AI consultancy and engineering for real business systems

Production AI. Built on thirty years of engineering.

Put AI to work across your documents, applications and multi-step tasks. We engineer the context, tools, permissions and recovery around each workflow, then test the completed work.

AI engineering since 2023 Built on experience of identity, integration and recovery.

The work around the modelA defined request moves through approved evidence, a draft and human review to an authorised action. Independent checks control the action and a record is kept.
  1. A defined requestIdentity, purpose and permitted tools.
  2. Approved evidenceSources, versions and access rules.
  3. A draft to inspectSupporting passages and missing information.
  4. Human reviewApprove, amend or stop the proposed action.
  5. An authorised actionThe application checks permission and records the outcome.
Illustrative control flow. Each project needs its own data boundaries, approval points and completion checks.
Ways to begin

Practical AI. A clear scope.

Thirty years of engineering experience helps us spot the dependencies around an AI system, from identity and infrastructure to applications and recovery. Start with the workflow, its test evidence or the way it is operated.

01 / Automate the work

Document & workflow automation

Find information in approved documents, prepare records and reduce repeated handoffs, with people approving consequential changes.

Start with: one process, its inputs and agreed completion checks.

Explore workflow automation

02 / Test the change

AI evaluation & change assurance

Measure completed tasks, answer quality, tool use, response time and cost. Repeat the checks when models, instructions, data or integrations change.

Start with: a prototype or live workflow and a representative set of test cases.

Explore evaluation and assurance

03 / Operate the service

AI operations & governance

Define ownership, access, monitoring and change approval. Make it clear who responds to an incident and how interrupted work is handled.

Start with: a review of the service, its controls and operating responsibilities.

Explore operations and governance
Reference architecture

A governed agent, layer by layer.

How we structure an AI agent that works inside an organisation. Each layer has a job, an owner and a limit.

  1. People and requests

    Verify who or what initiated a request before granting access.

    • Teams
    • Email
    • Web
    • Voice
    How it fails
    A request arrives without a verified identity, so the agent cannot tell who it is acting for.
    How we control it
    Verify the initiating person or service through the channel’s authentication controls. Do not treat an email address or a spoken name as proof of identity.
  2. Agent runtime

    Planning, task state and model routing, with attributable identities and explicit authority.

    • Orchestration
    • Memory
    • Model routing
    How it fails
    Shared credentials and unscoped memory make actions hard to attribute and allow information to cross task boundaries.
    How we control it
    Give each deployed agent a named owner and attributable actions. Scope memory and tool authority to the task, and record model-routing decisions.
  3. Guardrails

    Policy is enforced outside the model. Consequential actions wait for a person.

    • Policy checks
    • Approvals
    • Evaluation
    How it fails
    Policy lives in the prompt, so a cleverly worded input can talk the model out of it.
    How we control it
    Policy is enforced by code outside the model, and consequential actions wait for a person to approve them.
  4. Tools

    Each tool gets the narrowest credential that works.

    • MCP servers
    • APIs
    • Computer use
    How it fails
    A tool holds a broad credential, so one manipulated call can reach far beyond the task.
    How we control it
    Scope each tool’s credentials and validate requests before execution. Check the resource, operation and authority required for the action.
  5. Enterprise systems

    Delegated and application access have explicit limits.

    • Microsoft 365
    • Line of business apps
    • Databases
    How it fails
    Delegated access and application access are confused, so the agent receives authority the task does not need.
    How we control it
    Delegated calls stay within the signed-in person’s access and the app’s scopes. Application calls use a separately authorised identity, scoped to the resources and operations the task needs.
  6. Evidence

    Keep a record of the request, actions and result.

    • Audit trail
    • Traces
    • Cost and quality metrics
    How it fails
    Something goes wrong and there is no record of what the agent saw, decided or did.
    How we control it
    Trace the request, retrieved sources, tool calls, cost and result. Apply access and retention controls to the logs, and avoid collecting unnecessary sensitive content.
Reference architecture. Components and controls are selected for the workflow, its risks and the systems in scope.

Read the note: Least privilege for AI agents

The first step

Start with a review you can act on.

Bring a document process, a workflow or an AI system you want to improve. We agree the review boundary and the evidence needed to decide the next step.

What you get. A defined scope, prioritised risks and a practical plan for integration, testing and operation.

Talk to an engineer