Case study · United Nations
Automation platforms for United Nations environments.
Ansible and AWX platforms serving multiple UN organizations across cloud and on-premises estates — built so that teams with different mandates could onboard without weakening security or auditability.
- Environment
- United Nations System organizations
- Engagement
- 2021–2026
- Role
- Automation Expert / Senior Ansible Automation Engineer
- Platform
- AWX on Kubernetes
- Delivery
- Remote, multi-country
- Ansible
- AWX
- Kubernetes
- Execution Environments
- ServiceNow
- Azure AD
- Microsoft Graph
- HashiCorp Vault
- CyberArk
- LDAP
- CI/CD
Written to be confidentiality-safe: no internal hostnames, tenant names, ticket references or architecture detail beyond what is publicly appropriate.
Context
The organizations served operate under strict security and audit expectations, across a mix of cloud and on-premises infrastructure, with teams distributed internationally. Automation existed, but it had grown per team: different conventions, different credentials handling, and no shared way to prove what an automated change had done.
The engagement ended in July 2026.
Challenge
- —Onboard multiple teams onto a shared automation platform without giving every team platform-admin access
- —Support both cloud and on-premises targets with the same content
- —Standardise execution environments so runs were reproducible
- —Integrate with enterprise identity, secrets and ITSM rather than around them
- —Make automation auditable enough to satisfy internal review
Scope
Platform
AWX on Kubernetes, with the platform itself defined as code and upgradeable on a routine cadence.
Automation content
Roles and collections with testing and documentation standards applied across contributing teams.
Execution Environments
Purpose-built container images per capability, versioned and distributed from a controlled registry.
Onboarding
A repeatable path for a new team: project, credentials, inventory, RBAC and a working first job template.
Integrations
Identity, secrets and ITSM wired into the platform rather than reimplemented per team.
AI-assisted operations
Assistive tooling for operational work, with scoped access and human approval.
Implementation and standards
Platform practices
- ✓ Platform configuration held in Git and applied consistently
- ✓ Custom Execution Environments built through a pipeline, not by hand
- ✓ RBAC mapped to enterprise identity groups
- ✓ Upgrades rehearsed against a non-production platform first
- ✓ Automated synchronisation of platform resources
Automation standards
- ✓ Roles and collections over standalone playbooks
- ✓ ansible-lint and YAML validation in CI
- ✓ Molecule scenarios for reusable content
- ✓ Idempotency as an acceptance criterion
- ✓ Documentation required before content is shared
Security and integrations
Automation was integrated with the systems the organizations already relied on: secrets retrieved at run time from Vault and CyberArk rather than stored in content, identity resolved through LDAP and Azure AD, lifecycle actions performed via Microsoft Graph, and change records written to ServiceNow so every automated action had a corresponding trail.
No secrets in content
Credentials are retrieved at run time. Nothing sensitive lands in a repository.
Least privilege
Credentials and job templates scoped to the team and the target that needs them.
Auditable by design
Job output, change records and platform configuration all traceable to a source.
Governed AI assistance
Where AI supported operations, tool access was scoped and human approval required.
Results
- —Multiple teams onboarded onto a shared platform with their own scoped access
- —Automation content standardised across contributors, with testing in CI
- —Execution environments reproducible and versioned rather than hand-built
- —Cloud and on-premises targets served by the same automation content
- —Platform upgrades became routine, rehearsed operations
TODO — confirm which additional outcomes may be published, and in what terms, before this page goes live.
Related case studies
BigFix to Ansible Migration
20,000+ endpoints across 10+ countries moved to Ansible Tower.
Read case study →AWX Platform Modernization
Legacy AWX rebuilt on the operator with GitOps configuration-as-code.
Read case study →AI-Enabled Operations
Governed AI integration with scoped tools and human approval.
Read case study →
Running automation under audit expectations?
The hard part is rarely the playbook. It is proving, afterwards, exactly what ran and who approved it.