Agents, RAG pipelines, MCP servers and evals. I write the code, in your repo, and your team maintains it afterwards.
What I work on
Five areas. Sometimes I build the thing, sometimes I go through what you already have and tell you what will break, sometimes I work alongside your team for a while. If you are not sure which one you need, start with what is actually happening.
What's happening right now?
Tick anything you recognise. The list below reorders as you go.
Nothing ticked yet — everything below is in its usual order.
What that points to
Prompt injection, agent permission boundaries, tool-call blast radius and data leakage — the failure modes classical AppSec misses.
Service boundaries, event-driven architecture, database and latency work, multi-region AWS. Done from inside your team.
Multi-tenant isolation, IAM, zero-trust access, secure pipeline, and the questionnaire your enterprise deal is waiting on.
Model inventory, risk classification and EU AI Act readiness, sized so your engineers still follow it after I leave.
How it starts
- A call, thirty minutes. You describe the problem, I tell you honestly whether I am the right person for it.
- If I am, I write down what I will do, what you get, and what it costs. Before anything starts.
- We start, usually within a couple of weeks.
No pitch deck, no discovery phase you pay for. Tell me what you are working on.