Officers needed answers from decades of legislation, rulings and internal guidance. A wrong answer here is not an inconvenience, it is legal exposure. And none of the corpus could leave the authority's control.

Retrieval-grounded architecture where every answer traces back to a source document and passage. Role-aware access so an officer only ever retrieves what they are entitled to see. An evaluation harness for grounding and refusal behaviour before anything reached a real user.

Millions of images a year needed cloud-scale processing. The images contained identifiable faces. Shipping them to a public cloud as-is was never going to survive review, and should not have.

Face detection and redaction run on-premise, before anything crosses to Azure. The cloud only ever receives data that has already been made safe. Privacy stopped being a policy document and became a network boundary. Drawing A-01 above is this system, generalised.

Call audio arriving over SIP needed transcription and analysis fast enough to be useful during the call, not the next morning. Off-the-shelf connectors did not fit the telephony estate.

Custom Python middleware to bridge the SIP stream into the speech service, handling reconnection, back-pressure and ordering, then pushing results straight to a live operations dashboard.

Organisations were deploying AI systems with no consistent way to answer two questions: is this vulnerable, and is it compliant here? Existing tooling secured the infrastructure around the model, not the model's own behaviour. There was no team and no precedent to inherit.

CTO, head of function, technical lead and sole engineer. Product direction, architecture, implementation, release and support — every decision and every line of it mine.

Built end to end: vulnerability scanning and scoring for AI systems, plus a compliance scoring model mapped separately against UAE, Saudi, EU and US expectations, because "compliant" means four different things depending on where the workload runs.