Selected work.

What it does

Reproduces a public filing journey end to end, with every figure, deadline and account state editable, so a finance team can be walked through the journey they will face.

The control

Rehearsal. Nothing in it touches a live filing.

Failure

Meeting an overdue payment, a rejected return or a liability that does not reconcile for the first time on a real return.

Unit of work

A journey walked through, rather than a return learned on.

Authority

• Acts alone Renders any account state on demand, including states a live account cannot be put into.
• Asks first Nothing, because it has no live counterparty to ask.
• Refuses Any route to a live filing endpoint. It holds no live credentials and there is nothing for it to hold them against.
• Never exceeds Its own environment. Every account in it is fictional and stays that way.

Named systems

Two-factor sign-in · business account · payroll · indirect tax · corporate tax

Claims

That an administrator meets an overdue payment, a rejected return and an unreconciled liability before a real one arrives. The first cohort reached independent filing in five weeks rather than eleven. At scenario inputs of 120 administrators a year, six weeks of 20 supervised hours a week and $85 an hour, a separate enterprise sensitivity model values released supervision at $1.224 million a year.

Non-claims

Any avoided penalty. An error that did not occur has no cost to measure, and a figure built on one would not survive a buyer checking it.

Evidence held

Across the first nine administrators trained in it, amendments in their first quarter fell from 2.4 each to 0.6.

Status

In production

Read the case →

What it does

Submits batches of journal entries into an accounting ledger, having first read what is already in it.

The control

It refuses any transaction matching one already posted, or another in the same run, on date, amount, counterparty, direction and account. Refusal is the default state and overriding it is an explicit, deliberate act.

Failure

A debt or credit posted twice, a bank reconciliation that will not tie, and three weeks spent finding out why.

Unit of work

A batch checked, rather than a posting typed. Fifty transactions per write.

Authority

• Acts alone Reads the existing ledger, groups postings into batches of fifty, and records an exit status that tells a clean run from a partial one.
• Asks first Every commit. An operator confirms before a single posting is written.
• Refuses Any posting that matches on all five fields. One difference is enough for it to be written.
• Never exceeds A write budget. The run stops at the budget rather than at the end of the batch, so the worst case is bounded before it starts.

Named systems

Xero · batch write API · double-entry ledger

Claims

Measured: about 1,800 duplicate journal entries a year became none, with 1,740 refused before commit in year one, and year-end clean-up fell from three weeks to under a day. The operation had 18,000 subscriptions; that count is context, not a multiplier. Applying modelled $200 to $400 of debt-or-credit exposure plus $50 to $100 of resolution work to the measured 1,740 refusals gives $435,000 to $870,000 of annual value at risk.

Non-claims

That the dollar range is an audited saving. It is a sensitivity model whose debt, credit and resolution assumptions are published on the case page.

Evidence held

The ledger history, refusal log and year-end reconciliation: about 1,800 duplicates a year became none, with 1,740 stopped before commit in year one.

Status

In production

Read the case →

What it does

Reads years of correspondence at scale, classifies every counterparty, and aggregates each into a profile: how much passed between you, in which direction, and how long ago it went quiet.

The control

A person decides which relationships are worth reviving. Nothing reaches the CRM before that sign-off.

Failure

A CRM populated by hand only ever captures the relationships somebody already remembered.

Unit of work

A decision per relationship, rather than per message.

Authority

• Acts alone Reads and classifies, checkpointed so an interrupted run resumes rather than restarts.
• Asks first Every write. Not one profile reaches the CRM without a person approving it.
• Refuses To treat a classification as a decision. Machine traffic is separated from people, and the separating is where its job stops.
• Never exceeds Read access to the mailbox and write access to nothing until sign-off.

Named systems

Google Workspace · Microsoft 365 · two implementations, no shared runtime code

Claims

Forty thousand messages judged at three seconds each take about thirty-three hours; about four thousand pre-classified correspondents judged at two seconds each take a little over two hours. At enterprise scenario inputs of one million messages, 100,000 counterparties, 90 seconds a review and $100 an hour, a separate sensitivity model removes 900,000 review decisions and values the 22,500 released hours as a one-off $2.25 million of operating capacity.

Non-claims

That this client measured either figure. They did not, and the page it appears on says so in the same sentence.

Evidence held

Of four thousand correspondents, 2,610 classified as machine traffic and 1,390 as people or organisations. The client’s team approved 412 into the CRM, 147 of which had been quiet for more than two years.

Status

In production

Read the case →

What it does

Listens continuously to a live mix, separates speech from music, adjusts as the room changes, and coaches whoever is at the desk in plain language on a phone or a projector.

The control

Every action it can take is safety-classified. A kill switch, a rollback and a manual override sit above all of it.

Failure

Output quality that depends on whichever volunteer is at the desk that day, going to FM, Zoom and YouTube at once.

Unit of work

Competence that travels with the system, rather than with the individual.

Authority

• Acts alone Listens, classifies the room, and coaches. It also captures the station’s own broadcast off air and compares it against the desk output.
• Asks first Every destructive change. The operator is asked and the operator decides.
• Refuses To act outside its safety classification, and to continue at all once the kill switch is thrown.
• Never exceeds The desk. It never touches the broadcast chain it is listening to.

Named systems

Soundcraft Ui24R · FM · Zoom · YouTube

Claims

Deployed across four venues in three countries, with the same safety classification, operator consent and override hierarchy at every desk.

Non-claims

A measured time saving or audio-quality uplift. The deployment footprint is confirmed; a comparable cross-venue performance series has not been supplied.

Evidence held

Four venues in three countries.

Status

In production

Read the case →

What it does

Holds a change to a fixed sequence of review, quality assurance, release and sign-off, and denies the merge outright if a stage is missing, has expired, or does not bind to the change it claims to cover.

The control

The denial itself. Each stage leaves a tamper-evident receipt chained to the one before it.

Failure

Where agents write production code, nobody can otherwise show that the review happened.

Unit of work

Evidence produced as a by-product of doing the work, rather than assembled afterwards for an auditor.

Authority

• Acts alone Verifies the chain and reports what it found, on every merge attempt.
• Asks first Nothing. It has no decision to delegate, only a fact to check.
• Refuses The merge, when a stage is missing, has expired, or binds to a different change.
• Never exceeds It never approves on anyone’s behalf. Refusing is the only thing it can do.

Named systems

Client has not disclosed the stack

Claims

The mechanism, which is verifiable: a merge that skipped a stage is denied by a receipt chain bound to the same commit. At scenario inputs of 10,000 changes a year, 40 minutes of evidence reconstruction per change and $150 an hour, a separate enterprise sensitivity model values released assurance capacity at approximately $1 million a year.

Non-claims

Any defect-cost multiple. The figures in circulation are old and softly sourced, and would not survive a buyer checking them.

Evidence held

Run on one production software project, with receipts emitted inside the ordinary delivery path.

Status

In production

Read the case →