Approach
Review, then design and build, then run and evolve
Three steps, each a complete piece of work. The way in is a fixed-fee review. After each step you decide whether to continue, and nothing auto-renews.
How it starts
The first call is 30 minutes. We ask what AI you run today, where it is heading and what worries you about it. If we are not the right fit, we say so. If we are, we scope the work and send a quote after the call.
The three steps
Step 1
Review
AI is becoming central, and nobody has the full picture.
We review the AI you run or plan to run: how each system is built, what it can reach, what it costs and who can change it. You get the findings against the three outcomes, and a plan.
Who it's for
- AI runs in several teams or products, each built its own way
- Nobody has the full picture of what runs where, what it can reach or what it costs
- Customers, auditors or regulators ask how your AI is controlled
- You face a build-or-buy or platform decision and want an independent view
How it runs
- Map: we walk through each system with your engineers: how it is built, what it can reach, what it costs and where the data goes.
- Assess: we hold each system against the three outcomes: under control, yours to own, accountable value.
- Plan: the gaps in priority order, and the target architecture they point to.
What you get
- A written review of what runs where, what it can reach and what it costs
- The gaps in priority order, with the reasoning behind each
- A target architecture, with the decisions behind it written down
- The rules and standards that apply to you (such as the EU AI Act, ISO/IEC 42001 and the NIST AI RMF) mapped to the architecture
How it ends
- Fixed fee, quoted after the first call.
- Ends with the written findings and a plan. The plan is yours, whether your own team carries it out or we do.
- Can continue into Design & build, under a separate quote.
Technical detail
Threat model (STRIDE for AI, attack trees), risk classification under the rules that apply (for example Article 6 of the EU AI Act), data flow mapping, cost per system, and architecture decision records with C4 diagrams where useful. Build-vs-buy and platform decisions with the trade-offs written down.
Step 2
Design & build
You know what to build, and it has to hold up.
We design the architecture and write the code with your engineers. Each agent can reach only what you decided, and a person approves the actions that matter. The controls, the measures and the handover are part of the build.
Who it's for
- Several teams need one foundation and one set of standards to build AI on
- Your agents are moving from answering questions to taking actions
- They need access to customer data, money or core business systems
- You serve several customers from one platform, and their data must stay apart
How it runs
- Design: one reference architecture with shared building blocks; which actions agents take on their own, which wait for a person, and what each agent can reach.
- Build: we write the code with your engineers, in your repository, in commits your team reviews.
- Test and measure: we test the agents for misuse and close what we find before launch, and set the evaluation baselines and cost measures the system is judged on.
- Hand over: documentation and runbooks, so your team can run and extend the system.
What you get
- The reference architecture and its decision records
- Working, reviewed code in your repository
- Permissions, approval steps and data separation built into the system
- Security test results, with the findings closed
- Evaluation baselines and cost measures, kept with the code
- Compliance evidence written alongside the code, for the rules and standards that apply to you
How it ends
- Fixed fee where the scope is defined, milestone-based where it is not yet. Quoted after the first call.
- Ends with handover to your team, or continues into Run & evolve.
Technical detail
Patterns for retrieval over company data, tool use, multi-agent orchestration and model serving in the cloud and at the edge. Per-tool permission scopes, human-in-the-loop approval policies, per-tenant data isolation and retrieval scoping, events API and authentication model. MCP for access to tools and data, A2A for agents working across systems. Agent security testing with Ziran and NVIDIA Garak. An evaluation suite with baseline results. MLOps and LLMOps standards.
Step 3
Run & evolve
Your AI is live, and the models, tools and needs keep changing.
We stay with your teams month to month. We review changes before they ship, keep the architecture and its controls current, re-test when something changes, and step in when something goes wrong.
Who it's for
- Your AI is in production and changes every month
- New teams, models and agents keep being added
- You want an architect to call when something goes wrong
- Your obligations under the rules that apply to you continue after launch
How it runs
- A monthly retainer, scoped to the systems and risks we agree on
- Review of architecture changes before they ship
- Security re-testing, and evaluation against the baselines, when agents, tools or models change
- We step in when an AI system fails or misbehaves
- Evidence for the rules and standards that apply to you kept up to date
What you get
- Architecture and decision records kept current
- A written review of each major change
- Incident reports when something goes wrong
- A quarterly governance review
How it ends
- 3-month minimum. Nothing auto-renews. Quoted after the first call.
- Continues for as long as it is useful to you, and ends with your team running the system.
Technical detail
Threat model updates, post-market monitoring and technical documentation where regulation requires them (for example Annex IV of the EU AI Act), re-testing of agents after tool or model changes, AI-specific incident response.
When we are not the right fit
If any of these apply, another firm will serve you better. We would rather say so on the first call.
- You want an exploratory pilot to find out what AI could do for you. We work on AI that is becoming central to how you operate or what you sell.
- You need extra engineers by the hour. We take on defined work with agreed outcomes, and we do not place staff.
- You want a strategy document with no build behind it. We design and build, and we stay until the work runs in your system.
- You want one vendor's stack resold and configured. We are independent of model vendors, clouds and platforms, and we design so the model can be swapped.
- Your engineers cannot work with us during the engagement. We design and build alongside your team. Without them, the work does not stick.
- You need penetration testing of systems that are not AI, such as networks, web apps or mobile apps. A dedicated pentest firm is the better choice.
- You need a certificate from an accredited body. We build the controls and prepare the evidence. The certificate itself comes from an accredited auditor.
- You need a legal reading of AI regulation. We turn the rules into design decisions. A law firm or your own legal team covers the legal interpretation.