AI systems engineering

I build the parts of AI systems that have to be trusted.

Backend and platform work on AI systems that touch real company data, in Go, Python and Kubernetes. Most recently: giving a language model delegated access to a company's mail, chat, calendars and documents, and doing the security engineering that made it defensible to ship.

See the work
● Available nowAI systems engineering · contract or advisory
Get in touch

Measured

$1,299/mosubscription tender-response product displaced by the in-house system: the gross cost that stopped, not a net saving I can claimRead the work →0 of 658answering attempts served by a cache that was wired up, logging, and had never once hitRead the work →93%largest measured cut in the input tokens a single request carriedRead the work →44routes that required only a valid session, including a bulk delete of the shared corpusRead the work →437plaintext records encrypted in place across 64 conversations, verified three ways, 0 failuresRead the work →$0committed to a paid third-party feed: every source optional, and the pipeline correct with none configuredRead the work →

Each of these is an observation I recorded, and each links to the page that shows how it was obtained. Where money appears it is a bill that stopped or spend never committed, stated gross, at the billed rate, never a token count multiplied out into an annual saving, because that needs a message volume and a headcount I never measured and the assumption would be doing all the work. The pages are also interested in the numbers that came out flat, like a guard that fired zero times or an optimisation worth one per cent, because those are the ones that changed a decision.

What I'm usually brought in for

Agentic tool access, without widening anyone’s permissionsReal reach into mail, chat, calendars and documents on the user’s own credential, with a human in front of anything destructive.Retrieval and cost engineeringRetrieval over a corpus that has been audited rather than assumed, and the token and latency work underneath it, including the parts that measured flat.Measurement before tuningLabelled baselines and the arithmetic that says whether the obvious optimisation is worth shipping. Twice the answer was no, before the work was done.

What the first one looks like

A model has decided to send a message on someone's behalf. Nothing leaves until a person says yes, and if nobody answers, the answer is no. Press either button, or leave it alone and watch it decline.

Live, not a screenshot

send_messagechat tool server · delegated
15s
To
A colleague (internal recipient)
Message
Thanks, I've reviewed the draft policy and left two comments on the retention section. Happy to walk through them tomorrow.

Reconstruction of the shipped UI. Countdown compressed to 15s for the demo; the real gate blocks for 60.

How the real one was built →

Selected work

437plaintext tool-result records encrypted in place across 64 conversations, 0 failures, verified three ways

Giving an AI assistant real access to a company's data

Agentic tool access · Security and access control · 13 min read

Corporate OAuth and four agentic tool servers added to an internal AI assistant, plus the security engineering that made giving a language model write access to mail, chat and calendars defensible.

→ Four tool servers live behind one consented identity. The assistant acts on a user’s own mail, chat, calendar and documents, and never sees a credential.

  • Go
  • Python
  • Vue 3
  • MongoDB
  • Valkey
Read →
93%largest measured cut in the input tokens one request carried: 30k down to 2.2k

The thirty-thousand-token tax on asking what time it is

Agentic tool access · Measurement and cost · 16 min read

A per-user tool toggle and an embedding-based relevance gate in front of the model call, cutting the fixed token cost of having tools at all, plus the measurement that deleted the cleverest part of my own design.

→ The fixed cost of having tools at all, cut by up to ≈93% on a message, and the cleverest part of my own design deleted on its own evidence.

  • Go
  • Vue 3
  • TypeScript
  • MongoDB
  • AWS Bedrock
Read →
0 of 658logged answering attempts served by a cache that was wired up, logging, and had never once hit

The cache that had never served an answer

Retrieval and RAG · Measurement and cost · 15 min read

A three-tier answer cache that was wired up, logging, healthy and passing its tests had served zero answers in its entire life. The reason was a gate reading one number as if it were a different one.

→ The cheap answer path switched on for the first time, after finding two stacked defects that kept it dark across 658 attempts.

  • Go
  • MongoDB
  • AWS Bedrock
  • Retrieval-augmented generation
  • Cost measurement
Read →

All 13 case studies →

Elsewhere

How I work · CV · Contact

If any of the above is the shape of a problem you have, say hello. I read everything and reply to anything specific.