file: services.tsxpractices: 6

Specifications for every practice.

Each practice has a typical shape, deliverables, inputs, and an honest out-of-scope list. Most engagements combine two or three. Jump to a practice or read how discovery works.

// 01 · generative AI

Generative AI Solutions

RAG architectures, fine-tuning when it earns its keep, evaluation pipelines, prompt design, and product UX patterns that make AI features feel trustworthy. Model selection across Grok, Claude, OpenAI/GPT, and open-source on Azure — plus Copilot Cowork and Claude Cowork where the work lives in the desktop and M365 surface.

typical

8–12 wks · production AI feature with eval coverage

commercial

Fixed-scope discovery, then milestone build. Most product AI builds land mid contact-form bands; complex multi-tenant retrieval runs higher.

Who it's for

Product teams with a demo that impresses sales and scares engineering
SaaS scale-ups adding customer-facing Q&A, copilots, or document intelligence
Teams that need citations, tenancy isolation, and a path past “prompt hope”

What we deliver

Target architecture + ADR (model, retrieval, tenancy, cost/latency budgets)
Retrieval contract (corpus, chunking, filters, refuse path)
Golden eval set + CI smoke/full gates (groundedness, refusal)
Tracing (request → chunks → completion) wired for on-call
Feature-flagged ship path with shadow-mode plan
Runbooks and ownership handoff your team can operate

Inputs we need

Product owner + eng lead with decision rights
Access to corpus systems and staging (or redacted export)
Tenancy / auth model documentation
Examples of answers that would get you in trouble

Out of scope

Open-ended research agents with no product boundary
Training foundation models from scratch
Content farms or SEO spam generation
“Make ChatGPT of our company” with no corpus or owner

Typical shape

Wk 1–2

Failure modes, data flow, corpus audit, success metrics

Wk 3–5

Retrieval + app path, first goldens, baseline evals

Wk 6–9

Product UX, hardening, CI gates, cost controls

Wk 10–12

Shadow mode, flag flip criteria, docs & handoff

combines with

Agents (tool use)Security (threat model before GA)Azure (private data plane)

proof

Case: production RAG + evals →Note: evals before the flag →

Start with this practice →

// 02 · automation

Intelligent Automation

Durable workflows on Temporal or Azure Durable Functions. Copilot Cowork, Claude Cowork, and Grok where language and desk work are the hard part; deterministic rules everywhere else. Document processing, internal tools, and back-office paths that need retries and audit trails.

typical

4–10 wks · measurable hours-saved per week

commercial

Often shorter than product AI. Discovery is light if the process is already mapped; build priced on systems integrated and exception rate.

Who it's for

Ops and eng leaders drowning in ticket/document triage
Teams with a clear process but brittle scripts and no durability
Companies that tried RPA and hit exception-handling walls

What we deliver

Process map with happy path, exceptions, and SLAs
Workflow implementation (Temporal / Durable Functions)
LLM extraction/classification steps with validation
Idempotent write-backs to systems of record
Metrics: throughput, failure rate, human touch rate, hours saved
Ops runbook and alert thresholds

Inputs we need

Process owner who lives the workflow daily
API or export access to systems of record
Sample documents/tickets (including ugly edge cases)
Definition of “done enough” for v1 (not boiling the ocean)

Out of scope

Full ERP replacements
Unattended desktop RPA as the primary architecture
Automations that require breaking vendor ToS or scraping logins
Headcount reduction programs dressed as engineering

Typical shape

Wk 1

Process workshops, system inventory, success metric

Wk 2–4

Core workflow + one integration path in staging

Wk 5–7

LLM edges, exception queues, observability

Wk 8–10

Pilot cohort, tune, handoff (or extend integrations)

combines with

Agents (for multi-step decisions)Azure (hosting + identity)Advisory (prioritisation)

proof

Case: AI on boring office work →Note: fail-closed loops →

Start with this practice →

// 03 · azure

Azure Cloud Architecture

Landing zones, hub-and-spoke networking, Well-Architected reviews, Bicep/Terraform IaC, AKS platforms, and FinOps. Pure Azure or hybrid — designed so your team can operate it under change control.

typical

6–16 wks · documented architecture, deployed

commercial

Discovery produces options and cost model; build is milestone-based per environment (identity, network, landing zone, workloads). FinOps retainers available after.

Who it's for

Scale-ups that outgrew click-ops subscriptions
Enterprises standardising a platform for multiple product teams
Teams migrating workloads who need right-sizing, not pure lift-and-shift

What we deliver

Current-state assessment and target architecture
Landing zone IaC (hub-spoke, policies, identity patterns)
Environment promotion story (dev/stage/prod)
Observability baseline (Azure Monitor / logs / budgets)
FinOps starter: tags, budgets, rightsizing loop
Runbooks and platform ownership RACI

Inputs we need

Subscription/tenant admin for a sandbox (or dedicated landing zone sub)
Network and identity stakeholders
Inventory of apps/data classes and compliance constraints
Rough monthly spend and pain points

Out of scope

Multi-year outsourcing of all cloud ops
Forced Azure migration when another cloud is the platform of record without mandate
Unlimited “help desk” without a retainer scope
Greenfield app product builds under a pure platform SOW

Typical shape

Wk 1–3

Discovery: workloads, network, identity, cost drivers

Wk 4–8

Landing zone + IaC foundations in non-prod

Wk 9–12

Workload patterns, private endpoints, observability

Wk 13–16

Prod readiness, FinOps cadence, handoff (scope-dependent)

combines with

Security (IAM, private endpoints)GenAI (AI data plane)Advisory (roadmap)

proof

Case: landing zone + ~35% cost →Notes: Azure / cloud →

Start with this practice →

// 04 · security

Cloud & AI Security

Threat modeling for LLM applications (OWASP LLM Top 10), prompt-injection defense, sensitive-data flows, IAM hardening, secrets management, and readiness support for teams heading toward SOC 2 / ISO 27001.

typical

3–8 wks · signed-off risk register and remediations

commercial

Fixed-scope review is the usual entry. Remediation sprints priced separately. Not a full MSSP or 24/7 SOC.

Who it's for

Product teams shipping AI before a security or customer review
Platform teams cleaning IAM and secrets before audit season
Founders who need a risk register, not a policy PDF

What we deliver

Data-flow diagram for the AI/cloud feature under review
Risk register (severity, mitigation, residual risk, owner)
Prioritised remediation plan (quick wins vs structural)
Control evidence notes useful for SOC 2 conversations
Optional: retest after remediations

Inputs we need

Architecture diagrams (even rough) and tool/API list
Access to staging or walkthroughs of prod controls
List of compliance drivers (customer asks, SOC 2, etc.)
Known incidents or near-misses if any

Out of scope

Full penetration test firm replacement (we coordinate, not always execute)
Legal opinions or formal certification issuance
Managed SOC / SIEM operations
Rubber-stamping a feature you will not let us inspect

Typical shape

Wk 1

Kickoff, asset inventory, trust boundaries

Wk 2–3

Threat model workshops + technical review

Wk 4–5

Risk register, findings readout, remediation order

Wk 6–8

Optional remediation support / retest

combines with

GenAI & Agents (before GA)Azure (identity & network)Advisory (roadmap)

proof

Note: threat-model before SOC 2 →Case: production AI controls →

Start with this practice →

// 05 · agents

AI Agents & Agentic Systems

Multi-step agents with LangGraph, OpenAI Agents SDK, Azure AI Foundry, OpenClaw, Hermes, Copilot Cowork, and Claude Cowork. Grok and other frontier models where they win the eval. Narrow tools, durable workflow underneath, memory that does not become sludge, human-in-the-loop on irreversible actions, and observability for production debugging.

typical

10–14 wks · agent shipped behind a feature flag

commercial

Usually follows or pairs with GenAI discovery. Builds are milestone-gated on tool safety, eval trajectories, and HITL UX — not demo day.

Who it's for

Teams automating multi-step internal work with clear systems of record
Products that need tool use beyond single-shot chat
Leaders who want autonomy without unsupervised production credentials

What we deliver

Agent scope: goals, hard stops, step/cost caps
Tool surface design (least privilege, typed args, idempotency)
HITL queues for irreversible actions
Trajectory evals + injection cases in CI
Tracing and replay path for failed runs
Feature flag + rollback runbook

Inputs we need

Process with defined success/failure
API access to systems the agent may call
Policy on what requires human approval
Staging environment that tolerates test side effects

Out of scope

Unsupervised agents with admin Graph/cloud keys
Swarm architectures as a first ship (we start with one loop)
Consumer viral agents with no business process
Guarantees of full autonomy without human oversight

Typical shape

Wk 1–2

Process + tool inventory; kill multi-agent sprawl early

Wk 3–6

Single competent loop, tools, sandbox side effects

Wk 7–10

HITL, evals, observability, product integration

Wk 11–14

Shadow/pilot, hardening, handoff

combines with

Automation (durable backbone)Security (tool abuse cases)GenAI (retrieval)

proof

Case: OpenClaw & Hermes day-to-day →Case: agent loop + evals →Note: HITL without theatre →

Start with this practice →

// 06 · advisory

Modernisation & Advisory

Architecture reviews, build-vs-buy, technology selection, hiring scorecards, and executive briefings. For teams that need senior judgement more than more hands — including heritage Microsoft estate decisions that still land on today’s roadmap.

typical

ongoing retainer · better decisions, faster

commercial

Monthly retainer (office hours + async review) or fixed-scope reviews. Heritage migration advisory often scoped as a time-boxed assessment.

Who it's for

CTOs/VPs who need a second brain on architecture or vendor choices
Teams hiring first AI/platform roles and needing scorecards
Enterprises modernising identity, M365, or hybrid estates

What we deliver

Written recommendations with options and tradeoffs
Decision records you can share with board or procurement
Hiring scorecards and interview loops (when in scope)
Roadmaps with sequencing, not vanity timelines
Intro paths to specialists when we are not the right builder

Inputs we need

Decision you are actually trying to make
Constraints (budget, deadline, political)
Access to key stakeholders for 2–3 conversations
Existing decks/ADRs (imperfect is fine)

Out of scope

Body-shop staffing under an advisory label
Rubber-stamping a decision already locked for politics only
Indefinite strategy with no decision owner
Legal, tax, or HR compliance advice

Typical shape

Week 0

Fit call / written read — decline fast if wrong

Retainer

Weekly or biweekly office hours + async design review

Fixed review

1–3 weeks for a bounded architecture or vendor decision

Optional

Convert to discovery/build SOW when execution is next

combines with

Any build practice after a clear decisionHeritage migration assessment

proof

Case: tenant-to-tenant weekend flip →Case: 15k-mailbox hybrid migration →Note: rules we never break →Archive field notes →

Start with this practice →

// combinations

How practices usually combine.

product AI

GenAI + Agents + Security

Customer-facing features: retrieval contracts, tool-using agents, threat model before GA. Most common path for SaaS product teams.

genai →

platform

Azure + FinOps + Advisory

Landing zones and cost ownership for teams that outgrew ad-hoc subscriptions.

azure →

ops leverage

Automation + Agents

Back-office workflows: deterministic core, LLM at the edges, durable execution.

automation →

// how we work

The standard engagement loop.

Cadence is senior and light: working sessions when decisions are needed, async design review otherwise. You always know who is doing the work — not a pyramid after kickoff.

phase 01 · 2–3 wks

Discovery

Technical interviews + workshops
Written target architecture & options
Costed plan you can take or leave

phase 02 · ~1 wk

Plan & align

Scope, risks, milestones in writing
Success criteria and gates
Access checklist closed

phase 03 · iterative

Build

Two-week iterations, working software
Decision log / ADRs kept current
No surprise scope without a change note

phase 04 · end of build

Handoff

Docs, runbooks, training
On-call path for the feature/platform
Optional fractional support

// discovery

What a fixed-scope discovery produces.

deliverable

Written fit read

Within one business day of your brief — honest yes/no/maybe and what discovery would cover.

deliverable

Target architecture options

Usually 2–3 options with tradeoffs, not a single predetermined stack.

deliverable

Risk & dependency register

What can kill the timeline: data, tenancy, vendors, access, politics.

deliverable

Costed build outline

Milestones, gates (evals, threat model, landing zone), and commercial shape.

deliverable

Decision log seed

ADRs started in discovery so build does not re-litigate week one.

// sample artifacts

What the work looks like on paper.

Illustrative shapes — redacted client versions look like this, not a slide-only consulting pack. Real templates are shared under NDA during discovery.

artifact · adr

Architecture one-pager

Context, forces, decision, consequences. Model/retrieval/network boundaries on one page your eng lead can defend.

artifact · evals

Eval scorecard

Golden set size, groundedness/refusal thresholds, CI smoke vs nightly, last regression delta — release gate, not a slide.

artifact · security

AI risk register excerpt

Injection paths, tool blast radius, data egress, residual risk, owner. Mapped to OWASP LLM themes where useful.

artifact · azure

Landing zone sketch

Hub-spoke, identity, private endpoints, env promotion. Enough to estimate; full IaC follows in build.

// heritage practices

Where this playbook was earned.

2016 – 2021

Microsoft 365 & Azure migrations

15,000+ mailboxes and workloads: Exchange hybrids, SharePoint upgrades, Lotus Notes and G Suite migrations, tenant-to-tenant M&A moves, ADFS and hybrid identity.

field notes →

2016 – 2021

Private cloud & virtualization

Hyper-V + System Center at 400+ server scale, vSphere replication, multi-forest AD consolidation, DR that actually failed over.

field notes →

2016 – 2021

VDI & unified communications

Citrix XenDesktop, RDS, WVD → AVD, multi-tenant Skype for Business — 10,000+ concurrent users at 99.95% availability.

field notes →

// lives on inside Modernisation & Advisory — see advisory // case studies

// economics

How commercial shape usually looks.

discovery

Fixed scope

Typically lower contact-form bands. Written options, risks, and a build SOW you can take or leave — no obligation to continue with us.

build

Milestones

Payment tied to working software and agreed gates (eval coverage, landing zone, threat model). Rates in the SOW — no mystery line items.

advisory

Monthly retainer

Architecture office hours, design reviews, hiring scorecards — senior judgement on tap.

// next

Not sure which practice fits?

Send a brief. We reply within one business day with an honest read — and which practice (or combination) actually matches.

Start a project →