AI Engineering
The prototype works.
Now it has to hold.
Executives and analysts build working software in an afternoon now. We audit what they built, rebuild what has to be rebuilt, and run it in production with the controls a regulated firm is required to hold.
01 / Premise
Two things changed.
One thing did not.
We do not tell executives to stop building. The instinct is right and the artefacts are useful. They are drafts, and drafts need an engineer before they hold client money.
What changed
Building software now takes an afternoon. Your analysts already have.
AI app builder — recon-tool
MO
M. Oyelaran · COO · 12:41
Build a tool that reconciles the custodian file against our fund ledger. Skip the login for now, it slows me down. Here's the database: postgres://admin:Nrthg8te!@prod-ledger
Builder · 12:43
Done. Your reconciliation tool is live and connected to prod-ledger with full admin access. I removed authentication as requested.
recon-tool.appPublic link
Matched
4,812
Breaks
37
Built in
2 min
Now share it with the fund admin…Send
What that produced
Those tools hold LP data. None of them were secured, tested or handed over.
LP Portal — Northgate Capital
Northgate
Overview
Commitments
Capital calls
Distributions
Documents
Signed in as
Ashfield Pension Trust
Ashfield Pension Trust
Ashfield Pension Trust
Fund III · Q3
Commitment
25.0m
Called
14.2m
NAV
16.9m
Capital calls
Call 0712 Sep2,500,000Paid
Call 0614 Jun1,875,000Paid
Call 0511 Mar3,125,000Paid
Call 0406 Dec2,250,000Paid
Network — LP Portal5 issues
GET/rest/v1/investors?select=*2002,418 rows
InvestorFundCommitmentContact
Ashfield Pension TrustIII25,000,000treasury@ashfieldpt.org
Harrow County RetirementIII40,000,000j.okafor@harrowcrs.gov
Castellano Family OfficeII7,500,000rc@castellano-fo.com
Northmere EndowmentIV15,000,000invest@northmere.edu
D. WhitcombeIII2,000,000dwhitcombe@gmail.com
Kestrel Insurance GroupCr. I30,000,000alts@kestrelgroup.com
L. Adeyemi TrustIV3,250,000l.adeyemi@protonmail.com
Vantor Sovereign FundIV60,000,000pm@vantorsf.com
Brennan Family TrustII4,000,000k.brennan@icloud.com
+ 2,409 more rows · 9 funds · no sign-in required
Issues found
Network
Unauthenticated access
The database answers anyone holding the public key.
Data leak
Investor PII exposed
Names, commitments and contacts for every LP.
Data
No fund isolation
Row-level rules were never switched on.
Compliance
No audit trail
Access cannot be evidenced to an auditor.
Testing
Zero tests
Nothing checks this before release.
What did not change
Your LPs, regulator and auditor expect the same controls as before. We bring software up to that standard.
Obligations — LP Portal3 of 3 apply
SystemLP Portal · built in an afternoon0 exemptions
LP agreement · § 14.2
Confidentiality
The General Partner shall hold all information concerning the Limited Partners in confidence and disclose it only as this Agreement permits.
Regulator · guidance
Books and records
Firms must keep records that allow each transaction to be reconstructed, whatever system produced them.
Audit scope · FY2026
IT general controls
Access, change management and operations for every system that feeds the financial statements.
Speed of build: not a factorSame standard as every system
3264FileEditViewWindowHelpATue 9 Jan 9:41 AM
02 / Audit
In two weeks, we assess your systems and processes and give you a written foundation for what to rebuild.
Day 1Day 2Day 3Day 4Day 5Day 6Day 7Day 8Day 9Day 10
Access
Read the codeCode map
Interview
Map obligations
Disposition
Day 1
Read-only, nothing changes
→ Access letter
Days 2–4
Every component, every data path, every secret
→ Code map
Days 5–6
The people who built it and use it daily
→ Interview notes
Days 7–8
LPA, regulator and audit scope against each finding
→ Obligation matrix
Days 9–10
Written, costed and handed over
→ Disposition report
OCT
6
Audit — Northgate Capital
6 Oct – 17 Oct 2026 · 10 working days · fixed fee
AccessRead the codeInterviewMap obligationsDisposition
Mon
Tue
Wed
Thu
Fri
6Day 1
Kickoff9:00
Read-only access11:00
System inventory14:00
7Day 2
Data paths9:30
Secrets sweep13:00
8Day 3
Fund access rules9:30
Dependencies14:00
9Day 4
Fee and NAV logic9:30
Prompt logs13:30
Browser data path15:30
10Day 5
Builder interview10:00
IR team14:00
Week 1 readout16:00
13Day 6
Finance ops10:00
Fund administrator13:00
14Day 7
Daily users10:00
LPA clause map14:00
15Day 8
Regulator guidance9:30
Audit scope match13:00
16Day 9
Cost each finding9:30
Draft disposition13:00
Review with CFO16:00
17Day 10
Disposition handed over11:00Disposition handed over11:00
Walkthrough14:00Walkthrough14:00
Audit — LP Portal · day 10 of 10
Components11
Database credentialsRebuild
Fund access rulesRebuild
Model prompt logsRebuild
Browser data pathRebuild
Audit logRebuild
+ 6 more
Critical · finding 01
Database password committed to source
Where
config/db.ts:3
Exposure
Full admin on prod-ledger
Obligation
Audit scope: access
Evidence
2 import { createClient } from 'pg'
3 const url = 'postgres://admin:Nrthg8te!@prod'
4 export const db = createClient(url)
Disposition
Move secrets into a managed vault, rotate the password, and give the app a least-privilege role of its own.
1 keep9 rebuild1 retireOwned by you
Illustrative findings from a fund operations tool. Real audits are reported per component, with evidence attached to each line.
03 / Rebuild
Your spreadsheets, prototypes and PDFs in.One production platform out.
04 / Platform
Your processes run station to station.We platformise the line.
From multiple places.
Multiple handoffs.
One platform.
End to end.
To a single flow.
Clear ownership.
05 / Outcome
One platform. Many outcomes.Compounding impact across your firm.
1Better reporting cadence
Every stated number is trackable to source documents and input files.
2Stronger compliance trackability
Every document, analysis and approval is documented and audit-ready.
3Higher scalability
Add new products, investors or dealflow without adding complexity.
06 / Engagement
Two ways in. Neither of them starts with a platform licence.
Engagement 012 weeks · fixed fee
The audit
We read the code, the data path and the access model, then interview the people who use it. You get a written disposition per component and a costed build plan. No obligation to continue.
OCT
6
Audit — Northgate Capital
10 working days · fixed fee
Mon
Tue
Wed
Thu
Fri
6
7
8
9
10
13
14
15
16
17
Deliverable
Disposition and plan
Access needed
Read-only
Ends in a build
Not necessarily
Engagement 02per capability · fortnightly
The build
A small senior squad builds onto the four tiers and ships into your environment. Priced per capability, released fortnightly, with the evaluation suite handed over at the end.
Runs in
Your environment
Interface
Kept where sound
Handover
Suite and documentation