Skip to content

Production systems, not proofs of concept

Your company already knows the answer. Now your assistants do too.

Most answers your people need are already in your systems, split across tickets, code and spreadsheets. We build a knowledge graph from them and serve it through one MCP server to Copilot, ChatGPT, Claude and Gemini. Every answer cites its sources, every change waits for a person, and it all runs in your cloud.

Book a Technical Briefing Try it with your systems
  • Copilot · ChatGPT · Claude · Gemini
  • Every answer cited to its source
  • Your cloud · your sign-in · yours to keep
Fig. 1 A governed run · example
Agent session · inside your VPClive

Which accounts slipped last quarter, and why?

  1. Classified as a new task84 ms
  2. 14 personal details → placeholders112 ms
  3. Found 7 relevant tables of 50,2141.9 s
  4. Read 1,284 rows, kept in your VPC [1]3.4 s
Wants to update 12 CRM records − stage: "Commit" ×12 + stage: "At risk" ×12
Waiting for you
written without approval · 0
Fig. 1A real run, compressed: it works on its own until it would change something, then it waits for you.
Citations

100%

Answers that cite the ticket, file or commit behind them

Delivery

6–12 wk

Weeks from the first review to a production system you own

Report

90 s

From one sentence to a finished Power BI report, at most

Egress

0 bytes

Bytes of customer data leaving the customer VPC

Runs where your data lives
  • PostgreSQL
  • Snowflake
  • Databricks
  • BigQuery
  • Azure SQL
  • Power BI
  • Azure DevOps
  • Amazon Bedrock
  • Vertex AI
  • Microsoft Teams
  • Okta
Sound familiar

The question your team asked this morning.

It crosses three systems, so nobody can answer it alone. With your graph, the same question gets one answer, in the assistant your people already use, with every source attached.

Today

team chat

    With your graph

    Software teams

    1. Is the fix for Northwind’s failed payments shipping this week?

      Yes. Northwind’s escalation ESC-881 is linked to PAY-2231, and pull request #4120 closes it 123. It is merged into payments-svc and goes out in Thursday’s release. Northwind’s renewal is open for FY27, so their account team will want to know 4.

      1. ZendeskESC-881escalation from Northwind · opened 4 Nov
      2. JiraPAY-2231retry limit on failed payments
      3. GitHubpayments-svc #4120merged 6 Nov · ships Thursday
      4. SalesforceNorthwind · Renewal FY27open · closes Q1
    1. Dana Northwind escalated again about failed payments. Is the retry fix going out this week?
    2. Sam Not sure which ticket that is. Priya wrote the retry code, maybe ask her?
    3. Priya I moved teams in the spring. Try PAY-2231? No idea if it’s merged.
    4. Dana PAY-2231 doesn’t mention Northwind. Does anyone know who owns the Zendesk side?

    4 messages · 3 people · 5½ hours · still open

    Banks & insurers

    1. Which systems hold customer account numbers, and who can read them?

      Three places: LOANS.CUSTOMER, CRM.EXPORT, and the Account_No__c field in Salesforce, which feeds CRM.EXPORT every night 12. loan-ops-read can query LOANS.CUSTOMER, certified under CTL-118 in October 34. fin-analysts can query CRM.EXPORT, and no control covers that group yet 5.

      1. SnowflakeLOANS.CUSTOMERcolumn account_no
      2. SalesforceClient · Account_No__cexported nightly to CRM.EXPORT
      3. Entra IDloan-ops-read34 members
      4. ServiceNowCTL-118access certification · passed 2 Oct
      5. Entra IDfin-analysts9 members · no certifying control
    1. Morgan Audit wants every system that holds customer account numbers, and who can read them. By Friday.
    2. Alex The loans warehouse for sure. Maybe the CRM export too? The data catalogue is from last year.
    3. Jo Access is in Entra, but the groups don’t say which tables they cover.
    4. Morgan So we are building the spreadsheet again.

    4 messages · 3 people · 5½ hours · spreadsheet started

    Health systems

    1. Which systems hold PHI, and can Fabrikam’s support staff reach them?

      Scheduling holds PHI: it writes APPOINTMENTS and reads ENCOUNTERS 12. Fabrikam’s support staff are in vendor-support, which can reach Scheduling today 34. Nothing gives that group ENCOUNTERS directly.

      1. ServiceNowSchedulingapplication · holds PHI
      2. SnowflakeAPPOINTMENTS, ENCOUNTERStables it writes and reads
      3. Entra IDvendor-support12 members · can reach Scheduling
      4. ServiceNowFabrikamvendor record · support contract
    1. Rae Fabrikam wants remote access for their support team. Which of our systems hold PHI that they could reach?
    2. Chris Scheduling for sure. The CMDB should list the rest, but nobody has updated the PHI flags in a while.
    3. Lee Their group is already in Entra, I think? Not sure what it is scoped to.
    4. Rae I’ll set up a meeting.

    4 messages · 3 people · 5½ hours · meeting booked

    Revenue & data teams

    1. Why does the board pack show Net revenue down 3% when finance says it is flat?

      The definition changed. Net revenue in the board pack comes from net_revenue.sql 12, and pull request #212 started subtracting FIN.CREDITS on 3 October 3. Finance’s figure still uses invoices only, so the 3% gap is the credit notes 4.

      1. Power BIBoard pack Q3 · Net revenuemeasure on page 2
      2. GitHubnet_revenue.sqlsemantic model source
      3. GitHub#212merged 3 Oct · subtracts credits
      4. SnowflakeFIN.CREDITSQ3 credit notes
    1. Maya The board pack says Net revenue is down 3%, but finance says it is flat. Which one is right?
    2. Theo Different definitions, probably. The Power BI measure changed at some point.
    3. Sana I think someone changed the credit-note logic in the SQL? Not sure when.
    4. Maya Can we get on a call before the board meeting?

    4 messages · 3 people · 5½ hours · call booked

    Your graph

    Your systems, answering your questions.

    Pick who you are. The graph assembles from the systems a team like yours runs, and answers in the assistant your people already use, under each person's own sign-in.

    Who you are
    What you run on

    Blue lines join records across systems. No single system holds them today.

    Ask in

      Your first graph, read-only, in your cloud account.

      Four weeks, $35,000 fixed, answering in the assistants your team already uses. Credited in full if you go on to build.

      Scope this graph with us

      Software teams

      • Jira EPIC Checkout v2 TICKET PAY-2231
      • GitHub PULL REQUEST #4120 SERVICE payments-svc
      • Confluence RUNBOOK Failover guide PAGE API limits
      • Zendesk ESCALATION ESC-881 ORGANIZATION Northwind
      • Salesforce ACCOUNT Northwind OPPORTUNITY Renewal FY27
      • contains
      • merged into
      • from
      • for
      • linked to
      • closes
      • documents
      • documents
      • same customer

      1. Is the fix for Northwind’s failed payments shipping this week?

        Yes. Northwind’s escalation ESC-881 is linked to PAY-2231, and pull request #4120 closes it 123. It is merged into payments-svc and goes out in Thursday’s release. Northwind’s renewal is open for FY27, so their account team will want to know 4.

        1. ZendeskESC-881escalation from Northwind · opened 4 Nov
        2. JiraPAY-2231retry limit on failed payments
        3. GitHubpayments-svc #4120merged 6 Nov · ships Thursday
        4. SalesforceNorthwind · Renewal FY27open · closes Q1

      2. Who owns payments-svc, and is its failover runbook current?

        team-payments owns payments-svc 1. The failover runbook was last edited before pull request #4120 changed the retry limit, so it still describes the old behaviour 23.

        1. GitHubCODEOWNERSpayments-svc → team-payments
        2. ConfluenceFailover guidelast edited 21 Oct
        3. GitHubpayments-svc #4120merged 6 Nov

      3. What is still open in Checkout v2?

        Three of its 14 tickets are open 1. PAY-2231 already has a merged pull request and closes with Thursday’s release 2. The other two have no code yet.

        1. JiraCheckout v214 tickets · 11 closed
        2. GitHubpayments-svc #4120closes PAY-2231

      Banks & insurers

      • SharePoint POLICY Retention 4.2 PROCEDURE Access review
      • ServiceNow CONTROL CTL-118 CHANGE CHG-30412
      • Salesforce OBJECT Client FIELD Account_No__c
      • Snowflake TABLE LOANS.CUSTOMER TABLE CRM.EXPORT
      • Entra ID GROUP loan-ops-read GROUP fin-analysts
      • covers
      • tests
      • certifies
      • can read
      • can read
      • changed
      • exported to
      • on

      1. Which systems hold customer account numbers, and who can read them?

        Three places: LOANS.CUSTOMER, CRM.EXPORT, and the Account_No__c field in Salesforce, which feeds CRM.EXPORT every night 12. loan-ops-read can query LOANS.CUSTOMER, certified under CTL-118 in October 34. fin-analysts can query CRM.EXPORT, and no control covers that group yet 5.

        1. SnowflakeLOANS.CUSTOMERcolumn account_no
        2. SalesforceClient · Account_No__cexported nightly to CRM.EXPORT
        3. Entra IDloan-ops-read34 members
        4. ServiceNowCTL-118access certification · passed 2 Oct
        5. Entra IDfin-analysts9 members · no certifying control

      2. Which controls cover retention policy 4.2, and when were they last tested?

        CTL-118 covers it 12. Its last test was the quarterly access review on 2 October, and it passed 3.

        1. SharePointRetention policy 4.2records and access
        2. ServiceNowCTL-118control · owner: data governance
        3. SharePointAccess review procedurerun quarterly · last 2 Oct

      3. What changed in LOANS.CUSTOMER this quarter, and who approved it?

        One change: CHG-30412 added a column to LOANS.CUSTOMER 12. The change advisory board approved it on 14 October.

        1. ServiceNowCHG-30412standard change · approved 14 Oct
        2. SnowflakeLOANS.CUSTOMERcolumn added: risk_band

      Health systems

      • SharePoint POLICY Remote access SOP Vendor intake
      • ServiceNow APPLICATION Scheduling VENDOR Fabrikam
      • Entra ID GROUP vendor-support GROUP sched-admins
      • Workday TRAINING Privacy 2026 DEPARTMENT Radiology
      • Snowflake TABLE APPOINTMENTS TABLE ENCOUNTERS
      • writes
      • reads
      • can reach
      • administers
      • staff in
      • applies to
      • requires
      • requires
      • assigned to

      1. Which systems hold PHI, and can Fabrikam’s support staff reach them?

        Scheduling holds PHI: it writes APPOINTMENTS and reads ENCOUNTERS 12. Fabrikam’s support staff are in vendor-support, which can reach Scheduling today 34. Nothing gives that group ENCOUNTERS directly.

        1. ServiceNowSchedulingapplication · holds PHI
        2. SnowflakeAPPOINTMENTS, ENCOUNTERStables it writes and reads
        3. Entra IDvendor-support12 members · can reach Scheduling
        4. ServiceNowFabrikamvendor record · support contract

      2. What does Fabrikam have to sign before it gets access?

        The vendor intake SOP applies to Fabrikam, and it requires sign-off under section 3.1 of the remote access policy 12. Intake is open in ServiceNow, and the policy sign-off is not on file yet 3.

        1. SharePointVendor intake SOPnew vendors with system access
        2. SharePointRemote access policysection 3.1 · vendor sign-off
        3. ServiceNowFabrikamintake task open

      3. Which departments still owe the 2026 privacy training?

        Radiology, with 6 people outstanding. It is the only department past the due date 1. The remote access policy requires the training before anyone gets vendor-facing access 2.

        1. WorkdayPrivacy 2026all staff · due 31 Oct
        2. SharePointRemote access policysection 3.4 · training required

      Revenue & data teams

      • HubSpot CAMPAIGN Q3 webinar LIST Attendees
      • Salesforce ACCOUNT Northwind OPPORTUNITY Renewal FY27
      • Power BI REPORT Board pack Q3 MEASURE Net revenue
      • Snowflake TABLE FIN.INVOICES TABLE FIN.CREDITS
      • GitHub MODEL net_revenue.sql PULL REQUEST #212
      • registered
      • includes
      • for
      • billed in
      • credited in
      • shows
      • defined in
      • reads
      • subtracts
      • changed

      1. Why does the board pack show Net revenue down 3% when finance says it is flat?

        The definition changed. Net revenue in the board pack comes from net_revenue.sql 12, and pull request #212 started subtracting FIN.CREDITS on 3 October 3. Finance’s figure still uses invoices only, so the 3% gap is the credit notes 4.

        1. Power BIBoard pack Q3 · Net revenuemeasure on page 2
        2. GitHubnet_revenue.sqlsemantic model source
        3. GitHub#212merged 3 Oct · subtracts credits
        4. SnowflakeFIN.CREDITSQ3 credit notes

      2. Which Q3 webinar attendees are now in open deals?

        Two attendees work at Northwind, and both are contacts on the open Renewal FY27 opportunity 12.

        1. HubSpotQ3 webinar · Attendees2 from Northwind
        2. SalesforceNorthwind · Renewal FY27open · 2 contacts attended

      3. How much has Northwind been billed this year, net of credits?

        $412,000 across 9 invoices, less one $18,000 credit note, so $394,000 net 123.

        1. SalesforceNorthwindaccount · billing ID NW-0042
        2. SnowflakeFIN.INVOICES9 invoices in 2026
        3. SnowflakeFIN.CREDITS1 credit note · August
      What changes

      What changes when the answer is one question away.

      Four places the working week goes today, each sized by published research, and what your graph changes in each.

      Number Where the time goes Today · published research With your graph
      I. Finding an answer Leaders and teams spend a quarter of their time searching for answers.Atlassian · State of Teams 2025 One answer, with its sources, in the assistant your people already use.
      II. Waiting on whoever knows 42% of what people know about their role is not shared with any coworker.Panopto · 2018 Questions your systems can answer stop queuing for the person who knows.
      III. Changing a live system IT and network outages rose to 23% of impactful outages in 2024, a rise Uptime links to change management.Uptime Institute · 2025 Who reads a setting, what sets it and which tests touch it, known before the change ships.
      IV. Proving a control works Average testing time per SOX control rose from 12 hours in FY2022 to 16 in FY2024.KPMG · SOX survey Which control covers a policy, when it was last tested and the result, each cited to its record.
      Published evidence that a graph changes the result: at LinkedIn, a knowledge graph built from past support tickets cut median resolution time by 28.6% over six months in production. Read the paper
      Solutions

      Our solutions, shown working.

      Every assistant your people already use learns your systems from one knowledge graph. Policies, contracts and manuals answer in a sentence, with the page attached. Agents qualify accounts, price deals and update your CRM. One sentence becomes a finished Power BI report. Outreach is researched from public records before a word is drafted. Each one deploys inside your own perimeter and waits for a person before it changes anything.

      Fig. 2An assistant asks the graph what a change would break
      MCP · graph.impactyour sign-in · read-only1
      1. Find every place order-service reads max_retriesgraph.find [1]
      2. 3 callers and 2 config files in release 7.2retry.py:42 · a91c3e7 [2]2
      3. 14 tests read it; none asserts the limitgraph.coverage [3]
      4. Open a change request for the missing testawaiting approval3
      as of release 7.2every fact: file · line · commit
      1. 1The assistant calls a typed tool on your MCP server, under the person's own sign-in, and only reads.
      2. 2Each fact points at the file, line and commit it was extracted from.
      3. 3The reads ran on their own. The change request waits for a person.
      MCP & knowledge graphs

      MCP Servers & Knowledge Graphs

      Copilot, Claude and ChatGPT learn your systems once: a knowledge graph built from your own source, published through an MCP server that answers every assistant your people use, under each person's own sign-in.

      • Facts extracted from source, each with its file, line and commit
      • Every call made as the person who asked, never a shared service key
      • Anything that changes a record waits for a person
      How it works
      Fig. 3An answer quoted from the contract in force · example
      MCP · docs.search412 of 1,180 documents1

      Asked“Can Fabrikam move our support work offshore?”

      Yes, with 30 days' written notice to us. [1] The 2025 amendment raised the notice from 10 days. [2]

      “…may subcontract the Services outside the Territory on not less than thirty (30) days' prior written notice.”2
      1. [1]Fabrikam MSA · §12.3 · p. 14
      2. [2]Amendment 2 · §1 · signed Mar 2025
      MSA 2022 wording · superseded, not quoted3
      1. 1Only the documents this person can already open were searched.
      2. 2The answer quotes the passage, and each sentence names its document, section and page.
      3. 3The amendment replaced the 2022 clause, so the old wording was never quoted.
      Document answers

      Enterprise RAG

      Your policies, contracts and manuals already hold the answers people email each other for. Asked in Copilot, Claude or ChatGPT, they come back as a sentence that quotes the page, drawn only from documents the person asking could already open.

      • Every sentence cites its document, version and page
      • Permissions copied from SharePoint, Confluence and your drives
      • "Not in your documents" when nothing answers, never a guess
      How it works
      Fig. 4An agent's run plan · example
      Agent run · account qualificationMicroVM · egress denied1
      1. Qualify 40 accounts against your ideal-customer profilewarehouse.read [1]
      2. Competitive analysisweb.fetch · allow-listed [2]2
      3. Price 6 deals from the rate cardpricing.rules [3]
      4. Update 12 CRM recordsawaiting approval3
      CRM connected by manifest · crm.yamlno code change
      1. 1The agent runs in a hardware-isolated MicroVM that cannot reach unlisted destinations.
      2. 2Each step is one scoped tool call, cited by the backend, never by the model.
      3. 3Reads ran on their own. The write waits for a person.
      Enterprise agents

      Enterprise Agentic AI

      Autonomous multi-step agents that qualify accounts, run competitive analysis, price deals, and update the CRM — inside a zero-trust execution environment your security team can actually inspect.

      • Agent code runs in hardware-isolated MicroVMs, never shared hosts
      • New systems connect via a YAML manifest, not a code change
      • Citations generated by the backend, never by the model
      How it works
      Fig. 5One sentence, one report · example
      slippage.pbip · Power BI Desktop3

      Asked“Quarterly slippage by region, with owner and reason”1

      12accounts slipped, Q3
      Procurement delay9 Sponsor left3 
      Slipped Accounts =
CALCULATE ( DISTINCTCOUNT ( Opp[AccountId] ), Opp[Slipped] = TRUE () )2
      1. 1The one sentence someone typed.
      2. 2A real DAX measure, parsed and validated before anyone sees it.
      3. 3A .pbip file that opens in Power BI Desktop. Your BI team owns it.
      Business intelligence

      Agentic Business Intelligence

      One sentence and a governed data source produce a real Power BI artifact — tables, relationships, DAX measures, visuals, page layouts — that opens directly in Desktop. Not a screenshot. A file your BI team owns.

      • Five cloud warehouses plus fourteen file adapters
      • PII detected and redacted before the model sees anything
      • Three self-correction loops; safe mode guarantees an output
      How it works
      Fig. 6A draft held for a person · example
      Outbox · draft 1 of 18
      To
      Director of Operations MX ✓SMTP ✓1
      Subject
      Your Davenport expansion

      I saw the permit filed in September for the Davenport line, and the two controls-engineer openings that followed. When a team adds a line like that, how its systems fit together usually lives in two people's heads for the first year. Would a twenty-minute call on how others made that searchable be useful?

      Evidence score 82/1002 10-K · job post · permit filing
      Send held for a person3
      1. 1The address was resolved and verified, never guessed from a name pattern.
      2. 2Scored on evidence from public records, not optimism.
      3. 3It stops here. A person decides whether it goes.
      Revenue development

      Agentic Revenue Development

      Qualifying accounts discovered from public records, researched against real data, contacts resolved and verified, outreach drafted — then it stops. The draft lands in an outbox and a person decides whether it goes.

      • Addresses never guessed from a name pattern
      • Three-tier deliverability firewall before any draft
      • Every lead scored 0–100 on evidence, not optimism
      How it works
      For your reviewer

      Built for the reviewer, so it reaches production.

      Three findings stop most AI projects in review. We design all three out before we write code, so the review your security, compliance and platform teams run becomes the step before production.

      Fig. 7Security questionnaire
      Vendor AI pilot§4 · data handling

      Q 4.3Does customer data leave your environment for inference?

      Pilot answer

      Yes. Prompts include customer records and are sent to a hosted model API.

      Blocker

      The data cannot leave

      Your prototype called a vendor API from a laptop. Production means regulated data, a data residency clause, and a security team that will not approve an architecture where proprietary information crosses your perimeter to be inferenced on someone else's hardware.

      Fig. 8Model risk review
      Forecast assistantfinding 2 of 5
      Claim
      Q3 revenue at risk: $4.2M
      Source query
      none recorded
      Reproducible
      No
      Cannot verify

      Nobody can audit the answer

      A model produces a confident number. No one can say which query produced it, whether the join was correct, or whether the model invented it outright. In a regulated forecast or a safety case, an unverifiable answer is worth less than no answer at all.

      Fig. 9Change request
      AI assistant · CRM write accessCR-0418
      Approval step
      none
      Preview of changes
      none
      Replay protection
      none
      Denied

      It cannot touch anything real

      Read-only assistants are safe and largely worthless. The value is in the write: filing the change request, updating the record, publishing the dashboard. That requires an approval gate, a blast-radius preview, and replay protection — engineering most pilots never budget for.

      Our position
      We treat all three as architecture problems, not prompt problems. That is the entire difference between a system that ships and a system that demos.
      For your security team: the 24 questions to ask about any AI system, and a review memo in five days. Read the security architecture
      Anatomy

      Anatomy of a governed run.

      One question, six steps, one pause for a person. The drawing is the whole system as it runs inside your cloud. As you read, it lights the part at work and shows what moves between the parts, and what never leaves.

      1. 01 / 06

        The question arrives inside your network.

        An analyst asks which accounts slipped last quarter, and why. The control plane, which sits outside your network, sends down a policy and the list of tools this person may use on this turn. It sends instructions, never data, and stores none.

        Analyst workspace

        Which accounts slipped last quarter, and why?

        role · analyst6 tools permittedpolicy · tenant-default
      2. 02 / 06

        Names are swapped out before the model sees them.

        A router classifies the request in 84 milliseconds. Every call to the model then passes the tokenizer: fourteen personal details become placeholders, and the real values wait in a vault inside your network until the answer comes back.

        Outbound to the model

        Summarise why these accounts slipped: ACCOUNT_1 (owner PERSON_1, EMAIL_1), ACCOUNT_2 (owner PERSON_2) …

        14 values held in the vault0 sent

        Principle 03The router and the tokenizer are separate subsystems, each behind its own kill switch.

      3. 03 / 06

        It finds the right tables the way an analyst would.

        Fifty thousand tables do not fit in a prompt. The agent searches the catalog, previews, counts and samples before it commits to a query, and settles on seven tables.

        Data catalog
        opportunity slip
        • sales.opportunity_history1.2M rows
        • sales.opportunity_stage48k rows
        • crm.account_owner9.1k rows
        • marketing.campaign_touchskipped
        7 of 50,214 tables chosen1.9 s

        Principle 01Retrieval before reasoning.

      4. 04 / 06

        The rows stay in your warehouse. The model gets a pointer.

        The query runs in your warehouse. Its 1,284 rows are written to storage inside your network, and the model receives a pointer and a short summary, never the rows. The backend records the call as citation [1].

        warehouse.read
        SELECT account, stage, slip_reason
FROM   sales.opportunity_history
WHERE  quarter = '2026-Q3' AND slipped
        Result
        1,284 rows → rs_9f3c, inside your VPC
        To the model
        a pointer and a six-line summary
        Logged as
        citation [1]
      5. 05 / 06

        The write stops until a person decides.

        The agent proposes updating twelve CRM records. Every read so far ran freely; a write halts at the gate with a diff of exactly what would change. The approval is pinned to plan v7, so it cannot be replayed against a changed plan. Try it.

        Write gateawaiting approval

        crm.update · 12 opportunity records. Nothing is written until someone decides.

        − stage: "Commit" ×12 + stage: "At risk" ×12 · slip reason from [1]
        blast radius · 12 recordsplan token v7

        Principle 04The human is in the loop, not on the label.

      6. 06 / 06

        Every claim opens its source.

        The answer comes back citing [1], and [1] opens the exact query and result set. Every event in the run is in the audit log, so an auditor can rebuild it months from now.

        Answer

        Twelve accounts slipped in Q3. Nine name a procurement delay ; three lost their executive sponsor .

        [1] warehouse.read → sales.opportunity_history · 1,284 rows · result set rs_9f3c · logged 14:02:11. The marker was written by the backend from the tool call, not by the model.

        audit log · 9 eventsrebuildable on demand

        Principle 02Deterministic output, probabilistic design: the model reasons, code writes the record.

      A technical drawing of the system inside your cloud: an analyst at a laptop, the agent runtime, a tokenizer with its vault, a data catalog, a warehouse, a result store, a write gate with a reviewer beside it, a CRM and an audit log. The control plane and the model endpoint sit outside, above the walls. Each step of the walkthrough lights the parts at work.
      The architecture in full How the write gate is built
      Controls

      Twelve controls, each with a check your reviewer can run.

      Mapped against ISO/IEC 42001, the NIST AI RMF, and SP 800-53, and written for the person whose job is to say no. Six of the twelve:

      Number Control ISO/IEC 42001 · NIST AI RMF How your reviewer checks it
      I. Control and execution plane separation A.6 · A.10
      GOVERN · MAP      		 Network diagram plus a data-flow review. The claim is falsifiable: name the store where customer records would sit in the control plane.
      II. Egress denied by default A.6 · A.7
      MANAGE      		 Packet capture from inside the sandbox while attempting an unlisted destination.
      III. Context-aware tokenization of sensitive data A.7
      MAP · MANAGE      		 Inspect the payload leaving the perimeter and confirm the sensitive spans are placeholders.
      IV. Human approval on every write, with blast radius shown A.9 · A.5
      GOVERN · MANAGE      		 Request a bulk update and confirm the record count is displayed before approval is possible.
      V. Approvals pinned against replay A.6 · A.9
      MANAGE      		 Approve a write, modify the underlying record from another session, then release the approval.
      VI. Deterministic citation provenance A.6 · A.8
      MEASURE · MANAGE      		 Open any citation in a delivered answer and confirm it resolves to a logged call with arguments.
      Mapping, not certification. Each control links to its evidence. All twelve controls
      Engagement

      Six to twelve weeks. Then it is yours.

      We are not staffing a seat. We deliver a running system, the source, the infrastructure code, the decision records, and the test suite — then train your team to own it.

      01 · Review
      02 · Build behind your firewall
      03 · Harden
      04
      01 · Weeks 1–2

      Architecture and security review

      We meet your security team before we write code, not after. Deployment topology, data residency, identity provider, egress policy, and audit requirements are settled up front and written into the design. The output is a threat model and a deployment diagram your reviewers have already seen.

      02 · Weeks 3–8

      Build against production data, behind your firewall

      Synthetic data hides every problem that matters. We work against your real schemas, your real document corpus, and your real naming conventions from the first sprint, inside your environment. You see a working increment every two weeks, and every increment is deployable.

      03 · Weeks 9–11

      Harden, instrument, and prove it

      Red-team the agent against prompt injection, tool-shadowing, and egress evasion. Wire metrics, audit events, and alerting. Load the automated test suite into your CI. The exit criterion is not a demo that impressed someone — it is a green pipeline and a runbook.

      04 · Week 12

      Transfer, then get out of the way

      Full source transfer, infrastructure-as-code, architecture decision records, and hands-on enablement for the engineers who will carry it. If we vanished the following Monday, the system would keep running and your team would be able to extend it. That is the standard we hold ourselves to.

      Business case

      Model the number before you take it to your CFO.

      Enter your headcount, loaded cost, and current cycle times. The calculator runs entirely in your browser and shows reclaimed engineering capacity, annualized cost recovery, and payback period against a realistic deployment. Nothing is transmitted while you model.

      Open the ROI Calculator
      Worked exampleBuild the business case
      Reclaimed capacity

      4,620 hrs

      Annualized recovery

      $364,931

      Payback

      10.5 mo

      Illustrative figures for a 40-person team running 6,000 manual research-and-update workflows a year. Your inputs will differ.

      Fees

      Fixed scope. Published ranges.

      Most firms in this category will not publish a number. Here are the ranges, so you know within a minute whether the budget is in the same order of magnitude.

      Start here Phase 01 · See it work

      First Graph

      $35,000

      4 weeks · fixed price

      A read-only graph from up to three of your systems, answering your team's own questions in the assistants they already use. Credited in full to the build if you continue.

      What it includes
      Or phase 01 · Settle the design

      Architecture & Security Review

      $18,000 – $32,000

      2–3 weeks · fixed price

      When the build is already decided, we settle the decisions that cannot be reversed later: deployment topology, data residency, identity provider, egress policy, and audit requirements.

      Phase 02

      Build, Harden & Transfer

      $75,000 – $420,000

      6–12 weeks · fixed price, set in phase one

      A production system on your real data inside your environment, handed over with everything needed to own it. One team on up to three systems from $75,000; several teams, strict topology or regulated evidence from $180,000.

      No licence, no per-seat fee. You run it on your own infrastructure. A system already stalled in security review? The Security Review Memo is $3,500 and five business days. What moves you across the range

      Colophon

      A small engineering firm in the Quad Cities, Iowa.

      Juan Carbone
      Principal engineer
      Juan Carbone

      Fifteen years building analytics, software, and manufacturing systems inside Fortune 100 product organisations. Now builds production agentic AI that deploys inside the customer's own perimeter, stops at a human approval before writing, and is handed over with the source.

      Role
      Founder and Principal Engineer
      Works on
      Agentic AI architecture, zero-trust deployment, MCP servers and knowledge graphs, BI automation
      Writing and background
      1. Security comes first, not last

        We meet your security architects in week one, before there is code to defend, while the decisions are still cheap to change.

      2. Your data, or we are guessing

        We build against your real schemas and your real document corpus from the first sprint, inside your environment.

      3. A human approves every write

        Not as a configurable default — as an architectural property. We have been asked to remove it, and declined.

      4. Tests are the deliverable, not the overhead

        A system your team is afraid to change is already dead. The suite is what makes it safe to touch after we leave.

      Questions

      Asked in the first meeting.

      Direct answers. If yours is not here, ask it in the briefing.

      Which systems can the graph be built from?

      The ones your people already search across. Repositories and configuration, tickets in Jira or ServiceNow, pages in Confluence or SharePoint, records in Salesforce or your warehouse. We start with one graph and one server, read-only, over the systems your first questions need, and grow from there. Every fact keeps a pointer to the record it was read from.

      Does our data leave our network?

      No. The execution plane runs inside your own VPC under a bring-your-own-cloud model. Agent-generated code executes in hardware-isolated MicroVMs on your infrastructure, and an eBPF egress filter plus DNS sinkhole restricts outbound traffic to an allowlist you control. The control plane orchestrates; it never holds your data.

      Can an agent write to production without a human approving it?

      No. Every WRITE action halts at a human-in-the-loop gate that renders a blast-radius diff before anything commits. Approvals are pinned to an optimistic-concurrency version token, so an approval granted against one plan cannot be replayed against a modified one. Reviewers approve, reject, or escalate, and every decision is written to the audit log.

      How do we verify an answer is not hallucinated?

      Every claim carries a citation the backend generated, not the model. Each marker resolves to the exact tool call and result set behind it, so a reviewer can open the underlying query. Markers the model invents on its own are stripped before rendering, and citations survive across conversation turns rather than resetting each message.

      How long until we are in production?

      Six to twelve weeks for a scoped pilot. Weeks one and two cover architecture and security review, weeks three to eight build against your real data inside your environment, and the remainder covers hardening, red-teaming, runbooks, and handover. We start from platforms already proven in production, which is where the compression comes from.

      What is the smallest way to start?

      A First Graph: 35,000 US dollars, fixed, over four weeks. We build a read-only knowledge graph from up to three systems you already run, in your own cloud account, and your team asks it its own questions in the assistants they already use. Every answer cites its source. If you go on to a build, the fee is credited in full; if you stop, the graph and its source stay in your account.

      Do we get the source code?

      Yes — that is the deliverable. Engagements terminate in full source transfer, infrastructure-as-code, architecture decision records, and the automated test suite, plus hands-on enablement for your engineers. You are not renting a black box, and there is no extraction cost if you decide to take it entirely in-house.

      Technical briefing · 45 minutes

      Bring the question nobody on your team can answer.

      Forty-five minutes with the engineers who built these systems — not a sales team. Bring the question that crosses three systems, the change nobody can size, or the requirement that stopped the last attempt. You will leave with an architecture opinion whether or not you work with us.

      Book a Technical Briefing Read the case studies
      Fig. 11What you leave with · example
      Architecture opiniondraft · 1 page
      Your question
      Which services read the retry limit, and which runbooks still describe the old one?
      Verdict
      answerable From GitHub and Confluence. The first graph runs read-only, in your Azure tenant.
      For your reviewer
      Data-flow diagram · egress capture · outbound payload sample
      Open questions
      2 · which repositories first, SSO group mapping

      — Axionalytics engineering, after a 45-minute briefing