How We Work
A delivery framework built for accountability
High-stakes AI work needs more than talent. It needs criteria, gates, and standards everyone agrees to before a line of code is written. This is ours.
Engagement criteria
When an embedded engagement works
Before we take an engagement, we confirm it can succeed. If these are not in place, we will tell you — and help you get there before we start.
- An executive sponsor with authority to make decisions and clear blockers.
- A bounded, high-value problem — not "do something with AI".
- A measurable success metric agreed before work starts.
- Access to the data, systems, and subject-matter experts the solution depends on.
- Security & compliance constraints identified up front, not discovered late.
- A team member who will own the solution after handover.
- Budget and timeline aligned to the scoped outcome.
Solution standards
What every solution we ship must do
These are non-negotiable. They are how we define 'done' and how you hold us to it.
- Solves a quantified business problem against a defined KPI or ROI target.
- Is production-grade: tested, observable, documented, and deployable.
- Has a defined evaluation method for AI quality, with human-in-the-loop where risk requires it.
- Is secure and compliant by design, inside the client's existing controls.
- Is maintainable by the client's team — no dependency on us to keep it running.
- Ships with full ownership transfer: code, infrastructure, docs, and IP.
The engagement framework
Six gated phases, your sign-off at every gate
You approve each gate before we move forward. No open-ended billing, no surprises about scope, security, or readiness.
Discovery & Fit
1–2 weeks
- Problem definition and measurable success criteria
- Data, systems, and security/compliance assessment
- Feasibility and risk review; go / no-go recommendation
- Scoped Statement of Work
Embed & Architect
1–2 weeks
- Engineer embeds: access, onboarding, environment, standups
- Technical discovery with your team and SMEs
- Solution architecture and evaluation strategy
- Risk, compliance, and security plan
Build
Iterative, 1–2 week sprints
- Working software delivered every sprint
- Demos and acceptance against explicit criteria
- Evaluation harness run on every increment
- Continuous documentation and code review with your team
Harden & Secure
1–2 weeks
- Security review and threat-model validation
- Compliance validation against agreed frameworks
- Load, failure, and AI-evaluation testing
- Runbooks, rollback plan, and monitoring
Deploy & Hand Off
1 week
- Production deployment with monitoring and alerting
- Documentation, architecture records, and runbooks delivered
- Knowledge-transfer sessions and pairing with your team
- Ownership transfer of code, infrastructure, and IP
Stabilize & Exit
Optional retainer
- Post-launch support window
- Metric validation against the original success criteria
- Transition to your team or scoped follow-on engagement
Approval & completion
The checklists we sign off against
Acceptance is explicit and written. These are the gates that protect both sides.
Increment acceptance
Run every sprint.
- Meets the agreed acceptance criteria for the increment
- Automated tests written and passing
- AI evaluation suite run; quality thresholds met
- Code reviewed by a client engineer
- No new critical or high security findings
- Documentation updated
Production readiness
Before any launch.
- Security review completed; findings remediated or accepted in writing
- Compliance requirements validated against agreed frameworks
- Secrets managed; least-privilege access enforced
- Observability: logging, metrics, alerting, and audit trail in place
- Evaluation gates and guardrails enforced in the pipeline
- Rollback and incident-response runbook tested
- Load and failure scenarios tested
- Data handling validated (classification, retention, PII)
Project completion
Before sign-off & exit.
- All contracted deliverables shipped and accepted
- Success metric measured and reported against the baseline
- Code, infrastructure, and documentation transferred to client ownership
- Knowledge transfer sessions completed with the owning team
- Runbooks, architecture decision records, and evals handed over
- Open risks and follow-on recommendations documented
- Sponsor sign-off recorded
Compliance
We work inside your compliance reality
We do not impose a framework on you. We design to the obligations you already carry and support the evidence your auditors need.
- SOC 2 control alignment and evidence support
- GDPR / CCPA data-handling and data-subject considerations
- HIPAA-aware design for engagements involving PHI
- ISO 27001 / NIST control alignment where applicable
- Data Processing Agreements and subprocessor transparency
- Data residency and retention requirements honored
- Audit logging for sensitive and AI-driven actions
How it works in practice
During Discovery we capture your regulatory and contractual obligations. During Architect we produce a compliance plan mapped to those obligations. We then validate against it in Harden & Secure before anything reaches production.
Specific certifications and attestations are scoped per engagement — ask us on a discovery call.
Security by design
Security is a phase gate, not an afterthought
The engineer operates inside your security policies from day one. Security work is threat-modeled at architecture and validated before launch.
Access & identity
- Least-privilege, scoped, time-bound credentials
- No standing production access; access through your IAM
- Engineers under NDA/MSA; background-checked
Data protection
- Data classification and minimization
- Encryption in transit and at rest
- No training on your data without explicit consent
- PII detection and redaction where required
AI-specific security
- Prompt-injection mitigation and input/output validation
- Guardrails and policy enforcement on model actions
- Human-in-the-loop for high-risk operations
- Eval-gated releases; model/provider risk assessed
Secure SDLC
- Code review and dependency / secret scanning
- Infrastructure-as-code and change control
- Threat modeling during architecture
- Monitoring, audit logs, and incident response
Want this framework applied to your problem?
Book a discovery call. We will walk your use case through the criteria and tell you honestly whether — and how — an embedded engagement gets it to production.