Read access
Repository, deployment configuration, relevant logs, and architecture material.
AP–01 / production readiness
A written decision, not an open-ended discovery phase.
We establish what has been built, what prevents dependable use, what it will cost to resolve, and whether further investment is justified.
The question
Can this system become a service we should rely on?
A prototype can demonstrate that a model, integration, or workflow is possible. It does not establish that the system is controlled, measurable, supportable, or worth operating.
The assessment closes that evidence gap. It is designed for a decision-maker who needs a technically credible answer without commissioning another vague phase of work.
What you receive
A report your team can act on.
Every material conclusion is tied to observed evidence. Findings are written for both technical owners and the people accountable for the investment.
- 01System baselineWhat has actually been built, how it is deployed, and who owns each part.
- 02Evidence packReferenced findings across identity, data, permissions, behaviour, observability, and operations.
- 03Defect schedulePrioritised issues with severity, consequence, evidence, and recommended treatment.
- 04Target stateThe minimum architecture and operating model required for dependable production use.
- 05Delivery decisionA costed recommendation to remediate, selectively rebuild, or stop.
Assessment frame
Five connected areas of production readiness.
The exact findings differ by system. The assessment frame remains consistent enough to make omissions visible.
| Reference | Observed defect | Severity |
|---|---|---|
| A-01 | Identity and access boundaries | Critical |
| A-02 | Data provenance, retention, and exposure | Critical |
| A-03 | Evaluation coverage and release thresholds | Major |
| A-04 | Observability, incident reconstruction, and escalation | Major |
| A-05 | Ownership, runbooks, cost, and operational support | Minor |
What we need
Limited access, focused evidence.
We do not begin with a week of workshops. We ask for the smallest set of access and context needed to test the system against its intended use.
One working session
Up to 90 minutes with the person or team that knows the build best.
A real workflow
Representative data and the operational path the system is expected to support.
Questions
Before you commission it.
Is this a security audit?
No. Security is part of production readiness, but the assessment also covers architecture, AI behaviour, evaluation, operations, cost, maintainability, and delivery viability. Where formal certification or penetration testing is required, we will identify it rather than pretend this assessment replaces it.
Do we have to engage you for the remediation?
No. The report is written to stand on its own. Your team, the original supplier, or another partner can deliver against it.
What if the recommendation is to stop?
We explain why, identify anything worth retaining, and set out the least damaging way to close or redirect the initiative. Avoiding the wrong build is a successful outcome.
Can you assess a live system?
Yes. We adapt access and evidence collection to minimise operational risk. The report distinguishes immediate containment from longer-term improvement.
Next step
Tell us what is preventing release.
We will confirm whether the assessment is the right starting point and what access it requires.
Start a conversation