Services & Methodology
- For
- Founder-led Private Capital principals
- CTOs & CCOs at regulated firms
- PE operating partners
Where complexity meets regulation.
The first time a regulator, an auditor, or an LP asks how your AI reached that decision — can you answer from a record?
The framework is public on purpose. Putting it into production under audit — and knowing which of the five tiers your program can actually defend today — is the work.
I work with people standing up AI agents that write — allocate, abstract, screen, price, decide — across private capital, banking, payments, CRE, and healthcare payer, and need the answer to hold the first time it is asked under oath.
- $750M deal architect
- Ransomware-to-cloud: 50-day MVP, not 6 months
- 6 open libraries, all DOI-archived
A0→A4 methodology · sovereign veto · hash-chain audit · a ladder of engagements in outcome terms.
The Methodology
What an engagement actually builds.
Read the repositories and you have the patterns. The methodology is the order you apply them in, the boundary you defend, and the evidence you leave behind. These four load-bearing parts are what an engagement actually builds.
The maturity ladder
Five tiers, human-only to production-autonomous. Each decision class earns its rung; nothing is granted write authority it cannot survive an audit at. The A2→A3 line is the regulator-visible boundary.
The non-overridable gate
A deterministic check sits between the agent and anything that touches capital, customers, or compliance. It is not a prompt and not a model — it cannot be argued out of a refusal, and the agent cannot route around it.
The hash-linked ledger
Every decision, input, and gate outcome is written to a tamper-evident, hash-chained ledger. When someone asks how the agent reached a decision eighteen months ago, the answer is a record, not a reconstruction.
The check that doesn’t share the failure
The thing that approves an agent’s write cannot be the same model, the same vendor, or the same training data that produced it. Independent verification is what turns “we tested it” into “we can defend it.”
The framework is open. The judgment is not. Six permissively licensed pattern libraries, all DOI-archived, ship the building blocks publicly; the engagement decides what to build, what to refuse, and what a regulator will accept.
The Verticals
Six regulated verticals, one governance backbone.
Each sector has its own regulator, its own rule cite, and its own open library — so whether you are a CIO under the Advisers Act, a bank CCO under ECOA, or a payments CTO under BSA/AML, you are reading the right page.
Allocators, alts & family offices
Mandate, risk-limit, and fiduciary-reasonableness gates mapped to the Advisers Act §206 fiduciary duty.
PE-backed CRE operators
Lease-abstraction provenance, fair-housing pre-flight gate, tenant-PII residency. Colorado SB 26-189 mapped.
Capital markets & trading desks
EU AI Act mapping for cross-border desks, plus a DEFCON-style readiness state machine, sovereign veto, and hash-chain audit for market-facing AI.
Bank model-risk & lending
Model-risk effective-challenge, ECOA / Reg B adverse-action gate, OFAC reference workflow.
Payment & transfer operators
OFAC screening, BSA / AML, Reg E — plus a rail-finality gate for transfers that can’t be clawed back.
Health-insurance payers
Coverage-determination and utilization-management governance for health-insurance payers.
The framework is open across all six; the judgment is not. Each library ships the building blocks publicly — the engagement decides what to build, what to refuse, and what an examiner will accept.
The Ladder
How far up the ladder can you defend?
Think of it as a driver’s license for AI. At A0 it only gives directions — a human drives. At A2 it drives inside a fenced lot while you spot-check. At A4 it drives itself on approved routes, with a brake it can’t switch off and a recorder of every turn.
A2 → A3 is the regulator-visible boundary. Escalation is automatic; de-escalation is deliberate.
The Engagements
Three ways to work. You leave each with something concrete.
Where you start depends on what your program can defend today — the self-scorer below puts a number on it. Scope and price are set in the conversation, not on a page.
No standard list price. Each engagement is scoped to one program, one vertical, one regulator. Price is set in the conversation.
The Operator
The framework is public. The operator is the scarce part.
Anyone can clone the repositories. Far fewer people have shipped this kind of governance into production under real regulatory and operational fire. I build the governance, then I build the system that lives under it.
- $750M wealth-management contract. Architected the platform behind one of the largest such contracts in years — the kind of fiduciary-grade, audit-bound system the Autonomy Ladder is built to govern.
- Rebuilt a company on Azure during an active ransomware investigation. Twelve days hard-down, no disaster recovery, a 50-day rebuild — security and compliance certified in the same window. Governance that holds when everything is on fire, not just in the demo.
- Author of the Autonomy Ladder (A0→A4) framework. Six permissively licensed open-source pattern libraries — all DOI-archived — for regulated finance, commercial real estate, healthcare payer, private capital, banking, and payments, published on purpose, so the methodology is inspectable before you ever take a call.
- 25+ years in regulated-industry technology. Private capital, banking, capital markets, payments, and healthcare payer technology — two decades of scar tissue across the exact domains where AI write authority is the hard problem.
Every chapter is rare on its own. The combination is the part that doesn’t reproduce.
Why Now
The compliance horizon carries real dates.
The deadline reason to act is no longer hypothetical. The regulations that govern AI write authority in these verticals carry real dates and real conduct standards.
Colorado SB 26-189 sets the compliance horizon for high-risk AI systems. The act itself is effective August 12, 2026, with no safety clause — the runway to defensible governance is shorter than the headline date suggests.
Article 14 human-oversight obligations apply to high-risk systems on a staged timeline. The Autonomy Ladder’s A2→A3 boundary maps directly onto what “human oversight” has to mean in practice.
For buy-side and allocation agents, the Investment Advisers Act fiduciary and adviser-conduct standards already apply — an agent that allocates capital answers to them today. The adviser-conduct gates map directly to the obligations the Act imposes.
Reference framework, not legal advice. The deadlines are real; the right posture for your firm is a counsel-and-engineering conversation, not a checkbox.
The Self-Scorer
Score your program in seven questions.
Where does your AI program actually sit on A0→A4 today — not where the slide deck says, but where the gates, the verifier, and the audit ledger put you? Seven questions across model inventory, verifier independence, audit chain, and human authority. The verdict is framed against peers, never as a grade — and it never leaves your browser.
A0 → A4 Self-Scorer
No email required to see your tier. Nothing you enter leaves your browser — the score is computed on this page.
Get your tier benchmark and the board-ready brief
The self-scorer gives you a tier in your browser. Subscribe and I’ll send the full A0→A4 brief written for a risk committee, plus a benchmark of where firms in your vertical actually land — the part a public repository can’t give you.
Double opt-in: one email to confirm. After that, the occasional governance note — no spam, no sharing, no selling, unsubscribe in one click.
The Open-Source Libraries
Inspect the methodology before you take a call.
Six permissively licensed pattern libraries — one per vertical, each with the same governance spine, all DOI-archived on Zenodo. These are reference implementations to inspect before any conversation — not drop-in production controls; the production track record is the career work above.
Governance patterns for AI agents in regulated finance — DEFCON-style readiness state machine, sovereign veto, hash-chain audit, autonomy ladder, EU AI Act mapping, shadow mode.
Commercial real estate sibling. The same spine plus three CRE-native gates — lease-abstraction provenance, fair-housing pre-flight, tenant-PII residency.
Healthcare payer governance — coverage, prior-authorization, and appeals decision classes under the rules a health plan answers to.
Standalone investment-adviser library — adviser-conduct controls mapped to the Advisers Act for buy-side and allocation agents.
Banking governance — model-risk effective-challenge, ECOA / Reg B adverse-action gating, and an OFAC reference workflow wired by the deployer.
Payments governance — OFAC screening, BSA/AML and Reg E controls, and a rail-finality / irreversibility gate for agents that move money.