Build it
Production AI systems built by people who spend the rest of their time attacking them. Evaluation harnesses, retrieval pipelines, agent orchestration, and the serving infrastructure underneath — designed so the security review and the invoice both hold up later.
Engagements from £16,000. Or start with a Exposure Review from £4,500.
Scoped as fixed-window work with a written deliverable. No retainers you cannot exit, no findings held back for a follow-on sale.
2–4 weeks · build
The thing most teams skip and later wish they had not. A test suite for behaviour: task-level success criteria, regression cases drawn from real failures, and adversarial cases from the security practice. Run in CI, with results that move when the model, the prompt, or the retrieval corpus changes — so a swap can be evaluated instead of guessed at.
4–8 weeks · build
Ingestion, chunking, embedding, and ranking built with authorization as a first-class concern rather than a later retrofit. Per-tenant isolation enforced at query time, access changes in the source system reflected in the index, and evaluation of retrieval quality independent of generation quality — because when answers are wrong, it matters which half failed.
5–10 weeks · build
Systems where the model calls tools and the calls have consequences. Least-privilege tool design, deterministic guardrails outside the model rather than inside the prompt, idempotency and replay safety on every side-effecting action, and observability that captures the reasoning trace alongside the API calls it produced.
3–6 weeks · build or review
Serving architecture with unit economics as a design constraint: batching strategy, caching at the semantic and exact layers, quantization trade-offs measured against your evaluation set rather than a public benchmark, and routing between model tiers so the expensive one handles only what needs it.
Principle
A great deal of AI work is shipped on vibes: someone tries a dozen prompts, the outputs look reasonable, and it goes live. Then the model version changes, or the corpus grows, or a user phrases something unusually, and there is no way to tell whether the system got worse because there was never a measurement.
Every build engagement starts with the evaluation harness — not because it is glamorous, but because it is the only thing that makes every subsequent decision checkable. It is also what turns a security finding into a regression test instead of a memo.
Anything enforced only by instructions in the prompt is a request, not a control.
The index enforces the caller’s permissions, not the ingestion job’s.
An agent that retries must not double-charge, double-send, or double-delete.
Model choice is a configuration decision with a measurable answer, not a rewrite.