NIST AI RMF
Internal risk-management methodology
Govern, Map, Measure, Manage — the operating model most US programmes expect.
Capability
From model to product.
Retrieval, agents and evaluation engineered into software people actually operate — with the governance evidence your risk function is going to ask for.
An AI feature is a systems problem wearing a model's clothes. Retrieval quality, latency budget, token economics, what happens when the model is wrong, and an evaluation harness that tells you whether last week's change helped — that is where projects succeed or quietly fail.
Commercial SaaS
Ship AI features your customers trust and your competitors cannot copy in a sprint.
The hard part of an AI feature is rarely the model call. It is retrieval quality, latency budget, token economics, graceful degradation when the model is wrong, and an evaluation harness that tells you whether last week's prompt change made the product better or worse.
What we deliver
- AI feature discovery and proof-of-value
- RAG architecture: embeddings, hybrid retrieval, re-ranking
- Eval harness and prompt regression suite in CI
- Model routing, fallback chains and cost controls
- Agentic UX patterns for copilots and multi-step flows
Internal Corporate Systems
Automate the work your staff actually do, without losing the audit trail.
Internal AI fails on sprawl: several RAG stacks, several model providers, overlapping copilots and no shared guardrails. We consolidate onto one governed platform, with identity, permissions and logging inherited from the systems you already run.
What we deliver
- Integration with existing identity, RBAC and data boundaries
- Consolidation of duplicated RAG and copilot stacks
- Guardrails: input/output filtering, groundedness checks
- Human review queues for consequential actions
- Observability and tracing across the agent path
Government & Defence
Accessible, accountable systems that can pass the assessment they will face.
Public-sector delivery is a control problem before it is a design problem. We design to the impact level a programme is authorised at, produce the evidence continuously rather than at assessment time, and meet Section 508 and WCAG 2.2 AA as a floor rather than a remediation project.
What we deliver
- Design to FedRAMP Low / Moderate / High baselines
- DoD Cloud SRG impact-level aware architecture (IL2–IL6)
- CMMC 2.0 readiness for Levels 1, 2 and 3
- Section 508 and WCAG 2.2 AA conformance
- Continuous control evidence and system documentation
Governance is the deliverable, not the paperwork
ISO/IEC 42001
Certifiable AI management system
The auditable management-system standard, the AI analogue of ISO 27001.
EU AI Act
Mandatory obligations, full enforcement in 2026
Risk-tiered duties on providers, deployers, importers, distributors and manufacturers whose systems reach the EU.
Singapore MGF for Agentic AI
The first governance model written for agents
Published 22 January 2026 at the World Economic Forum: autonomy-level assessment, human accountability structures, risk-bounding by design.
The gap we work in
NIST AI RMF, ISO/IEC 42001 and the EU AI Act contain no reference to "agent" or "agentic". Governance written for static models under-covers systems that act on their own — reading mail, filing contracts, provisioning infrastructure, escalating incidents. Closing that gap is design work, and it is the work we do.
The vocabulary we work in
Published in full, because the fastest way to tell a specialist from a generalist is to ask which of these they have actually shipped.
Retrieval & context
- Retrieval-augmented generation (RAG)
- Embeddings and vector search
- Hybrid retrieval
- Re-ranking
- Chunking strategy
- Context engineering
- Citation fidelity
- Groundedness
Agents & orchestration
- Agentic workflows
- Tool use and function calling
- Model Context Protocol (MCP)
- Multi-agent systems
- Bounded autonomy
- Model routing
- Fallback chains
- Human-in-the-loop (HITL)
Quality & reliability
- Eval harness
- Golden datasets
- LLM-as-judge
- Prompt regression suites
- Hallucination rate
- Drift detection
- Shadow deployment
- Observability and tracing
Governance
- NIST AI RMF
- ISO/IEC 42001
- EU AI Act
- Model and system cards
- AI bill of materials (AI BOM)
- Data lineage
- Red-teaming
- Model registry
Have a system in mind?
We will come to the first meeting with a point of view, not a capabilities deck.