Consolidating a utility's .NET estate, and putting AI identity verification inside it

Context

Years of incremental delivery had left several web services with overlapping responsibilities, each with its own quirks and its own reason nobody wanted to touch it. The same estate also had to verify customer identity from uploaded documents using a third-party AI provider, under the eye of an enterprise security review.

The problem

Consolidate the services into one without freezing delivery for a rewrite, land on a new database structure in the same effort, and get a document out to an external AI verification service and the verdict back — while satisfying reviewers who care about exactly where credentials live and what could be reconstructed from a log file.

What I did

• —Restructured the surface around CQRS, separating read paths from write paths.
• —Pointed the consolidated service at a new schema rather than preserving the existing one, so the new service was not carrying the inherited data model forward.
• —Built APIs for secure document upload, then integrated the third-party AI identity-verification provider over HTTP, sending and parsing payloads in both directions.
• —Moved every API key and secret into the organization's secret-management package.
• —Logged enough of each request and response to diagnose a failed verification in production without putting a customer's documents in the log.
• —Unified test automation across the products, so the consolidated surface had one approach instead of three that disagreed.