A broker in the middle
An Azure App Service sits between the legacy system and Claude. Nothing calls the model directly and the model never reaches the system. Every request goes through one place that can authenticate it, shape it, and record it.
Secure AI integration
Letting Claude read a legacy system without giving it the keys
The data worth applying AI to sat in a system with no modern authentication. We built a broker on Azure App Service with credentials in Key Vault, so the model gets the fields it needs and every record it touched is logged.
Legacy line-of-business operator · Alberta · anonymised at the client's request
The situation
What we walked into
The information that would make AI genuinely useful was locked in a legacy line-of-business system that predates modern auth entirely.
The obvious approaches were all wrong. Putting API keys in the legacy application, or on the workstations talking to it, spreads long-lived credentials into exactly the estate you least want them in.
Handing a model direct access to the system was not acceptable either — no scoping, no way to constrain what it could read.
The requirement that decided the design: being able to answer "which records has AI seen" later. Without that, the integration is unauditable, and unauditable is unusable for anything regulated.
The work
What we built
Credentials in Key Vault, never in the estate
Secrets live in Azure Key Vault and the broker reaches them with a managed identity, so no API key is ever written into the legacy application, a config file, or a workstation. Rotation happens in one place and nothing downstream needs to know.
Least privilege on the data, not just the connection
The broker pulls only the fields a given request needs rather than handing over whole records. Scoping at the field level is what stops "AI can read the system" from meaning "AI can read everything in the system".
A log built for the question that gets asked later
Every call is recorded: who asked, what was requested, which fields were passed, and when. The audit trail is not a by-product here — it is the reason the architecture looks the way it does.
The outcome
Where it landed
- AI applied to legacy data with no credentials anywhere in the legacy estate.
- Secrets centralised in Key Vault, rotatable without touching the application.
- Field-level scoping, so exposure is bounded by design rather than by policy.
- A complete record of what data the model was given, available before anyone has to ask for it.
Got something shaped like this?
Most of this work starts the same way — finding out what is actually running before anyone proposes a fix.