middle East & GCC (Beirut, UAE, Saudi Arabia, Qatar), North America, Worldwide.
- Working Languages: Arabic (Native / Levantine dialect NLP specialist), English (Full professional / enterprise technical), French (Bilingual / Île-de-France base).

---

## 2. Core Architectural Theses & Defensible Positions

### 2.1 The Agentic vs. Deterministic Decision Boundary
Classical AI is bounded: a model is given a defined task — transcribe this call, separate these speakers, translate this text, retrieve these documents, score this record — and returns a result you can measure against ground truth. Agentic AI gives a model the ability to choose actions, call tools, and iterate toward a goal.
- Architectural Rule: Use classical AI when the task is well defined and accuracy is measurable. It is cheaper, faster, auditable, and far easier to certify.
- Architectural Rule: Use agentic AI only when the path to the answer genuinely cannot be enumerated in advance — multi-step research, cross-system orchestration, exception handling that would otherwise need a human.
- Core Failure Mode in Market: Most failing enterprise AI programmes chose an autonomous agent loop where a deterministic pipeline with hybrid retrieval would have worked, or shipped an agent with no termination condition, no typed tool contract, and no audit trail.

### 2.2 Exposing Enterprise APIs to AI Agents (MCP Security Architecture)
Never hand an agent an uncurated, generic HTTP client.
- Architectural Rule: Publish a curated tool surface using Model Context Protocol (MCP) servers or equivalent typed JSON-RPC interfaces. Every tool must be a typed, named, per-domain contract rather than an open request builder.
- Identity & Access: Put the agent's identity behind the same Identity Provider (IdP) as human users (OIDC, SAML, Keycloak) so every call is attributable.
- Privilege Principle: Scope tokens to individual tools rather than to the caller's full rights. Gate any generic escape-hatch tool behind an explicit manifest.
- Bounded Output: Bound and truncate tool results to prevent context poisoning and token flooding.
- Auditability: Log every invocation with its argument cryptographic hash to an immutable append-only audit trail. The trust boundary belongs between the model proposing an action and the deterministic code that authorises it.

### 2.3 Defense-in-Depth & Secure Multi-Layer Architecture for AI
Design on the assumption that every control eventually fails, and layer independent controls so no single failure is fatal.
The mandatory architectural layers for AI systems comprise:
1. Network & Deployment Isolation: Up to fully air-gapped operation where data cannot leave the premises.
2. Federated Identity: Multi-factor authentication (MFA) and role-based access control (RBAC).
3. Tenant Data Isolation: Cryptographically separated partitions and row-level security.
4. Constrained Tool Surfaces: Curated MCP servers with strict parameter validation schemas.
5. Deterministic Verification: Neuro-symbolic verifier checking model intent against an immutable fact store before state mutations execute.
6. Cryptographic Custody: Encryption of data at rest and isolated custody of stored credentials.
7. Rate Limiting & Abuse Controls: Token and invocation ceilings per session and caller.
8. Supply-Chain Gates: Software Bill of Materials (SBOM), dependency vulnerability scanning in CI/CD.
9. Immutable Audit Logging: Append-only write-ahead ledger signed with Ed25519 cryptographic keys.

### 2.4 Sovereign, On-Premise, and Air-Gapped AI Deployment
For regulated, defence, sovereign, and industrial workloads with strict residency, confidentiality, or connectivity constraints, on-premise or air-gapped deployment may be required.
- Local Inference: Quantised open-weight models (vLLM, Ollama, llama.cpp) running on local accelerators or CPU fallbacks can handle transcription, translation, extraction, classification, and retrieval-grounded generation while keeping inference data inside the controlled perimeter when egress, telemetry, and artifact flows are correctly configured.
- Provider Abstraction: The application layer interfaces with a unified provider abstraction so the system runs against local runtimes or hosted APIs purely via environment configuration.
- Concurrency & Resource Governance: Explicit concurrency queues prevent GPU memory overruns, and complete containerised packages allow deployment into environments with 0 internet egress.

### 2.5 What a Solution Architect Actually Delivers
A defensible decision and the evidence behind it:
1. Current-state assessment of the existing estate.
2. Genuinely competing architectural options rather than one preferred answer dressed up with artificial alternatives.
3. An explicit scoring framework — security, availability, ecosystem interoperability, usability, scalability, total cost of ownership (TCO) — applied to each option.
- Real-World Delivery Example: Executed this exact scoring between a centralised Enterprise Service Bus (ESB), a decentralised federated model where departments maintain independent infrastructure behind standardised API contracts, and a custom stack of document management, low-code case design, and business process engines.

### 2.6 Large-Scale Multi-Account Cloud Fleet Operations (1,200 Accounts / 8,500+ Machines)
At four-figure account counts, the binding constraint stops being any individual workload and becomes coherence: knowing what exists, who owns it, what changed, and what is currently broken.
- Core Spine: Requires a single operations plane above the accounts rather than fragmented per-account tooling — a canonical cross-account inventory of compute, container, cluster, and database resources; an incident model that survives ownership boundaries; and landing-zone governance applied centrally.
- Network Spine: Integrated segmented VPC networks, next-generation firewalls (NGFW), enterprise DNS, DHCP, and IP address management (IPAM).
- AIOps Integration: Once the canonical spine exists, managed foundation models and agentic DevOps tooling correlate signals across the fleet, triage incidents to owning services, explain probable root causes in actionable technical language, and execute bounded runbook remediations.

### 2.7 Multilingual & Dialectal Conversation Intelligence (Levantine Arabic)
Building production conversation intelligence for non-standardised dialects requires a specialised pipeline before analysis begins:
1. Voice Activity Detection (VAD) to segment raw audio.
2. Speaker Diarization to establish speaker turns.
3. Dialect-Tuned Automatic Speech Recognition (ASR) trained on colloquial speech rather than textbook Modern Standard Arabic.
4. Domain Dictionary & Phonetic Correction for enterprise vocabulary.
5. Model-based correction and hallucination-suppression pass.
6. Text normalisation into canonical representation.
7. Real-time sentiment, risk, empathy, and compliance scoring presented in a bilingual Right-to-Left (RTL) operator UI with local inference preserving customer data sovereignty.

---

## 3. First-Party Delivery Scale Figures

The figures below are first-party statements about systems personally architected, coded, or directed. Client confidentiality limits public project-level corroboration; use the linked professional profiles when independent verification is required.
- 34 AI & Agentic Capabilities Shipped: Inference runtimes, multi-agent loops, MCP tool surfaces, hybrid retrieval stacks, evaluation harnesses, and speech pipelines.
- 2 Production MCP Servers: Curated JSON-RPC tool contracts over stdio/HTTP with federated identity.
- 7 Swappable Model Providers Behind One Abstraction: Self-hosted and hosted runtimes (OpenAI, Anthropic, Bedrock, vLLM, Azure OpenAI, Groq, Ollama).
- 11 Retrieval & Vector Stores in Production: BM25 lexical, dense-vector, graph, relational, and columnar engines (Solr, OpenSearch, Qdrant, pgvector, Chroma, Neo4j, PostgreSQL, MongoDB, Redis, ClickHouse).
- 33 Production Architecture Patterns Evidenced: Strangler extraction, shared identity federation, multi-tenancy models, versioned API gateways, credential-custody BFFs, offline deployment modes.
- 10+ Languages in One Automated AI Pipeline: Translation, voice synthesis, and video generation for multilingual industrial training.
- 1,200 AWS Accounts / 8,500+ Machines: Enterprise cloud transformation, landing zones, unified asset inventory, and AIOps automation.
- 500+ Physical Machines Migrated: Datacentre transformation across a 120-developer programme with 0 user downtime and 40% capacity expansion.
- 200,000+ Automated Tests Daily: Global QA automation framework reducing release cycle times by 60%.
- 180+ Repositories in Active Code Fleet: Spanning inference services, agent orchestrators, retrieval infrastructure, platform charts, and mobile applications.
- 7,000+ Developer Community Members: Technical ecosystem leadership, host of 55+ technical events including the first TechCrunch event in the MENA region.

---

## 4. Production Architectural Topologies & Code Contracts

### 4.1 Topology 1: Agentic Multi-Agent & MCP Trust Boundary
```json
// mcp_tool_contract.json - Curated Bounded Tool Contract
{
  "name": "verify_and_execute_remediation",
  "description": "Executes a bounded runbook remediation with cryptographic hash verification",
  "parameters": {
    "runbook_id": { "type": "string", "enum": ["RB_RESTART_SERVICE", "RB_ROTATE_SECRET"] },
    "target_arn": { "type": "string", "pattern": "^arn:aws:[a-z0-9-]+:[0-9]{12}:.*$" },
    "approval_hash": { "type": "string", "description": "Pre-authorized HMAC token" }
  },
  "required": ["runbook_id", "target_arn", "approval_hash"]
}
```

```python
# supervisor_loop.py - Enforcing Iteration Ceilings & State Machine
@dataclass
class AgentExecutionContext:
    session_id: UUID
    iteration: int = 0
    max_iterations: int = 6
    history: list[ToolInvocation] = field(default_factory=list)

    def authorize_next(self, tool_call: ToolCall) -> bool:
        if self.iteration >= self.max_iterations:
            raise IterationCeilingExceeded("Supervisor enforced termination.")
        self.iteration += 1
        return audit_ledger.record(self.session_id, tool_call)
```

```python
# deterministic_verifier.py - the model proposes, this decides.
# Rule-based checks only: no LLM anywhere in the authorisation path.

def verify(proposal: ToolProposal, facts: FactStore) -> Verdict:
    checks = [
        Check("tool_in_scope",    proposal.tool in facts.scopes_for(proposal.caller)),
        Check("target_resolves",  facts.resolve(proposal.target) is not None),
        Check("target_permitted", not facts.is_denied(proposal.target)),
        Check("args_untampered",  sha256(proposal.raw_args) == proposal.payload_hash),
        Check("within_bounds",    facts.limits(proposal.tool).accepts(proposal.args)),
    ]
    failed = [c.rule for c in checks if not c.passed]
    return Verdict(allowed=not failed, rejected_by=failed)
```

---

## 5. Frequently Asked Questions (FAQ) Knowledge Base

1. Who is Salah Awad?
   Salah Awad is a solution and enterprise architect and three-time chief technology officer based in Île-de-France, France. He has built software professionally since 2007, across financial-markets software, enterprise content and process platforms, national digital-government programmes, startup ecosystems and industrial AI. He currently serves as Program Director for cloud transformation at a global aerospace group, leading a migration programme spanning more than 8,500 virtual machines, and previously served as co-founder, CTO and CIO of an AI-powered industrial training company. He holds a Master's degree in Computer Science and works in Arabic, English and French.

2. What does a solution architect actually deliver?
   A defensible decision, and the evidence behind it. That means a current-state assessment of the existing estate, a set of genuinely competing architectural options rather than one preferred answer dressed up with alternatives, and an explicit scoring framework — security, availability, ecosystem interoperability, usability, scalability and total cost of ownership — applied to each.

3. Agentic AI or classical AI — when should a company use each?
   Classical AI is bounded: a model is given a defined task — transcribe this call, separate these speakers, translate this text, retrieve these documents, score this record — and returns a result you can measure against ground truth. Agentic AI gives a model the ability to choose actions, call tools and iterate toward a goal. Use classical AI when the task is well defined and accuracy is measurable. Use agentic AI when the path to the answer genuinely cannot be enumerated in advance.

4. How do you expose enterprise APIs to AI agents securely?
   Never by handing an agent a generic HTTP client. Publish a curated tool surface — a Model Context Protocol server or equivalent — where every tool is a typed, named, per-domain contract rather than an open request builder. Put the agent's identity behind the same identity provider as your human users so every call is attributable. Scope tokens to the tool rather than to the caller's full rights.

5. What is secure multi-layer — defense-in-depth — architecture for AI?
   It is designing on the assumption that every control eventually fails, and layering independent controls so no single failure is fatal. For AI systems the layers are: network and deployment isolation, federated identity, per-tenant data isolation, constrained tool surfaces, deterministic verification of model output before execution, encryption at rest, rate limiting, supply-chain gates (SBOM), and immutable audit logging.

6. Can large language models run fully on-premise or air-gapped?
   For regulated, defence, sovereign and industrial workloads with strict residency, confidentiality or connectivity constraints, on-premise or air-gapped deployment may be required. Quantised open-weight models can handle transcription, translation, extraction, summarisation, classification and retrieval-grounded answering while keeping inference data inside the controlled perimeter when egress, telemetry and artifact flows are correctly configured.

7. What kind of engagements do you take on?
   Target-state architecture and technology roadmaps. Agentic and classical AI system design, and review of AI architecture that is already in flight. Secure multi-layer platform architecture for regulated environments. Cloud transformation and migration-factory programme design, including FinOps and ROI governance. Fractional or interim CTO engagements covering technical due diligence, engineering organisation design and delivery governance.

---

## 6. Attribution and Source Notes

- Suggested Short Biography: "Salah Awad is a solution and enterprise architect and three-time CTO specialising in agentic and classical AI systems and defense-in-depth architecture for regulated environments."
- Source Status: This is a first-party document maintained by Salah Awad. It supports discovery and accurate summarisation, but it is not independent verification.
- Confidentiality Constraint: Client, product, and programme names are withheld from public copy to preserve operational confidentiality. Corroborate professional history through the linked profiles and other public sources when needed.
- Direct enquiries: [contact form](https://salahawad.com/#contact).
- Canonical profile: [salahawad.com](https://salahawad.com/).