The 70/30 thesis
The visible 30% is the stack — budget, integration with the systems you already run, security and compliance. Below the waterline is the 70% that decides the outcome: choosing the right opportunities and proving their ROI, skills and AI literacy, redesigned workflows, the fear of what AI means for jobs, and a roadmap that holds. I've run both sides at scale; I work where programs sink or swim.
That's the 70% — ownership, controls, measurement. I don't sell it as a separate project; it's how every build is delivered. The four ways in →
The home page keeps the eight most asked. These are the rest.
I lead every build and write the controls. Vetted developers do parts of the engineering under my review. It runs in your tenant, on your keys.
If you want a roadmap and no build, a strategy firm will serve you better.
Everything I build passes a strict delivery-assurance standard — registered in your AI registry with a rollback plan, human-in-the-loop by default, tested with an evidence pack you keep, rolled out in stages, 30-day warranty. If it can't produce its evidence pack, it doesn't go live. The record shows what was tested, what was reviewed, and who signed off — your named owner makes the call.
Three ways: an eligibility rubric in writing (I build on your existing stack, internal-facing or human-reviewed, always reversible — and I decline what's not mine to build); staged rollouts with the code in your repo, not mine; and when a build needs deep engineering, I say so and direct a vetted engineer instead of pretending.
Never. Your GRC is the skeleton; AI governance arrives as an overlay — the registry maps into your platform, AI controls extend your existing control families, and AI risk reports into the committee pack your board already reads. You'll get two lists: what your GRC already covers (don't pay again), and what's genuinely new for AI.
Two kinds of machines: my tools and your appliances. My tools process what you hand me — under business contracts that forbid the AI vendors from keeping or learning from it, with deletion deadlines in the SOW; anything too sensitive is processed inside your walls instead. Everything I build permanently runs in your house: your tenant, your cloud, your API keys — nothing phones home to me. The registry is a document in your SharePoint or your GRC platform, not a service of mine. Revoking my access is one click.
Yes — governed ones. Agentic orchestration without process redesign automates chaos at machine speed. I build agents your board can defend: registered in your AI registry, human-in-the-loop where it matters, with a rollback switch.
Fixed fee, known before we start: the 7-day Check is $4,500, credited in full to a Build or a Governance Setup within 90 days; the 30-day Build is from $19k, with up to 30% paid on the day-30 number; Agent Care from $3,500 a month and a Fractional CAIO from $8k a month, each on a 3-month initial term, then monthly. Governance Setup is scoped on a 30-minute call.
As a method, not a promise: every build has a named owner, every decision is logged, there is an off switch, and the evidence pack is written while we build. If you run several AI initiatives or a regulator is asking, the Governance Setup covers the whole company — inventory, owners, risk tiers and a policy your board can sign.
I prepare and map — policies, AI-layer controls, evidence structure — into the frameworks and tools you already run (including Vanta-class platforms; I overlay, never replace). Certification itself comes from auditors: SOC 2 attestation from a CPA firm, HIPAA counsel where health data is real. I make sure you walk into that process ready, and that your AI layer doesn't break what you've already certified.
The 7-day Check tells you which process to automate first and what it saves. The 30-day Build puts it in production, with the number read on day 30 from your systems.
No. Every build carries its own controls — owner, log, off switch, evidence. If you run several AI initiatives or a regulator is asking, the Governance Setup covers the whole company.
Because the agent has to survive your CFO's month-end, your auditor and the next system upgrade. The controls are a few hours inside a 30-day build; leaving them out is how pilots die in month three.
Still have questions? Book a 30-minute call and we'll work through them together.