TRI NGUYEN

Field Notes

What I've built in the field.

Two kinds of work live here. One is the agentic tooling I built and run for myself. The other is patterns I've designed for enterprise customers, anonymized on purpose. No client names, no deal numbers, no logos. What's left is the part that carries between projects: the architecture and the governance around it. Every entry keeps the same shape so they're easy to compare: context, problem, system built, technical pattern, governance, and outcome.

01
Self-built

AgentOS: multi-agent task decomposition

Agentic orchestration · Multi-agent orchestration, human-gated

Context

I hand an agent ambiguous goals all day. Build this, research that, fix the site. A single chat thread is the wrong container for that work: it doesn't survive a restart, and nothing in it stops an agent before it does something I can't undo.

Problem

I wanted those goals to become work I could actually see and trust. Broken into pieces, each piece assigned to the right agent, tracked somewhere durable, and halted at the exact points where a wrong move costs money or fires off a message I can't recall.

System built

I built an orchestrator that breaks a goal into worker-sized tasks, routes each one to a specialist agent, and tracks state on a shared board. Workers hand off written context to each other, so the next agent picks up where the last one left off.

Technical pattern

Orchestrator and workers, with a dependency graph so a task waits for its parents before it runs. The gate is the part I care about: any irreversible side-effect, whether a payment, an outbound message, or a deploy, stops and waits for me to approve it. Research, drafting, and analysis run unattended up to that line.

Governance

The approval gate is wired into the orchestrator itself, so a model can't talk its way past it. Every run leaves behind an artifact and a written summary on the board, so I can read back exactly what each agent did and why.

Outcome

A vague goal becomes tracked work that survives a restart and stops for me at the parts that bite. This page was decomposed and drafted that way.

Multi-agent orchestrationTask dependency graphTool-calling LLM workersHuman-approval gatesShared task board
02
Self-built

Agentic pre-meeting briefings

Knowledge & context · Multi-source retrieval and synthesis

Context

Back-to-back meetings, and the context I need for each one is scattered across the systems I'm allowed to read.

Problem

Prepping by hand is slow and uneven. Some briefs are thorough, others are whatever I could scrape together in the five minutes before the call.

System built

An agent that assembles a structured brief from the sources I've granted it access to, in the same shape every time, ahead of each meeting.

Technical pattern

Retrieve from several permissioned sources, synthesize, return a structured brief. Each source keeps its own access scope, so the agent reads only what I'm authorized to read.

Governance

It touches only permissioned sources and keeps nothing past the brief itself. It hands me the result and stops there. No autonomous outbound action.

Outcome

Every meeting gets the same depth of prep. The quality no longer tracks how much time I had that morning.

Multi-source retrievalScoped API accessLLM synthesisStructured output
03
Self-built

Deck memory: context that outlives the edit

Knowledge & context · Durable per-artifact context

Context

Executive decks get rebuilt constantly. By the third revision, nobody remembers why a given slide exists or what it was meant to say. Not me, not a colleague, not an agent.

Problem

A future editor opens the file with no memory of the storyline. They redo decisions that were already settled, or break the narrative without realizing it.

System built

I built a context layer that travels with each deck: per-slide intent and storyline notes, plus a library of reusable templates. The next editor opens the deck and can see why each slide is there.

Technical pattern

Durable per-artifact context and template reuse, with a public/private content boundary built into the pipeline so customer-safe and confidential material can't mix by accident.

Governance

Confidential and public content are separated at the source. Customer material stays inside its boundary and never lands in a reusable template.

Outcome

Edits stay on-narrative across a long chain of revisions and handoffs, whether a person or an agent makes the next change.

Per-artifact context filesTemplate libraryPublic/private content splitHTML render pipeline
04
Self-built

Research-to-content studio

Automation pipeline · Research-to-content automation

Context

I turn messy research, experiments, and notes into things I can publish in my own voice.

Problem

Synthesis is the slow step. And anything finance-adjacent needs a privacy and disclosure check before it goes anywhere near public.

System built

A pipeline that captures source material, runs a synthesis loop, and drafts a first version, with a privacy and disclosure pass wired in as the required final stage.

Technical pattern

Ingestion, then a synthesis loop, then voice-preserving generation, then a hygiene gate. The screen-recording scrub and disclosure checks are a step the pipeline isn't allowed to skip.

Governance

The PII scrub, screen-capture cleanup, and disclosure checks run before anything publishes. Nothing publishes on its own.

Outcome

Research becomes drafts that sound like me, with the privacy pass baked into the run so it can't quietly get forgotten.

Capture pipelineSynthesis loopVoice-preserving draftingPII / disclosure gate
05
L3 Field pattern

AML & name-screening copilot

Knowledge & context · Entity resolution over governed data Large financial institution

Context

A regulated compliance team buried under name-screening alerts.

Problem

Deterministic fuzzy matching floods analysts with false positives, and the context they need to clear an alert is spread across systems that don't talk to each other.

System built

I designed and prototyped a copilot that runs entity resolution and semantic search over a governed data lake, with an assist that drafts the alert narrative for an analyst to review.

Technical pattern

Vector embeddings layered on top of the deterministic rules, entity resolution to collapse duplicate identities, and retrieval over governed data. The analyst reads the drafted narrative as a first cut and edits from there.

Governance

Regulated data, fully audited. The deterministic matcher stays in place as a fallback, and a human signs off on every regulated outcome before it stands.

Outcome

Less time spent per alert, with the analyst still making the call. The compliance record holds up to review because every step is logged.

Azure AI SearchAzure AI FoundryMicrosoft Fabric / OneLakeVector embeddingsDocument Intelligence
06
Field pattern

Agent governance & isolation baseline

Governance & trust · Agent identity, boundaries, and audit Regulated enterprise

Context

Enterprises want agents working on their real data. Security review won't let an ungoverned agent anywhere near it.

Problem

"Let an agent into our systems" fails review the moment someone asks who the agent is, what it can reach, and what it leaves behind.

System built

I architected a baseline for putting agents into a regulated estate safely. It's a reference pattern teams can drop into a new project and build on.

Technical pattern

Per-agent identity; data-boundary and access scoping so each agent reaches only its own lane; responsible-AI checks and telemetry; a data-security posture built for AI workloads; and isolation so one agent can't borrow another's access.

Governance

This entry is the governance. The baseline makes least privilege and an audit trail the defaults, and it's built to clear an enterprise security review up front.

Outcome

A repeatable answer to "how do agents touch our data safely" that carries from one engagement to the next.

Microsoft Entra Agent IDMicrosoft PurviewAzure AI FoundryDSPM for AI
07
L3 Field pattern

Agentic back-office operations

Agentic orchestration · Multi-agent process automation, human-gated Large commercial bank

Context

A bank's shared back-office runs on multi-step, multi-team workflows: loan processing, document checks, compliance, sign-off. Each case moves by hand from one queue to the next.

Problem

Every hand-off is a place a case stalls. The institution wanted to run the process end-to-end without losing the audit trail or the control points a regulator expects at the parts that carry risk.

System built

I designed a multi-agent system that runs a back-office process from intake to completion: a workflow orchestrator coordinating specialist agents for document comparison, compliance, signature and verification, and straight-through processing, over a shared memory layer wired into the bank's enterprise systems.

Technical pattern

An orchestrator agent coordinating role-specialized workers, each owning a single step and passing state through a shared memory store. Cases flow straight through, with a human pulled in only at defined risk gates rather than at every step.

Governance

Audit-grade traceability of every agent action, with data governance, role-based access, and responsible-AI policies wired in from the start. Human-in-the-loop is reserved for the risk gates, and every action is logged so the case holds up to review.

Outcome

A reference design for taking a multi-team back-office process end-to-end with agents, where the audit trail and the risk gates are part of the architecture rather than bolted on afterward.

Azure AI FoundryMulti-agent orchestrationShared memory storeMicrosoft PurviewRole-based access control
08
L3 Field pattern

Self-healing infrastructure operations

Autonomous operations · Closed-loop AIOps, threshold-gated Large media enterprise

Context

Infrastructure teams drown in monitoring alerts that flag that something is wrong but not why. Root cause sits buried across logs, metrics, and telemetry, and remediation is still done by hand.

Problem

Traditional monitoring lacks the context to explain an incident, so resolution stays slow and engineers spend nights correlating signals by hand. Full automation is the obvious fix and the one nobody trusts: few teams will let a system change production on its own.

System built

I designed a closed-loop, multi-agent operations architecture: specialist agents for monitoring setup, log collection and analysis, component-impact mapping, solution generation, and execution, running a continuous detect, diagnose, remediate, validate loop against the live estate.

Technical pattern

A closed-loop AIOps pipeline of modular agents driven by policy inputs (SRE guardrails, IaC modules, security checklists), with a threshold-based approval gate: actions inside defined safe limits can auto-execute, anything red or high-risk is held for a human. A build, govern, heal, optimize lifecycle abstraction makes it portable across servers, containers, and cloud apps.

Governance

A rule-based safety gate sits before execution: green-within-limits can proceed, red or critical is held for human approval. A gatekeeper and a hygiene-validation step run before any change lands, and every action and its effect are scored and reported.

Outcome

A reusable self-healing operations pattern where automation is bounded by explicit risk thresholds and a human override, so an enterprise can move toward autonomous ops without handing production a blank check.

Multi-agent orchestrationAIOps / observabilityInfrastructure-as-CodePolicy-based guardrailsHuman-approval gates
09
L3 Field pattern

Layered GenAI reference architecture

Solution architecture · Reusable platform architecture, pilot-to-scale Enterprise (cross-industry)

Context

Every enterprise AI engagement rebuilds the same foundations, identity, security, governance, data, orchestration, monitoring, before it can ship a single use case. Pilots stall because the plumbing gets redone each time.

Problem

Without a shared architecture, each new use case re-litigates the foundational decisions. Nothing carries from one project, or one business unit, to the next, and the jump from a pilot to scale never happens.

System built

I authored a three-tier reference architecture that separates a stable Core layer (identity, security, governance, observability, the shared AI platform) from a Variable layer (reusable agent capabilities: orchestration, tool-calling, memory, retrieval) from a Solution-Dependent layer (domain-specific agents, prompts, evaluations, and UX at the edge).

Technical pattern

Layer by rate-of-change. The Core stays constant across every use case; the Variable layer is composed per scenario; only the thin Solution-Dependent layer is built fresh, and it inherits identity, logging, and compliance from the layers beneath it. New use cases plug in instead of starting over.

Governance

Governance lives in the Core layer. Identity, an AI control tower, observability, and compliance are inherited by every solution above it, so a new use case can't ship without them. The controls are structural, not optional, which is the entire point of putting them in the layer nobody rebuilds.

Outcome

A pilot-to-scale model reused across engagements and business units, where teams stop rebuilding identity, security, governance, data, and orchestration for every project and build only the part that's actually new.

Azure AI FoundryAgent orchestrationRetrieval-augmented generationMicrosoft PurviewIdentity & access managementObservability
10
L3 Field pattern

LLM-as-judge evaluation loop

Quality & evaluation · LLM output evaluation, confidence-gated Capital markets firm

Context

A firm wanted to turn unstructured inbound email, broker messages, into structured trade data automatically. The model gets it mostly right, but mostly isn't good enough when the output feeds downstream systems.

Problem

An extraction model that's right most of the time still produces errors you can't see. There was no objective signal for whether a given output could be trusted, or for which prompt change actually made things better instead of just different.

System built

I designed and prototyped a generator-plus-judge pipeline: an analyzer model extracts structured rows from each email, a judge combining deterministic rule checks with an LLM scorer returns an accept-or-reject verdict with confidence and rationale, and uncertain cases branch out to a human.

Technical pattern

Generator to structured output to judge (rules plus LLM) to a confidence-scored verdict to a feedback loop. Scoring the judge's output against a ground-truth set drives iterative prompt tuning, so improvements are measured against data instead of guessed, and low-confidence cases route to review instead of flowing through silently.

Governance

The judge is the gate. Deterministic rules catch schema and invariant violations before the LLM scorer weighs in, low-confidence outputs are held for a human rather than trusted, and every verdict carries a rationale that can be audited.

Outcome

A reusable evaluation pattern that turns 'the model seems fine' into a measured, confidence-scored signal, and turns prompt tuning from guesswork into something driven by ground-truth deltas.

Azure OpenAILLM-as-judgeDeterministic validationGround-truth evalsConfidence-based routing
11
L3 Field pattern

Curated data-access layer for enterprise agents

Solution architecture · Governed agent-to-data access, identity-inherited Global resources enterprise

Context

An enterprise wants agents reasoning over its real business data, but that data lives in decades-old transactional systems spread across a lakehouse and a warehouse, thick with legacy columns and artifacts nobody remembers adding.

Problem

Point an agent straight at those raw estates and two things break at once. The agent can't make sense of a sprawling transactional schema, so accuracy falls apart, and the security team has no clean way to govern what the agent reaches when it's querying raw tables directly. Federating everything on demand just moves the pain into the agent's context window.

System built

I architected an opinionated target-state access layer that sits between agents and the raw estate. Rather than exposing tables, it publishes curated, governed datasets and wraps them in semantic tools over an integration layer, so an agent calls a business operation like 'get account information' instead of writing a query against a legacy schema. Each tool wraps an API, and the tools are grouped behind context boundaries so no single surface overwhelms the agent. The opinionated stance -- curate first, mediate through semantics, bound the surface -- is the point of the design, not an implementation detail.

Technical pattern

Mediate agent access through a curated semantic layer, not the raw data. Expose opinionated, business-level tools over governed datasets; keep the tool surface small and split it along context boundaries so the agent isn't drowning in choices; and let user identity stay the trust boundary, with the agent inheriting the originating user's permissions rather than holding its own broad access. Govern the curated layer, not the transactional sprawl underneath it.

Governance

Identity stays the control plane: the agent operates within the permissions of the user it acts for, and authentication stays anchored in the enterprise identity system rather than delegated to the agent. Governing a curated dataset is tractable in a way governing raw transactional data is not, so the curated layer is where access control and auditability actually live. Keeping the agent off raw tables is the point, not a side effect.

Outcome

A reusable answer to 'how do we let agents work over our real data without pointing them at the raw estate' that carries between engagements: curated datasets, semantic tools with a bounded surface, and identity inheritance as the default rather than an afterthought.

Model Context Protocol (MCP)Curated semantic data layerMicrosoft Entra IDLakehouse / warehouse integrationIdentity-inherited agent access
12
L3 Field pattern

Hybrid routing for conversational agents

Solution architecture · Intent-separated conversational AI, human-handoff Regional bank

Context

A regulated consumer service wanted one conversational experience to answer everyday questions and carry out account actions. Those requests look alike at the chat surface, but they have very different data, latency, integration, and risk profiles behind it.

Problem

Treat every intent as the same workload and the architecture becomes a compromise: informational questions inherit the complexity of transactional systems, while action-taking requests risk being handled through a path that was designed only to retrieve answers. Failure also needs to become a useful human handoff, not a dead end that makes the customer repeat the conversation.

System built

I designed and presented a hybrid conversational-agent reference architecture with one customer-facing surface and separate execution paths for informational and transactional intents. The information path is optimized for governed retrieval; the transaction path reaches enterprise actions only through managed APIs and private integration boundaries. The design allows for managed or pro-code agent runtimes and includes a live-service fallback that transfers the conversation context to a person.

Technical pattern

Classify first, then route by consequence. Knowledge intents go to a retrieval path; action-taking intents go to a separately governed tool and API path. Keep internal systems behind an integration boundary, observe both paths as one service, and make escalation a context-preserving continuation rather than a restart. The runtime can change without changing those workload boundaries.

Governance

Private connectivity and API boundaries keep the public-facing agent away from core systems, while PII detection and end-to-end tracing cover the conversation and its downstream calls. Transactions stay within the institution's existing controls, and uncertain or failed interactions can move to a human with the transcript and context attached. Production use remains subject to security review rather than being implied by the design.

Outcome

The proposal brought retrieval, transactions, security, observability, and human handoff into one blueprint for architecture alignment and feasibility assessment. It was a reference design, not a validated prototype or deployment.

Azure AI FoundryMicrosoft Copilot StudioAzure AI SearchAPI managementPrivate networkingHuman-agent handoff
13
Self-built

Industry-switchable agent demo

Agentic prototyping · Scenario-switchable agent demo with source inspection

Context

Enterprise agent demos often become a generic chat window with little business context or a one-off build that needs specialist setup before each session.

Problem

I wanted one self-serve experience that could cover different industries and personas while keeping a coherent end-to-end story. The audience also needed a way to trace each answer back to its evidence.

System built

I built and hosted a self-serve demo where a user picks an industry and persona, then works through a business scenario with the agent. The app uses synthetic, domain-specific artifacts and retrieves from several source types to synthesize an answer. Users can open the supporting sources. The interface leads with the business flow and keeps technical drill-downs available.

Technical pattern

Keep the agent and retrieval pipeline fixed, and swap the industry/persona context and supporting artifacts as one scenario layer. The same flow supports different scenarios without a rebuild. Progressive disclosure starts with the selected scenario and leaves the mechanics available on demand.

Governance

The demo uses synthetic data and restricted access. Citations and source inspection let reviewers trace an answer. The prototype is not presented as a customer deployment or production system.

Outcome

Reviewers could run the self-serve prototype, and early use informed the next iteration. Changing the industry or persona did not require a separate build.

Azure AI Foundry AgentsAzure Container AppsMulti-source retrievalSynthetic scenario dataSource citations
Tri Nguyen

About the author

Tri Nguyen is a Lead Data & AI Architect at Microsoft's ASEAN Innovation Hub, designing AI systems for enterprises across nine countries. He has worked deeply across the Microsoft, AWS, and Salesforce ecosystems and holds 30 AWS and Salesforce certifications.

How this gets built

The systems behind the notes.

Field Notes is what I’ve shipped. Systems is how I work — the agentic stack, the operating loop, and the principles that keep it public-safe.

See the systems →