Massimo BuonaiutoPrincipal Director · Data & Artificial Intelligence

Topics / Skills

Solution & enterprise architecture

Reference and solution architectures, C4 and TOGAF modelling, architecture boards, service and API design.

62 contributions across 8 experiences

Where this skill was applied

202613 contributions

Gavi, the Vaccine Alliance

  • Aligns the Innovation Lab architecture and experimentation portfolio to Gavi 6 Strategy 2026–2030 “Data Visibility & Use”, so every experiment traces to programmatic impact on global immunisation delivery.
  • Established and operates the Innovation Lab’s experimental AI tooling estate on Microsoft Frontiers models in Azure — including Cowork, Copilot Claude, MS Scout and OpenClaw for agentic-AI experimentation and architecture evaluation, alongside Cursor, Lovable, Bolt, v0, Microsoft 365 Copilot, Copilot Studio and Azure AI Foundry — under defined tool-selection rules, cost guardrails and an approved/excluded tooling list.
  • Leads AI enablement through a three-tier training architecture, a curated prompt library, an intranet AI Self-Service Hub and an organisation-wide AI Community of Practice with departmental champions — targeting 80%+ awareness-training completion and 70%+ monthly active Copilot users in year one.
  • Covered visitor and case lifecycles, category taxonomies, referral routing and service metrics under hard confidentiality controls — an immutable audit trail, a strict “Chinese wall” between functions, visitor numbers with no names stored and a <5 anonymisation threshold on all reporting — modelled in C4 and validated by an independent penetration test before go-live.
  • Designed the Azure architecture extending Gavi’s Programmatic Dashboard from reactive reporting to predictive early warning, forecasting country × vaccine stock-buffer breaches 6–12 months ahead — integrating SAP, UNICEF SD/Thrive360 and VaxNeed into Azure SQL and a row-level-secured Power BI model, with forecasting on Azure Machine Learning and grounded narrative generation on Azure OpenAI behind an API Management LLM gateway.
  • Coordinated architecture-board acceptance of the Governance Bot: a permission-aware knowledge assistant for audit-committee, board and governance-decision queries in Teams and SharePoint on Azure AI Foundry, with an eight-metric production-approval framework — answer accuracy ≥90%, citation coverage 100%, fallback precision ≥95%, access-control integrity 100% — so an AI service is not approved on technical completion alone.
  • Skills and technologies: Azure solution and security architecture (App Service, Static Web Apps, Functions, SQL, Blob, Key Vault, API Management, Data Factory, Machine Learning, AI Foundry, AI Search, Monitor) · Snowflake · Azure OpenAI, RAG, multi-agent and agentic AI · MLOps/LLMOps and AI evaluation · AI governance, Responsible AI and EU-aligned AI risk management · Entra ID, RLS, TDE/CMK, PIM, managed identities, TLS · C4 and TOGAF · Power BI, Power Platform, Copilot Studio, Purview, Sentinel · confidential-data governance · innovation portfolio governance, vendor selection and procurement · Design Thinking and rapid prototyping facilitation.
  • Principal AI Architect and Innovation Lab Coordinator consultant at Gavi, the Vaccine Alliance, leading the AI architecture practice behind global vaccination programmes; owns the end-to-end innovation lifecycle — idea, experimentation, outcomes, stabilisation, operationalisation — as operational deputy to the Innovation Lab Lead, and leads architecture definition and deployment across the AI portfolio.
  • Member of the Gavi architecture board, responsible for standards, investment prioritisation, solution assurance, exception management and technology-risk decisions; set up and coordinates the Gavi Innovation Lab.
  • Manages dual-mode execution governance for experiments: in-house delivery with mandatory Platform Architect validation of capacity, skills, security guardrails and environments, and external delivery by vendors, startups and academia through a four-phase collaborator workflow with capability-based assessment, compliance checks and post-experiment partner evaluation.
  • Established the reusable reference architecture for grounding Copilot agents in enterprise knowledge — SharePoint → Azure Blob → Snowflake → Azure AI Search vector index → Power Automate → Azure OpenAI → Copilot in Teams/SharePoint — secured with Entra ID RBAC, Key Vault and Purview DLP, with mandatory citation traceability and token-consumption cost controls.
  • Develops AI and solution architectures in full collaboration with the information-security and compliance function, as a formal pre-review and clearance gate rather than an after-the-fact sign-off; controls such as Entra ID SSO, least-privilege service access, audit logging of queries, responses and data access, restricted-content protection, Key Vault, PIM, RLS and Purview DLP are specified at design time.
  • Designed the secure Azure architecture for Gavi’s confidential Ombuds, Staff Counsellor and Ethics & Compliance case- and visitor-management platform: three segregated functions on Azure App Service over Azure SQL with Transparent Data Encryption and customer-managed keys in Key Vault, row-level security, Entra ID app roles enforced per request, managed identity as sole database principal and Privileged Identity Management with no standing admin access.
2025–202613 contributions

Solara28

  • Founded, ideated, architected and single-handedly developed Solara28, an AI-native multi-tenant SaaS platform for European commerce verticals — food services, restaurants, pharmacies, grocery retailers, wine and spirits, catering, coffee shops and event ticketing — positioned under the vision “Illuminate your commerce” as a local-first, zero-commission alternative to global marketplace aggregators and platforms such as Amazon, Shopify, Just Eat, Deliveroo, PrestaShop and WooCommerce. Evidence ↗
  • Architected and implemented a governed Agentic Factory coordinating eight specialised virtual teams and 32 autonomous AI agents across the end-to-end software delivery lifecycle, generating 6,000,000+ lines of production-ready code, documentation and change artefacts in under one year across a polyglot stack (TypeScript, Supabase/PostgreSQL, FastAPI, Stripe, Vercel).
  • An audited codebase review (August 2026) across eight engineering roles — frontend, backend, database, QA/security, DevOps, localisation, architecture and documentation — estimated the work at about 274.8 person-years (60,462 working days), roughly 275 engineers for one year, with a salary-equivalent labour value of about CHF 30.1M / EUR 19.6M at the midpoint (range CHF 25.9M–34.3M / EUR 15.5M–23.7M); all of it was delivered single-handedly. Evidence ↗
  • Designed, built and published the open-source Buonaiuto-Doc4LLM MCP server, which auto-detects a project’s library stack, fetches current official documentation and serves it version-aware to AI coding assistants — the RAG infrastructure that kept the agents’ 6M+ lines of code aligned with current, secure architectural standards and eliminated API hallucinations.
  • Delivered mobile-first, WCAG-accessible experiences in five languages from day one — Italian, English, German, French and Spanish — with theme-based templates for 9+ store verticals, including restaurant ingredient customisation, pharmacy prescription workflows and event ticketing with QR check-in.
  • Moved Solara28 from architecture and development into controlled production readiness, including security hardening, environment separation, release governance, monitoring, backup and recovery procedures and operational support processes.
  • Designed as next-generation commerce infrastructure for local economies, combining AI-native operations, multi-tenant SaaS architecture and decentralised business ownership to support European business sovereignty and restore data sovereignty, margin control and customer ownership to independent merchants.
  • Established an end-to-end autonomous AI delivery model covering architecture design, code generation, testing, security validation, cloud implementation and documentation, with every artefact traceable to requirements, architecture decisions, source-control changes, code review, automated testing, security scanning and release approval; the Agentic Factory executed work across engineering, QA, DevOps, compliance, localisation, marketing, branding, e-commerce and online payments.
  • Governed the automated delivery lifecycle — architecture, software engineering, testing, security, DevOps and documentation — as an agentic AI operating model aligned with the EU AI Act.
  • Architected a provider-agnostic LLM service layer (TypeScript/Node.js/Supabase) connecting OpenAI, Anthropic and Gemini APIs, with configurable provider settings, prompt governance, conversation logging and health monitoring, powering conversational and voice-enabled commerce (“Talk to Your Shop”), automated catalogue ingestion from PDFs, photos and Excel, and predictive revenue forecasting.
  • Architected the platform so merchants retain full ownership of all operational and customer data, with a GDPR-native multi-tenant architecture for the European market, automated audit trails and European data residency.
  • Engineered a secure PostgreSQL architecture with hundreds of tables and compound Row Level Security policies, enforcing deterministic tenant isolation across platform, store, staff and customer contexts, with governance-by-design audit logging, activity feeds and observability of API latency, background jobs, errors and cache performance.
  • Designed a fully API-first commerce infrastructure governing the complete retail lifecycle — dynamic catalogue management, logistics and proprietary driver-network routing, native multi-channel CRM and loyalty analytics — enabling modular extensibility and third-party integrations.
2024–20258 contributions

EPAM Systems

  • Coordinated the proposal for a bank-wide Generative AI blueprint mapping 35 prioritised use cases across all seven divisions of the bank over six enabling layers: AI strategy, legal and compliance, data and security, technical architecture, responsible AI and workforce enablement.
  • Adapted EPAM’s Generative AI Factory target architecture for the bank — three planes (Models / Data / Services) over Data Factory, AI Backoffice and AI Serving Platform — covering feature and prompt engineering, continuous training and evaluation, data- and model-drift monitoring, hallucination management, guardrails, vector stores, FinOps and a gateway to third-party models, closing on a dedicated data-privacy layer.
  • Global pharmaceutical company: principal expert (GenAI, architecture, software engineering) supporting the AI Factory framework and global AI strategy; defined a reusable AI component framework and LLM/multi-agent orchestration for biomedical R&D and regulatory processes, and a global Community of Practice for AI knowledge sharing.
  • Global energy leader, Saudi Arabia: designed scalable AWS AI cloud platforms and end-to-end architectures across upstream, downstream, R&D, engineering, finance, HR, safety and supply chain, with LLM orchestration, multi-agent systems, RAG and LSTM models for R&D.
  • Leading telecom operator, Africa: co-led the RFP response on enterprise AI/GenAI strategy, developing a target-state federated AI architecture, AI Factory delivery capabilities and a GenAI integration roadmap.
  • Global chemical manufacturer: lead architect for GenAI in R&D, engineering and production — semantic ingestion pipelines, RAG over structured and unstructured data, and a phased path from PoCs to multi-agent assistants on a modular, scalable architecture.
  • Global industrial materials firm, UK: defined the architecture for freight anomaly detection — hybrid statistical, ML and GenAI models with RAG for contextual validation on AWS and GCP, feature engineering, prompt design for anomaly justification and EPAM AI accelerators.
  • Led privacy-by-design reviews for AI systems handling sensitive or personal data, covering data minimisation, retention, data residency, DPIA inputs, access governance, encryption and secure data sharing.
2012–20134 contributions

United Nations

  • Led a team of data scientists and architects on a climate-change project, designing a large-scale data architecture managing 1.2 billion records to analyse agrobiodiversity.
  • Authored technical documentation defining recommended criteria for national and international data platforms and enterprise data architecture for desertification datasets, presented to Prime Ministers of several countries at UNCCD COP 10. Evidence ↗
  • Designed multi-country sensor-data collection architectures, integrating real-time climate datasets from thousands of sensors into unified analytical systems.
  • Engineered REST/SOA services enabling cross-agency interoperability for scientific and environmental data platforms.
20183 contributions

Fair Trade Handels

  • Defined and executed the new digital and data strategy — resources, technology and architectures — leading organisational change and aligning processes and resources to the new direction.
  • Restructured functions, technical teams and programmes into a digital, data-driven organisation, optimising distribution, revenue management, pharmaceuticals, decision-making and sales operations.
  • Architected a new enterprise data architecture and data valuation model, changing how business processes measure and prioritise the value of data.
1994–20062 contributions

CapodannoRoma, Helloitaly & Radio&Data Communications

  • Pioneered, architected and scaled Italy’s first B2C e-commerce platform for live-event ticketing as Start-up Founder & Chief Technologist at CapodannoRoma, Rome (1994–2006).
  • Co-architected and built Helloitaly.it, the first online travel portal in Italy, later acquired by Expedia Group: inventory for 15,000+ hotels and 500% global revenue growth (1998–2002).
2013–20181 contribution

Nespresso (Nestlé)

  • Supported the global restructuring of Nespresso’s data analytics function, migrating operations and technologies to a centralised analytics hub.
2002–20111 contribution

United Nations CGIAR

  • Developed digital tools and methods for genetics and omics research for food production, including federated access, SOA services, RESTful applications and data standards.
Profile15 contributions

Across the career

  • Uses Solara28 as a concrete reference case for AI-native product strategy, operational efficiency, platform architecture and business-model innovation.
  • Architects AI solutions that connect business objectives, data foundations, operating models, technical platforms, governance and measurable outcomes.
  • Combines AI product management, solution architecture, model evaluation, question design and rubric development.
  • Translates regulated-domain requirements into governed AI architectures, delivery models, validation processes and operational practices.
  • Leads strategic client engagements from discovery and solution scoping through architecture, value proposition, proposal development and executive presentation, combining pre-sales acumen with client relationship management.
  • Builds, manages and leads high-performing Swiss-based and international AI, data, architecture, engineering and analytics teams; has built and scaled distributed AI and data organisations spanning data science, machine learning, analytics engineering, cloud, architecture and product roles.
  • Demonstrates modern delivery leadership by orchestrating specialised AI-agent teams across architecture, implementation, documentation, testing and governance.
  • Designs enterprise data architectures combining DAMA and FAIR governance, data engineering, data mesh, event-driven design, cloud platforms and secure multi-tenant design.
  • Combines strategic data governance with hands-on architecture, pipeline design, integration, data modelling and platform implementation.
  • Specialises in taxonomy governance, ontology development, metadata standards, information architecture and institutional knowledge reuse.
  • Combines multi-tenant architecture with audit trails, feature flags, operational observability, GDPR-aligned governance and controlled data access.
  • Designs agentic development methodologies in which autonomous AI agents support architecture, code generation, testing, security review, documentation and delivery governance, along with hands-on agentic AI architectures and platforms.
  • Applies continuous code generation, architecture review, security scanning, test-driven development and human oversight to AI-native engineering.
  • Combines full-stack engineering with enterprise SaaS architecture, API-first design, Stripe payments, e-invoicing, customer analytics and operational workflows.
  • Designs commerce systems that support restaurants, food services, pharmacies, grocery retailers, events, ticketing and other specialised business models.
Skills2 contributions

Skills & applied knowledge

  • Architecture of scientific-data semantic-search systems using REST, SOA, metadata brokers, ontology-driven indexing and semantic retrieval.
  • Twenty-plus years of enterprise-architecture ownership across public and regulated organisations, and twenty-two years of software engineering spanning architecture design, SDLC governance, Agile, Scrum and mobile-application development.
All skills

Artificial intelligence

Architecture & data platforms

Leadership & business

Product, marketing & communication