Four-in-one delivery, built for 3,000 concurrent users

Dozens of subsidiaries across the group had each bought their own AI tools. Model access, knowledge bases and permission systems were not connected, and the security team could not audit conversations or data flows. Business units had heavy demand for policy lookup, report writing and data analysis, but no single entry point.

The infrastructure had to run entirely on China's domestic IT stack: Kylin V10 on ARM64 servers, the Dameng database and the containerd runtime. Mainstream open-source platforms had no proven production deployment on this environment. The group also required a ceiling of 3,000 concurrent users and had to pass China's MLPS security assessment.

We delivered platform, FDE, training and operations as one package, completing platform deployment and the first flagship use cases within 8 weeks.

• Platform: enterprise-grade enhancements on a Dify base, integrated with the group's single sign-on and multi-level org structure, with department-level data isolation and end-to-end audit trails
• FDE: on-site engineers built MVPs for 6 use cases, including policy lookup, meeting minutes and business data analysis, and took them to production
• Training: one executive strategy workshop and one bootcamp for 120 key staff, producing 10+ Agents built by departments themselves
• Operations: a monthly AgentOps cadence after go-live, reporting on usage, effectiveness, cost and risk

Capacity planning

Sized for 3,000 concurrent users: business pool 16C/32G × 4, async task pool 32C/64G × 4, infrastructure pool 8C/16G × 2. PostgreSQL was replaced with Dameng and the SQL dialect adapted; object storage and the vector store both use versions compatible with the domestic IT stack.

Domestic IT stack adaptation

• All images rebuilt for ARM64; 3 native modules in the dependency tree had to be compiled from source
• Differences in Dameng's JSONB and array support handled at the ORM layer and in migration scripts
• GPU scheduling and VRAM isolation under containerd verified separately