Case Study
Network Optix Scopes a Fleet-Wide Extension Platform and Agentic
Cloud Runtime on AWS
Clearscale ran a generative AI discovery and assessment engagement that turned Network Optix’s
platform vision from an architecture diagram into a bounded build plan: two customer-facing
scope areas, 15 objective success criteria, and a ~19-week milestone roadmap.
180+ countries served · 2M+ cameras checking into Nx Cloud daily · 2 customer-facing scope areas · ~19-week
build plan across 5 milestones
Client Profile
Industry Security | Video Software
Technology GenAI — Claude on Amazon Bedrock
Overview
Network Optix operates an enterprise video operating system used in
more than 180 countries, with over two million cameras checking into
its cloud daily. It set out to become a data-first platform by building a
fleet-wide extension platform and agentic cloud runtime, but the
program existed as an architecture diagram with open technical
questions, not as work anyone could scope or fund.
Clearscale ran a generative AI discovery workshop and technical
assessment with Network Optix’s product, platform, cloud, security,
and design owners. The engagement closed the open architectural
questions with recorded decisions, drew a firm scope boundary
around the customer-facing build, and produced a solution
architecture, success criteria, and a milestone roadmap.
The output was a build plan of approximately 19 weeks, sequenced
across five milestones and delivered as a single continuous project
phase, with a separable beta track for the AI-assisted creation flow
that can be deferred independently of the stable track.
Meet Our Hero
Network Optix builds the video operating system and video management platform behind a global fleet of cameras, servers, and sites. Its customers increasingly want operational intelligence derived from camera data — what happened, what it means, what to do about it — rather than recorded video alone.
Nx’s extension program was the vehicle for that shift: a platform for creating, validating, deploying, and evolving integrations, plugins, AI agents, analytics, and workflows across the Nx product family. The ambition was clear and the architecture was drawn. What was missing was the boundary between what Network Optix already owned and what needed building, and answers to the design questions underneath it.
With a customer-facing demonstration in view, leadership engaged Clearscale to convert the vision into a scoped, testable, fundable plan.
The Goal
• Close the open technical questions blocking a credible level-of-effort estimate
• Separate the customer-facing build from the existing core video product and edge transport
• Govern a channel that pushes executable code into security-critical infrastructure: package signing, manifest
enforcement, audit, staged rollout, one-action rollback, and a fleet-wide kill switch
• Define a v1 that proves the end-to-end path on one bounded pilot use case, not the whole fleet
• Establish agent boundaries and tenant isolation Network Optix can explain to its own customers
• Keep every load-bearing design decision portable off AWS
• Produce a milestone roadmap with objective success criteria
The Challenge
Challenge 01
No centralized way to get an extension onto Nx systems. Plugins and AI Manager pre-and post-processors were installed manually, server by server, which does not scale to a fleet
Challenge 02
Once camera data was generated at the edge, there was no cloud runtime to ingest it, reason over it with agents, and present the results back to a customer
Challenge 03
Open architectural questions blocked any estimate: live versus historical data, agent permissions and boundaries, where the cloud components live and how data residency is honored, and whether dashboards are static or generated
Challenge 04
Nx’s most security-sensitive customers may need to host on Kubernetes or a private cloud, so no load-bearing design decision could create an AWS-only dependency
The Solution
Clearscale ran a five-stage assessment that worked backwards from Network Optix’s own architecture diagram to a bounded scope. Every decision was recorded, every deliverable capped, and everything not named was placed explicitly out of scope.
Step 01: Discovery & Deep Dive
• Ran a generative AI discovery workshop followed by a technical deep-dive session
• Convened Nx product, platform, cloud, security, and design owners against their own diagram
• Included AWS in the conversation from the start so infrastructure options were aligned rather than retrofitted
• Carried unresolved questions from the first workshop into a written follow-up rather than leaving them in the room
Step 03 | Architectural Decisions
• Bounded v1 to the live analytics path, with historical and crosstime analysis sequenced as later work
• Fixed the v1 security baseline: a signed package trust chain with key custody and revocation, orgscoped
role-based access control, an append-only audit log, and tenant isolation enforced at the data-access layer
• Fixed the v1 fleet control set: staged rollout, one-action rollback, and a fleet-wide kill switch, with targeting at org, site, server-group, and individualserver level
• Required an offline signed-bundle path with a local apply tool, so air-gapped sites sit inside the platform rather than outside it as exceptions
• Scoped enterprise hardening, the full extension permissions model, and the marketplace to later phases, with interfaces stubbed so v1 does not have to be unpicked
• Defined the Nx Connect interface boundary and stub contract, keeping identity work off the build’s critical path
• Set four minimum RBAC roles, a 90-day retention window for normalized analytics, and three observability dashboard families with baseline alarms
• Confirmed deployment into Nx’s own AWS accounts across development, staging, and production pilot
Step 05 | Success Criteria & Roadmap
• Wrote 15 objective, testable success criteria across deployment, runtime, and outcome
• Sequenced five milestones over approximately 19 weeks in a single phase
• Made the AI-assisted creation flow a separable beta track on a lower quality bar, so it can ship rougher without risking the runtime
• Capped every soft deliverable so scope cannot drift silently: up to 25 production prompts, a golden evaluation set of up to 50 pairs validated by Nx’s subject-matter expert, up to two review cycles per design deliverable, and up to three dashboard templates
• Specified the validation estate up front: a test fleet of up to 25 servers across up to three sites, plus one air-gapped site for offline-bundle verification
• Made tenant isolation provable rather than asserted: an adversarial cross-tenant test set
the build must pass, with redaction verified on both the prompt and log paths
Step 02 | Scope Boundary
• Isolated the two customer-facing scope areas: the Extension Platform and the Cloud Runtime
• Placed the existing camera → Nx Server → AI Manager → Nx Maps stack and edge transport out of scope
• Bounded v1 to one first-party pilot application rather than the full camera fleet
• Covered both extension surfaces (core-product plugins and AI Manager pre- and postprocessors) through one shared control point
• Wrote an explicit out-of-scope list so follow-on phases are visible, not implied
Step 04 | Design Deliverables Assigned
• Assigned Clearscale two net-new design deliverables to author
• A recommended agent role model defining the confined space each agent operates in
• The first-draft applicationdescription schema the provisioning control loop consumes
• Bounded dashboard co-design, with wireframes built on Nx’s existing design system
AWS Foundation
• Terraform across three environments (development, staging, and production pilot) in
Nx’s existing AWS accounts
• Claude on Amazon Bedrock for the pilot (guardrail baseline, invocation logging, private
connectivity) behind a portable model-access gateway enforcing per-request token budgets and agent step caps, so a later change of model or host does not reach into the runtime
• MQTT ingest on AWS IoT Core behind one published analytics contract with mutual TLS, feeding a decoupled normalization service with contract validation and a deadletter
path
• A provisioning control loop that reconciles application descriptions into runtime
resources and tears them down on retirement
• The agent tier runs in containers against a portable interface, with an automated portability check that fails the build if an AWS only dependency enters a loadbearing
path
What Network Optix Holds Today
A firm scope boundary separating the two customer facing scope areas from the existing core video stack, with everything unnamed written down as out of scope
A baselined solution architecture for both scope areas, plus the Nx Connect interface boundary and stub contract that keeps the inflight identity migration off the build’s critical path
15 objective, testable success criteria that replace subjective sign-off at the end of the build
A five-milestone, ~19-week schedule with every soft deliverable capped, and a beta track that can be deferred without touching the stable one
Two net-new design deliverables specified and assigned to Clearscale: the agent role model and the firstdraft application-description schema
Recorded architectural decisions on the four questions that had blocked estimation: live versus historical data, agent boundaries, component hosting and residency, and the
dashboard model
What the Build is Designed to Achieve
Deployment lead time for a validated package falls from days or weeks to under one hour, a quantified success criterion rather than an aspiration
An authorized user uploads a signed extension once and deploys it across a multi-site fleet from a single control point, with one-action rollback and a fleet-wide kill switch
An AI Manager pre- or postprocessor deploys as a pipeline through the same control point used for core plugins
Portability is protected by an automated build check that fails the build if an AWS-only dependency enters a loadbearing path, rather than by good intentions
Turn Cloud Chaos Into Clear Results On AWS
Clearscale helps marketing and SaaS companies cut through cloud chaos and get clear results on AWS. If your legacy infrastructure is holding you back and you need a partner to tackle complex, large-scale migration and modernization projects, let’s talk.