Skip to main content

For mid-size and enterprise teams

AI agents that run inside your cloud, under your rules.

I design and build agents for teams with real systems and real reviewers. Your data stays in your accounts, and every step is traced.

Book a scoping call Read the security page
  1. Start here

    Architecture review

    A written plan for your systems, data flow and risks, with a fixed quote for the build.

    1 to 2 weeksYour tech lead joins the calls
  2. Then

    Pilot build

    One agent in your cloud, tested on your own past cases before it goes live.

    4 to 6 weeksYour team owns the repo
  3. Ongoing

    Retainer

    Fixed hours each month for changes, test runs and a monthly report.

    MonthlyHours agreed in writing
  4. The price for each is set after the scoping call. You get it in writing.

How it runs in your environment

Watch a real run move through the system.

This is run 1153 of my own lead agent, recorded step by step. It took 13.5 seconds and 32 steps. Each line in the log lights up its part of the diagram.

Reference architecture
How the agent runs inside your cloudAn enquiry enters your cloud and reaches the agent runtime. The runtime reads your settings, calls your model provider, checks the reply with a guard, writes to your CRM, alerts your team, emails the customer and saves a trace. Only the model call leaves your cloud.YOUR CLOUD · YOUR ACCOUNTS · YOUR SSOLEAD SOURCEYour web formCUSTOMERGets the replyAGENT RUNTIMERuns each stepSETTINGSPrices, rules, hoursGUARDChecks each replyCRMSaves the leadTEAM ALERTHot leads, at onceTRACE STOREEvery step, keptMODEL APIYour contractTHE ONLY CALL OUTHow the agent runs inside your cloudYOUR CLOUDLEAD SOURCEYour web formAGENT RUNTIMERuns each stepSETTINGSYour rulesGUARDChecks repliesCRMSaves the leadTEAM ALERTHot leadsTRACE STOREEvery stepEMAIL OUTReply sentMODEL APIYour contractONLY CALL OUT
Run 1153 · real timings0.0 s
  1. 0.10 sTrigger: website contactok
  2. 0.17 sQualify: AI lead scoring2.5 s
  3. 2.66 sQualify: parse outputtier: HOT
  4. 2.70 sGuard: check replypass
  5. 2.73 sConfig: fetch settingsok
  6. 3.02 sAlert: owner told0.7 s
  7. 3.82 sCRM: save lead2.0 s
  8. 6.14 sVisitor: AI reply written2.3 s
  9. 8.45 sVisitor: AI checker1.4 s
  10. 9.87 sVisitor: send email3.2 s
  11. 13.10 sRun: save recordai_sent

11 of 32 steps shown. Names removed.

How I test

Tested before it ships, and watched after.

You agree the pass bar before I build. The agent goes live only when it meets that bar on your own past cases.

Before release

A test set from your cases

I build a test set from your real past enquiries. We agree the pass bar together.

On every change

Tests run before each deploy

Automated tests run on every change. A failed test stops the deploy.

In production

Every run is traced

You can open any run and see each step. A person reviews a sample each week.

$ just test --all
All tests passed, 0 failed
run before every deploy · my own systems

Your data, step by step

You can see where each piece of data goes.

The numbers match the run above. See the full security page →

StepWhat dataWhere it livesWho can see itKept for
1 Enquiry arrivesName, email, messageYour cloudYour team, and me while I buildYou decide
2 Model callMessage text onlyYour model providerUnder your provider contractYour provider's terms
3 Guard checkDraft replyYour cloudNobody, it runs in codeIn the trace
4 CRM saveLead, score, notesYour CRMYour CRM usersYour CRM rules
5 Team alertShort summaryYour Slack or TeamsThe channel you pickYour chat rules
6 TraceEach step and its timeYour trace storeYour teamYou decide

Risk and rules

The known agent risks, each with a control.

I use the OWASP Top 10 for Agentic Applications (2026) as my checklist. Here are five. The security page lists all ten.

RiskWhat I doWhere you see it
ASI01 Goal hijackCustomer text is treated as data, never as orders. A guard checks each reply.Guard step in each trace
ASI02 Tool misuseEach agent gets only the tools it needs, from a fixed list.Tool list in the runbook
ASI03 Too much accessIts own accounts, least access, keys in your secret store.Your access logs
ASI08 Chain failuresTime limits and retries on every step. A failed step alerts a person.Alerts and traces
ASI10 Rogue agentOne switch stops the agent. You can turn it off at any time.Runbook, page 1

Working with one person

One engineer, with the paperwork your team needs.

You talk to the person who designs, builds and supports your system. Your team keeps everything needed to run it.

Who you work with

Moin Dalal

  • Agentic AI engineer, based in India (IST)
  • Online for the US and UK morning
  • Joins your team calls at those times
  • Designs, builds and supports your system
Paperwork

I sign your forms

  • Your NDA, before we share anything
  • Your MSA and your DPA
  • EU and UK transfer clauses (SCCs)
  • You own the code and the IP once paid
Continuity

Your team can run it without me

  • Code in your repository from day 1
  • A written runbook and the test set
  • A handover call with your engineers
  • You can remove my access at any time

Questions reviewers ask

Short answers for your security review.

Can it run in our own cloud?

Yes. I build on AWS, Azure or Google Cloud, in accounts your team creates for me.

Do you work under our SSO?

Yes. I use the accounts and access rules you give me. You can remove my access at any time.

Which AI model provider sees our data?

Yours. The agent calls your own Azure OpenAI, Bedrock, Vertex or direct provider contract. Team projects use no third-party router.

Do you hold SOC 2?

No. The agent runs inside your cloud, under your own controls. The security page shows what I do instead, with evidence for each row.

Will you answer our security questionnaire?

Yes. I have a filled-in standard questionnaire ready, and I answer yours in full.

Who owns the code?

You do, once paid. The code is in your repository from the first day.

Start

Book a 45-minute scoping call.

  1. Tell me about your systemsTwo minutes. No payment.
  2. We talk for 45 minutesBring your tech lead or security reviewer.
  3. You get a written scope and priceWithin 3 working days of the call.
How do you want to start?