Applied AI systems
Automation that drafts and routes. Never automation that decides.
Ten systems, built and run against real records.
Twenty-two years in naval intelligence came first. Handling information that could not leak, building the systems that let other people reach it, and teaching those people to use them.
The method
No agent reviews its own work.
Thirteen specialist agents run behind a single routing layer, each scoped to its own domain and permission boundary. Everything that ships passes through the same three stages.
One
Build
The engineer writes it and stamps a verification manifest.
Two
Security review
An independent reviewer holds the single pre-release gate.
Three
Attack
A third reads adversarially. A finding is suspected until reproduced.
A defect is not closed until a test fails on the old code and passes on the new. The release decision stays with a person.
Operations dashboard
Ten sources. One record.
Consolidates records scattered across ten systems into a single reviewed view, under a test suite that has to stay green.
483
records consolidated
311
passing automated tests
6
defects caught by the security pass
The outcome worth naming: one of those six was a time-of-check to time-of-use flaw. It came down to an import filter written as a denylist instead of an allowlist, and it was fixed by inverting it.
Records classification
Nothing uncertain is reported as settled.
Reads three mailboxes in parallel through an integration written for it, and attaches the verbatim source text plus a confidence level to every figure it extracts.
938
record backlog cleared
3
mailboxes read in parallel
Every
figure carries its source text
A low or missing count never silently means the data is absent. It may mean a source could not be read, and the system says which.
Expense and tax records
Built to refuse rather than guess.
Searches several mail accounts at once, extracts only what it can defend, and exports behind a preflight that blocks half-finished data from reaching a filing.
1,741
tests across 50 files
28,693
lines of Python
2
read-only scopes, and nothing else
Corrections are made by appending, never by editing, so the original record and the correction both survive. Where a figure cannot be tied to source text, the export refuses rather than shipping a number nobody can trace.
Multi-tenant drafting platform
Research once. Personal to everyone.
A platform where every user gets a finished monthly draft written in their own voice. The shared research runs once and serves the whole tenancy, which is the entire reason the economics work.
It never invents a person
It can describe what a book is about, because that is public fact. It cannot write that someone enjoyed it unless they said so. A section with no real input is left out rather than filled.
It cannot be talked out of a check
Every figure carries a named source and a date or it is dropped and flagged. Required disclosures are verified before a draft can be marked ready, and no draft leaves without a person approving it.
Because the platform can send mail under a user's own name, it was built on paid authentication with two-factor and retained audit logs rather than the free tier. That was the cheapest line in the budget and the one that prevents the incident nobody wants to explain.
Private file distribution
Specified in advance. Not assumed.
A distribution system serving four thousand files, which passed a written security gate before it went live rather than after.
4,040
files served
0
of its security decisions left to chance
Path traversal and filename handling were written down as requirements before a line was served, which is the difference between a control and a hope.
Everything built
Ten systems, and what each one can do.
Every capability below is in production against real records, not a prototype.
Multi-agent build pipeline
Thirteen specialist agents behind one routing layer, each with its own domain and permission boundary. Build, then independent security review, then an adversarial read. No agent reviews its own work, and a defect closes only when a test fails on the old code and passes on the new.
Operations dashboard
Consolidates 483 records across 10 sources under 311 passing tests. Its security pass found six defects, including a time-of-check to time-of-use flaw fixed by inverting an import filter from a denylist to an allowlist.
Records classification
Reads three mailboxes in parallel through a purpose-written integration and attaches the verbatim source text plus a confidence level to every figure it extracts. Cleared a 938-record backlog. Reports an incomplete run rather than letting a low count read as an absence.
Expense and tax record system
28,693 lines of Python under 1,741 tests. Two read-only scopes and no write path to the source accounts. Encrypted credential storage, a localhost-only review interface with a per-launch token that defeats cross-origin calls and DNS rebinding, append-only ledgers, an export preflight that refuses half-finished data, and a spreadsheet formula-injection guard on every cell.
Multi-tenant drafting platform
Per-user voice profiles, self-service signup behind an approval gate, and shared research that runs once for the whole tenancy. It never invents anything personal, every figure carries a named source and date or is dropped, required disclosures are verified before a draft can be marked ready, and nothing sends without a person approving it.
Encrypted device-to-desktop sync
Sealed payloads through a single crypto seam, a keyring at rest, and a ledger that enforces a nonce is used exactly once. A deliberately minimal two-route wire contract. A failed transfer is left on the relay rather than reported as collected, because losing a record silently is worse than collecting it twice.
Private file distribution
Serves 4,040 files and passed a written security gate before going live. Path traversal and filename handling were specified as requirements in advance rather than discovered afterwards.
Two-step intake funnel
Captures a contact in the first step, merges everything to a single clean record, and follows up automatically when the second step is abandoned. The follow-up runs on a rule set in advance; it never improvises a message.
Design-system library
Eleven token-level design systems reconstructed to exact colour, type, spacing, radius and elevation values, each with usage rules, contrast checks, and an honest note wherever the source was silent rather than a value invented to fill the gap. This page is built on one of them.
Custom integrations and MCP servers
Separate business systems wired together through REST, OAuth 2.0 and Model Context Protocol servers written for the job, so records, documents and messages move between tools without manual re-entry. Read-only by default; write access is granted per action, never per integration.
The principle underneath all of it
Nothing automated sends, spends, deletes or publishes without a human approving that specific action.
Automation that drafts and routes is safe. Automation that acts on its own in someone else's matter is not. That boundary was designed in before anyone asked for it, because a system that can act unsupervised will eventually act unsupervised at the worst possible moment.
Secrets live in environment variables or a secrets manager, never in code. Everything is least-privilege scoped by default. Where a control does not do what it appears to do, the documentation says so plainly rather than implying a guarantee that was never there.
Most of these systems run a live business and hold real records, so the repositories are private. A walkthrough is the honest substitute, and it is offered readily.