Ways to start
Build
The system, with the parts that are expensive to add later included from the first release.
The system itself, with the controls, audit trail and evidence built in from the first release. Retrofitting those into something already live costs several times what including them did.
What is examined
- The data model and its invariants, decided before code is written
- An authorisation matrix rather than checks accumulated across controllers
- Audit trail and access logging designed in, not derived from timestamps
- Retention and deletion enforced by the system
- Failure modes, retries and idempotency treated as design
What you get
The working system, and the evidence pack that describes it — kept current as the system changes rather than reconstructed when someone asks.
Suited to
- Regulated domains, where an auditor eventually arrives
- Systems that move, hold or owe money
- Multi-role platforms where permissions are the hard part
- AI running in production rather than in a demo
Not this
- Brochure sites and marketing pages
- Ordinary CRUD where being wrong costs nothing
- Work where the lowest bid decides the outcome
Ways to start
The other doors.
Fixed scope, one to two weeks
Production readiness review
Someone reads the system end to end and writes down what is actually true about it.
Fixed scope
Compliance readiness assessment
What a reviewer will ask for, what you can already answer, and what you cannot.
Monthly
Accountable architect
A named person owns the boundary, and is still there in eighteen months when it breaks.