Back to Projects
Multi-Source AI Assistant — Cloud & DevOps Internship at OREVIT
Project Overview
OREVIT · June – September 2026 · Cloud/DevOps — ingestion pipeline and security
An internal AI assistant that answers questions against a company's own knowledge, spread across the tools teams actually use: Jira, ServiceNow and SharePoint. The engineering problem is less about the model than about the ingestion layer — keeping a knowledge base current across several third-party systems, each with its own change semantics, without hammering their APIs or losing events.
My work covered the ingestion architecture and the security model around third-party credentials.
Event-Driven Ingestion
- API Gateway → SQS → Lambda for webhook-driven sources. Jira and ServiceNow push change events to API Gateway, which writes to a queue rather than invoking processing directly. The queue absorbs bursts, decouples ingestion from the source system's retry behaviour, and gives failed messages somewhere to go instead of disappearing.
- EventBridge Scheduler for SharePoint, which has no usable push model. Scheduled runs perform incremental synchronization based on change tokens, so a run costs proportionally to what changed rather than to the size of the corpus.
- The pipeline is sized for peaks in the several hundreds of events range, with queue depth as the backpressure signal rather than Lambda concurrency errors.
Security & Tenant Isolation
- OAuth2 tokens for each connected system are stored encrypted in AWS Secrets Manager under KMS keys — never in environment variables, never in the repository.
- Multi-tenant isolation is enforced through the ingestion path itself: a tenant's documents, credentials and derived data stay within that tenant's boundary, so a misrouted event cannot surface one customer's content in another's answers.
- Lambda execution roles are scoped per function, so a compromised ingestion handler cannot read secrets belonging to a source it does not integrate with.
Technologies Used
API Gateway
Amazon SQS
AWS Lambda
EventBridge Scheduler
Secrets Manager
KMS
OAuth2
IAM Least Privilege
Terraform
Jira / ServiceNow / SharePoint APIs
Multi-Tenant Architecture
Architecture Diagrams
Ingestion architecture diagram — coming soon
Repository
The codebase is proprietary to OREVIT and is not publicly available. Architecture and implementation details can be discussed on request.