Custom engineering
AI agent development & AI governance
AI agents with human approval
Agents that do real work across your systems, from triage and drafting to reconciliation and follow-up, and stop for a person to approve anything that matters.
What we deliver
- Agents for customer service, finance operations, claims, onboarding and internal requests
- Approval steps before an agent sends, pays, posts or changes a record
- Scoped access to your APIs, ERP, CRM and ticketing systems
- Models from OpenAI, Anthropic, Google or open-weight providers, run in your own cloud account where your data requires it
- Hand-off to a person whenever the agent is unsure
Compliance built in
- Every agent run traced: inputs, tools called, outputs and who approved
- Least-privilege credentials per agent, never a shared admin key
- A kill switch and rollback plan for every workflow
Retrieval over private content
Answers grounded in your own policies, contracts, tickets and records, with citations so people can check them.
What we deliver
- Search and question answering over SharePoint, Google Drive, Confluence, ticketing systems and databases
- Retrieval-augmented generation (RAG) combining vector and keyword search, tuned to your content
- Permission-aware retrieval that respects existing document access
- Indexing pipelines that keep answers in step with the latest versions
Compliance built in
- People retrieve only what they could already open
- Sensitive data classified, and masked before indexing where required
- Retention and deletion honored in the index, not just the source
Document AI
Pull structured data out of invoices, claims, contracts and forms, and route anything uncertain to a person.
What we deliver
- Extraction from invoices, receipts, claims, referrals, identity documents and contracts
- Classification and validation against business rules and ERP or CRM records
- Review queues for low-confidence fields
- Posting to finance, claims or case systems after approval
Compliance built in
- Personal and health data handled in line with HIPAA and GDPR
- We sign a Business Associate Agreement for engagements that involve protected health information
- Source document, extracted values and reviewer decisions linked for audit review
Evaluation, tracing & red-team testing
Know how an agent behaves before your customers find out, and keep checking after every model, prompt or tool change.
What we deliver
- Evaluation sets built from your real cases, scored for accuracy, grounding and policy
- Tracing of every step an agent takes, for debugging and review
- Red-team testing for prompt injection, data leakage, jailbreaks and unsafe tool use
- Regression checks in the release pipeline when models, prompts or tools change
Compliance built in
- Layered defenses against prompt injection: input screening, tool allow-lists and output checks
- Evaluation results kept as evidence your auditor or risk team can review
- Model and prompt versions recorded for each release
Tool & connector security
An agent is only as safe as the tools it can call. We lock down every connector, including Model Context Protocol (MCP) servers.
What we deliver
- Inventory and review of the tools, plugins and MCP servers your agents and staff use
- Internal MCP servers with authentication, scoped permissions and rate limits
- Allow-lists for tools and destinations, read-only by default
- Secrets in a vault and short-lived tokens, never credentials in prompts
Compliance built in
- Third-party connectors reviewed through your vendor-risk process
- Tool calls logged with the user and agent behind them
- Outbound traffic limited to approved destinations
LLM gateway, model routing & cost control
One controlled entry point for every model call, so you can switch providers, send each task to the right model and see what AI actually costs.
What we deliver
- A large language model (LLM) gateway with authentication, rate limits and quotas per team or product
- Model routing by task, cost and data sensitivity
- Caching, prompt tuning and batch processing to reduce spend
- Cost dashboards by team, feature and customer
Compliance built in
- Sensitive data redacted before prompts leave your environment
- An approved-model list with region controls for data residency
- Central logs of model usage for review
AI governance
A practical governance program that lets teams ship AI while giving boards, customers and regulators clear answers.
What we deliver
- AI use-case inventory, risk tiering and an intake process
- Acceptable-use, data-use and model procurement policies
- Alignment with the NIST AI Risk Management Framework (AI RMF), ISO/IEC 42001 and the EU AI Act
- Tracking of US state AI laws that apply to your use cases
- Model cards, impact assessments and answers for customer AI questionnaires
Compliance built in
- Control matrix covering data, model, vendor and change risk
- Human oversight defined for each high-risk use case
- Documentation organized for ISO/IEC 42001 certification readiness
Legacy automation (RPA)
Where a system has no API, robotic process automation (RPA) can bridge the gap. We use it only there, and plan for its retirement.
What we deliver
- Screen-based automation of legacy systems with UiPath, Power Automate or similar tools
- Bots exposed to agents as tools, behind the same approval steps
- Exception handling and monitoring for every bot
- A roadmap to replace bots with APIs as systems modernize
Compliance built in
- Each bot has its own least-privilege account
- Every bot run logged and reviewable
How we engage
Outcomes
AI people trust
Answers cite their sources and actions wait for approval, so teams use the tools instead of working around them.
Answers for security reviews
Clear records of models, data flows and controls for customer questionnaires, auditors and regulators.
Costs you can see
Every model call runs through one gateway, with spend visible by team and feature.
Freedom to switch models
Routing and evaluation let you change providers without rebuilding what works.
Typical deliverables
- Use-case assessment with risk tiering and a data readiness review
- Target architecture: models, retrieval, tools, gateway and approval steps
- Evaluation sets, red-team findings and a remediation plan
- Tracing and monitoring dashboards
- Control matrix and AI policies aligned with NIST AI RMF and ISO/IEC 42001
- Model cards, data flow diagrams, and runbooks for review, incidents and rollback
Engagement model
- Assess
Pick the right use cases
A fixed-scope review of your use cases, data and risks. Discovery typically takes 1–2 weeks and ends with a shortlist and an architecture.
- Build
Deliver in phased releases
A first working agent or retrieval tool typically within 6–10 weeks, tested on your own cases, then further use cases in phased releases.
- Run
Monitor and improve
Ongoing monitoring, evaluation reruns when models change, cost reviews and improvements after go-live.
Example use cases
- A startup preparing answers for the AI section of an enterprise customer's security questionnaire
- A SaaS company adding an in-product agent with MCP-based tool access and per-customer data isolation
- A mid-sized distributor matching supplier invoices in Business Central with document AI, approved before posting
- A clinic group summarizing referrals and prior authorizations under a Business Associate Agreement
- A bank placing an LLM gateway in front of every team's model usage, with redaction and cost reporting
- An enterprise building an AI governance program aligned with ISO/IEC 42001 and the EU AI Act
Insights
Related insights
Compliance AI
A2P 10DLC registration, explained for business owners
A2P 10DLC registration in plain English for small business owners: what it is, why texts get blocked without it, the steps, the fees and how long it takes.
Small business owners · 6 min read
Published September 29, 2026Compliance AI
Compliant by design: what it means for a 10-person business
Compliant by design, explained for a small business: where the idea comes from, what it means day to day, a one-page checklist, and what it doesn't mean.
Small business owners · 5 min read
Published September 29, 2026Compliance AI
Safe AI for small business: a person approves every action
Safe AI for small businesses: what can go wrong when AI acts alone, which actions need a person's approval, and what to ask before you switch it on.
Small business owners · 5 min read
Published September 29, 2026
Have an AI use case in mind?
Tell us the process and the data involved. We'll help you decide whether an agent fits, and what it would take to run it safely.