Forward Deployed Engineering in Australian Government: Clearances, Tenancy and How to Buy It

Agencies buy engineering differently from companies, and for good reasons. Data has to stay in the right place, people have to be cleared, decisions have to be defensible afterwards, and the money has to be spent through an approved route. That makes some delivery models a poor fit before the work even starts.

A forward deployed team fits the constraints better than most, if it is set up correctly. Here is what to ask for.

The work stays in your tenant

The first question on any AI project in government is where the data goes. Building agents inside your own Microsoft tenant, on Azure and Copilot Studio, means the documents, the prompts and the logs stay in your environment under your controls. Nothing is sent to a provider's platform for processing, and there is no separate system to assess.

Ask for it in writing: the code in your repositories, the workloads in your subscription, the identity model yours, and no copy of your data on the provider's side.

Onshore people, and clearances where they are needed

Where the engineers sit matters as much as where the data sits. For PROTECTED work, the practical requirements are Australian-based staff, Australian citizens where the environment demands it, and security clearances held before the work starts rather than promised during it.

A provider that subcontracts development offshore cannot meet this, whatever the sales deck says. Ask who employs each engineer and where they work from.

A decision record you can defend

An agency has to be able to explain a decision months later, to an auditor, a committee or an applicant. This shapes what an agent is allowed to do.

The workable pattern is narrow. Agents read, extract, draft and assemble. People decide. Every extract points back to the source document and page, so an officer can check it in seconds, and the trail of what the agent produced is kept with the record. Build it that way from the first sprint and assurance is a review rather than a rebuild.

Buying it

Most agencies buy digital work through a panel. At the Commonwealth level that is usually the Digital Marketplace Panel on BuyICT; states run their own arrangements. Two points are worth getting right early.

• Labour hire and professional services are different categories with different rules. A forward deployed team is a service with its own lead and delivery accountability, not a set of contractors you manage.
• Short, funded phases beat one long engagement. A fixed-fee assessment, then a team for a defined number of sprints, gives you a natural stop point and a decision you can justify.

Why agencies end up here

The pattern repeats. An agency runs a Copilot pilot, sees real time saved on drafting and summarising, and then finds that the next step needs the agency's own content, its own policies and its own systems. That work cannot be bought off a shelf and it cannot be specified from outside, because it depends on how that agency actually works. So it needs engineers who are close to the work, inside the environment, for long enough to finish.

The alternative, hiring the same skills permanently, is slow in the current market and hard to sustain at the APS and state pay scales. A team that works alongside your people, and leaves the code, the prompts and the know-how behind, is the practical middle path.

What to require in the contract

1. Named engineers, based in Australia, with the clearances the environment needs.
2. All work in your tenant, your repositories and your ALM.
3. A demo and a written report at the end of every sprint.
4. Source references on every AI extract, and a person at each decision point.
5. Everything handed over on exit: code, prompts, evaluation sets, documentation and training for your staff.
6. The ability to stop at the end of any agreed phase.

Frequently asked questions

Can forward deployed engineers work on PROTECTED systems?

Yes, when the people and the environment meet the requirements: Australian-based engineers, citizenship and clearances where the system demands them, and all work performed inside the agency's own assessed environment.

Does our data leave the agency?

It should not. Agents built on Azure and Copilot Studio inside your own tenant read and write your data in place. Ask any provider to state in writing that no copy of your data is processed or stored on their side.

How do we buy a forward deployed team?

Usually through a digital panel, as a professional service rather than labour hire, in short funded phases with a decision point at the end of each one.

How do we keep an AI decision defensible?

Keep the agent on reading, extracting and drafting, keep a person on the decision, make every extract point back to its source document and page, and keep the record of what the agent produced with the case file.

Our Forward Deployed AI Engineering page sets out how the teams work, and our Procurement Acceleration Agents page shows the read-and-draft pattern in a live government process.