Bringing a hybrid port estate under one control plane

A port operator runs two kinds of infrastructure that have historically pretended to be unrelated. On the cloud side, manifests, load balancers, and a handful of data services live in AWS and Azure accounts managed by a small cloud team. On the ground, container cranes and gate systems talk to a set of on-premises racks that the same team is responsible for, but that nobody had ever fully enumerated. The gap between the two halves was the real asset being operated.

The problem: drift you only noticed twice a year

The pain surfaced the way it usually does: during a review meeting, someone pointed at a diagram and asked whether it was still accurate, and nobody could answer with confidence. Change tickets said one thing, the cloud consoles showed another, and the on-prem racks were described from memory.

The team ran drift checks twice a year. In between, resources were added for peak-season scale-up, patched, and occasionally orphaned. Nobody noticed until the next audit, at which point 'reconstructing what happened' replaced 'defining what was allowed'.

The cost wasn't the drift itself. It was that every review became an archaeology project instead of a control check.

The approach: inventory first, policy second, approvals third

We started with the control plane's weakest requirement and the one that gives the most leverage: a single live inventory. Cloud accounts connected through the hosted SDK adapters. The on-prem racks were brought in through outbound-only agent pools, which meant no inbound ports, no VPN change, and no exceptions carved in the terminal firewall rules.

Once both halves described themselves against the same tenant-scoped graph, the next steps became mechanical rather than heroic.

cloud accounts (AWS/Azure) ──▶ hosted SDK adapterson-prem racks (crane, gate) ──▶ outbound agent pools                               │             one tenant-scoped inventory graph ◀──┘                               │   policy evaluation → drift checks → approval gates                               │                     audit trail (signed envelopes)

Implementation steps

• Connected two cloud accounts and ran discovery; reconciled results against existing tickets within a week.
• Deployed outbound agents to three terminal racks; each reports inventory, topology, and signals on a 60-second cadence.
• Defined a drift policy that flags any resource missing from the declared inventory or changed outside an approved run.
• Wired drift findings into the weekly on-call review instead of a twice-yearly manual pass.
• Turned on the approval gate for any change touching the crane/control network, with policy evaluated server-side before apply.

Guardrails: the AI boundary stays boring

The assistant was useful here for investigation: given a drift alert, it read the inventory and the recent change history and proposed a shortlist of likely causes. It never proposed an action on the crane network. Those changes stayed behind policy, approvals, and the audit trail, and deliberately so.

For a site where a bad change touches physical machinery, the rule was simple: the assistant plans, a human approves, the platform executes, and the audit trail records all three. We did not ask for autonomous remediation, and we did not offer it.

Lessons learned

The on-prem agent rollout mattered more than the cloud connectors. The cloud side already had consoles; the racks had nothing. Bringing the ground truth of the physical estate into the same graph is what made the weekly drift review credible, because it checked what was actually running rather than what was documented.

The second lesson was about cadence. A weekly review works when the signal is cheap to read and the review has a clear owner. The policy produced a short list every Monday; the on-call engineer read it in minutes and escalated only what needed action. That turned 'drift review' from a project into a habit.

Finally: do not attach an AI that executes to your most sensitive network on the first pass. Introduce the assistant for investigation, build the approval loop, and let trust grow from the audit trail, not from a demo.