The opportunity at a glance
IBIS Technology wanted to explore how AI could give tourism businesses easier, more secure ways to access and interact with the data held across its platform. Arinco helped define the architecture, security and development practices needed to move promising use cases beyond early experimentation. Over six weeks, the engagement accelerated IBIS’s understanding of the AI landscape, and established a governed foundation for progressing customer-facing AI capabilities, including conversational reporting through the IBIS Insights application.
About IBIS Technology
IBIS Technology is a Queenstown-based tourism software specialist that has been developing reservation technology for the New Zealand tourism industry since 1995. Its software supports a wide range of tourism and leisure businesses, including activity operators, attractions, tour operators and transport providers, helping them manage bookings, ticketing, payments and day-to-day operations. Today, IBIS supports around 120 tourism customers across New Zealand and Australia.
Business challenge
IBIS’s customers were looking for new ways to use technology to improve their tourism operations and profitability. Dynamic pricing was one opportunity that first prompted IBIS to explore AI, with several customers actively seeking the capability.
While dynamic pricing is well established in industries such as aviation and accommodation, it is less common among activity, attraction and transport operators.
Early proofs of concept helped IBIS explore the opportunity but also revealed that developing a reliable dynamic pricing capability would be complex and costly. IBIS had limited capacity to independently assess the growing number of AI technologies, implementation pathways and security requirements. The team estimated that establishing the necessary understanding and governance on its own could take up to a year.
The IBIS team was also exploring ways for tourism operators to generate dashboards or have natural conversations with agents about their operational data. Other potential use cases included interpreting reservation emails and reconciling information from online travel agents.
Moving beyond early experimentation required IBIS to enable different tourism businesses to use AI-enabled services while keeping each customer’s data secure, separate and governed.
IBIS needed specialist support to establish a repeatable approach that could verify users, control which data and capabilities they could access and scale securely as new services were introduced.
Solution
IBIS engaged Arinco to progress its customer-facing AI opportunities without compromising the security and governance of data held across its platform. Over six weeks, Arinco worked with IBIS’s leadership and development teams to assess the existing environment, explore practical use cases and translate its vision into a secure target-state architecture.
The engagement combined strategic guidance with hands-on development, including proofs of concept, implementation patterns and recommendations covering customer access, platform security and AI-assisted software development.
Exploring practical AI use cases
Arinco worked with IBIS to assess AI use cases that could deliver practical value to tourism operators. Initial proofs of concept explored dynamic pricing using historical bookings, demand, capacity and weather. Given its complexity, reporting and analysis became the more immediate priority.
Arinco helped progress the IBIS Insights application, designed to let authorised customers interact with their data through conversational agents. Arinco also developed a proof of concept for interpreting reservation emails, while IBIS identified further opportunities involving information from online travel agents.
Enabling and validating secure customer access
Arinco designed an architecture that enables IBIS to make selected data and capabilities available to AI agents while maintaining control over access. It uses Microsoft Entra ID for authentication and Azure API Management as the controlled entry point.
A Model Context Protocol (MCP) server allows agents to connect securely with external data, tools and systems, including through potential Microsoft 365 Copilot experiences. Identity claims or group membership determine which databases, datasets and tools each user can access, giving IBIS a consistent approach across different customer environments.
Arinco also documented a repeatable pattern for connecting the MCP server to Copilot Studio through Azure API Management using OAuth 2.0 and Microsoft Entra ID authentication.
To validate the security structure, IBIS worked with a key existing customer which operates nine tourism businesses. Its IT and business services teams reviewed the architecture before participating in the beta process. This helped IBIS confirm that the identity, access and security controls worked as expected within a corporate customer environment.
Building a foundation that can grow with IBIS
As IBIS expands its use of AI, Arinco designed a broader platform foundation using managed identities, private networking, secure endpoints, network security groups, Azure Key Vault and API gateway policies. This applied zero trust and least privilege principles while reducing reliance on secrets, keys and firewall-based controls.
Arinco also provided guidance for logging, monitoring and infrastructure as code to strengthen governance and support more consistent platform management. The architecture considered future Azure AI Foundry workloads, giving IBIS a secure foundation for additional AI and agentic use cases.
Creating a consistent approach to AI-assisted development
Alongside the customer-facing architecture, Arinco reviewed how IBIS could use AI to improve its internal software development practices.
Arinco recommended GitHub Copilot Business as a centrally governed approach to AI-assisted development, supported by repository governance, pull request controls, CodeQL, Dependabot, secret scanning and secure development practices.
A phased adoption roadmap showed how IBIS could use AI assistance across unit testing, code review, documentation, refactoring and code improvement while maintaining human oversight and governance.
Outcomes
The engagement gave IBIS a clearer and more governable pathway from early AI experimentation towards secure agentic capabilities. It connected architecture, identity, security and software engineering into a practical foundation the company can continue to build on. Key outcomes included:
- Accelerated AI capability: IBIS achieved in six weeks work that its team estimated could have taken six months to a year to understand and establish independently.
- Potential reach across 120 customers: Established foundations for AI capabilities that could support tourism operators across New Zealand and Australia.
- Conversational access to data: Progressed IBIS Insights towards giving authorised customers a conversational way to interact with their operational data.
- Customer-informed security: Tested the proposed identity, access and security structure through a beta process with an established corporate tourism customer.
- Practical proofs of concept: Explored AI applications across dynamic pricing, reservation emails and the reconciliation of information received from online travel agents.
- Greater control over customer access: The proposed identity and API patterns give IBIS a consistent way to determine who can access specific data and capabilities as new AI experiences are introduced.
- A repeatable foundation for new use cases: The architecture provides patterns IBIS can reuse as it explores additional AI agents, integrations and customer experiences.
- Reduced reliance on manually managed credentials: The roadmap gives IBIS a pathway towards managed identities and least-privilege access, reducing dependence on secrets and keys.
- Governed AI adoption: IBIS has a structured approach for introducing GitHub Copilot Business alongside repository controls, security scanning and human oversight.
What's next
IBIS is preparing to move the reporting and conversational data capability within IBIS Insights from beta into production. This will give authorised customers a secure way to connect to and interrogate their data through an MCP server or agent.
IBIS also plans to progress other use cases, including dynamic pricing and opportunities to simplify reservation management and external booking processes.
Future work includes further proofs of concept in Azure AI Foundry, continued development of the MCP architecture and adoption of managed identities. IBIS also plans to explore GitHub Copilot agents for code review and unit testing as it develops a more consistent approach to AI-assisted software engineering.
