Productized strategic engagements for CEOs and founders. Fixed shapes, fixed prices, fixed outcomes. Four guarantees. No agency-speak.
Personally - three clients at a time. No associates, no juniors, no delegation.
Platform engineering delivery at a regulated FinTech, through acquisition.
Head of IT / CIO - 40+ engineers, 99.98% uptime, AWS re-engineering.
Co-author of the open spec for autonomous agent authorisation.
Each sprint is a fixed-shape engagement carrying the four guarantees. Filter by moment, then open any sprint for the full spec. The price is named in the fit conversation, not negotiated - describe your situation in the matchmaker and the number comes with the match.
Build the tech foundation that survives the board, the audit, and the scaling.
Diagnostic for a legacy or inherited tech estate.
Independent audit of a steady-state engineering organisation against industry good practice.
Install the operating system - OKRs, KPIs, SLAs, SLOs, performance management cycle - in four weeks.
Strategic plan for integrating AI / LLM / agent capabilities into your product, responsibly.
Gap-closure programme for SOC 2, DORA, FCA Operational Resilience, or a sector-specific audit.
Tech-perspective GDPR programme: data flow mapping, ROPA, DPIA framework, vendor DPAs, data-subject-rights operating model, breach-response runbook.
Buy-side or sell-side tech due diligence delivered as a senior independent engagement.
Two weeks of senior recruiting infrastructure for one critical engineering hire - Staff+ IC or leadership role.
Design and stand up a Model Context Protocol server so AI agents can use your data and tools natively, with authorization that holds up.
Design and integrate per-request payment for an API that AI agents will call. HTTP 402 done properly - wallet, custody, compliance, and abuse-defence answered before they bite.
Put AI agents to work on a legacy estate - assess, map dependencies, containerize, and open governed pull requests - with the authorization model that lets you actually merge them.
Classify your AI systems under Article 6 and Annex III, scope Article 50 transparency and deployer-side duties on any GPAI models in use, cross-map to NIST AI RMF, and hand your board a readiness memo against the August 2 2026 deadline.
Inventory the agents and MCP servers already in production, design the authorization control-plane that should govern them, and ship the audit-trail specification your board (and your insurer) can defend.
The founder's pre-raise rehearsal - distinct from the auditor's lens. Walk the tech narrative end-to-end, stress-test the data-room, and hand your team an objection-handling playbook before the lead investor's DD partner arrives.
Trio bundles combine three sprints at a saving over booking them separately. The Quartet discounts any four sprints across a 12-month window. The Agency Partner Annual reserves capacity for the year. Exact figures come with the match.
Regulated-industry clients (fintech, healthtech, marketplace, edtech) where SOC 2 / DORA and GDPR converge.
Window: 4–6 months
Audit current operating posture → install the operating system that survives scale → hire the leader who maintains it.
Window: 4–6 months
Companies whose AI strategy needs all three layers - strategy, exposure to agents, monetization of agent traffic - and who are best served by doing them as one coherent program. Designed by the co-author of the WARRANT Standard.
Window: 4–8 months across the three sprints
Companies modernizing a load-bearing 10-15+ year codebase who need the work de-risked, governed, and independently signed off - especially pre-raise, pre-sale, or pre-enterprise-procurement. Map the estate → move the debt with a governed agent pipeline → independently attest the modernized system. Distinct from the Agentic Stack: that builds the agent-native product layer; this applies agents to the engineering process of clearing legacy debt.
Window: 4–6 months across the modernization programme
Companies that have shipped AI features and are now meeting the second wave of questions - from boards, enterprise procurement, regulators, and the security team. Strategy + governance + regulatory posture sequenced as one program. Distinct from the Agentic Stack: that bundle builds the agent-native product surface; this one builds the safety, authorization, and regulatory posture underneath it.
Window: 3–5 months across the three sprints
Companies or agencies with concurrent strategic moments across the year (sprint mix may be mixed across core and agency-only).
Window: 12 months from first sprint commencement
Sprint engagements solve one decision moment; fractional roles maintain strategic presence across many of them. Capacity ceiling: 0.60 across all concurrent fractional engagements.
In the room when it matters. Not in the room when it doesn't.
Posture: Pure advisory. Zero operational responsibility. Zero decision authority.
Best fit: Founders / CEOs / CTOs wanting a senior peer-grade thinking partner. Most engagements convert from a Foundation Sprint that closed well.
Independent senior tech voice on the board.
Posture: Non-executive. Formal board role with fiduciary posture.
Best fit: Series A+ companies, Series B candidates, companies approaching M&A. Particularly fitting for fintech / regulated.
Max 2 NED roles concurrently
Equity option in lieu of cash: 0.25%–0.75% vesting over 2 years. Combination structures (half cash + half equity) negotiable.
The CTO role, stripped of operational theatre. Strategy, architecture, hiring, vendors, board - yes. Standups - no.
Posture: Borderline operational. Sits in executive cadence; does not sit in delivery cadence.
Best fit: Companies between 15–80 engineers where permanent CTO isn't yet justified, is in transition, or where the founder has been carrying the CTO role unsustainably.
IT strategy and governance, executive-grade, for companies whose product engineering is healthy but whose IT operation needs senior leadership.
Posture: Borderline operational. Owns IT and platform-governance domain; does not own product engineering.
Best fit: Companies with healthy product engineering but where the IT, platform, security, and compliance side has out-grown ad-hoc. Regulated-industry / post-Series-B scale-ups.
AI strategy, governance, and integration design - frontier-grade, for companies where 'we need AI' has become 'we need AI responsibly and competitively'.
Posture: Borderline operational. Owns AI strategy and governance.
Best fit: Companies whose AI ambitions exceed what their existing engineering leadership has seen. Companies with regulated customers or serious agent-deployment plans.
Max 2 Fractional CAIO roles concurrently
The engineering leadership layer, on tap, for companies whose team has out-grown the founder-engineering-lead model.
Posture: Borderline operational. Engages with engineering leadership cadence.
Best fit: Companies at the 15–50 engineer mark where the engineering culture is being formed and the cost of getting people-and-process wrong now is high.
Bridge between two permanent CTOs. Time-bound. Designed-out within six months.
Posture: Operational. Carries the CTO role with a stated handover endpoint.
Best fit: Companies with a known CTO transition coming (departure, retirement, planned change). Also fits acquisition scenarios needing interim leadership.
Max 1 Interim CTO engagement at any time
Sub-sprint, named, fixed-scope units. Each one converts upward to a numbered sprint when the need scales. Pricing is named in the fit conversation.
One DPIA on a well-bounded processing activity, single-system, with existing data-flow documentation.
One DPIA on cross-system, multi-vendor, special-category, or novel ML/AI processing - including supervisory-authority consultation prep.
Three DPIAs across distinct processing activities, sequenced and cross-referenced.
Article 30-compliant Record of Processing Activities for a single business unit or product line, structured for ongoing maintenance.
Sub-processor inventory + DPA gap-list + Standard Contractual Clauses status + transfer-impact assessment scoping.
72-hour notification clock, decision tree, supervisory-authority drafting templates, internal communication plan, one tabletop exercise.
Independent facilitator for a high-stakes incident postmortem; structured write-up; remediation register with owners.
One senior-round technical interview (panel participation + structured write-up + calibration debrief).
One vendor decision (observability / IAM / CDP / search / data warehouse / similar) - weighted matrix, TCO math, recommendation memo.
One enterprise security / DPA / vendor-risk questionnaire drafted, reviewed, returned with the supporting evidence pack.
Audit on-call rota, paging discipline, incident-response posture, runbook coverage; prioritised remediation list.
One decision: OpenAI vs Anthropic vs open-source vs gateway routing - cost / latency analysis, recommendation, eval-gate plan; informed by WARRANT-Standard authorisation principles where agent behaviour is in scope.
Review of the tech section of a data room before opening to buyers - gap list, narrative coherence, risk pre-flagging.
One Architectural Decision Record-shaped engagement - option framing, weighted trade-off, design-review session, signed ADR artefact.
Review of the existing vendor / SaaS portfolio for overspend, overlap, renewal traps, and consolidation opportunities - quantified rationalisation plan with renewal-window calendar.
Pre-fiscal-year working session with CFO + CTO - tech budget model, headcount-vs-SaaS trade-offs, quarterly allocation, board-ready financial narrative and Q&A pack.
Architecture-led review of cloud spend - right-sizing, scaling patterns, environment hygiene, architectural inefficiencies driving cost. Not a line-item FinOps audit.
Software Bill of Materials across the codebase, open-source license inventory, copyleft/viral flagging, license-compatibility matrix, remediation list, regulatory-readiness note (EU CRA, enterprise procurement, M&A buyer-side legal).
Bootstrap one MCP server for a single existing API or data source. Tool definitions with input schemas, /.well-known/mcp.json manifest, robots.txt allowance, Claude Desktop and Cursor smoke-test. Hand-over package: code + deployment notes + observable behaviour.
Wire one endpoint to x402 on Base Sepolia. Test wallet, facilitator setup, server-side 402 response with payment requirements, verify-and-settle flow, receipt header echoed back, tested 402-pay-retry end-to-end. Foundation for the full Agentic Payments sprint when scope grows.
Stand up the governed agent pipeline on one bounded legacy service. Dependency map, containerization (Docker), an agent-opened pull request under branch protection and a human merge gate, characterization smoke-test, and a structured audit trail of agent actions. Proof-of-concept for the full Agentic DevOps sprint.
Inventory of every MCP server the company runs or consumes - first-party, third-party, registry-pulled. Per-server supply-chain audit: origin and publisher provenance, permissions surface, tool-call signing and message gating, secret-handling posture, kill-switch and revocation path. Findings mapped to OWASP MCP Top 10 and the current MCP-ecosystem CVE disclosure landscape. Deliverable: prioritised remediation memo with severity, owner, and fix-window.
Telemetry-backed discovery of agents and AI tools the company never centrally procured. Inputs: egress / DNS logs, SSO / IdP logs, repo SDK and dependency scans, expense-report keyword sweep, browser-extension audit. Output: a single inventory document - tool name, business unit using it, data classes touched, contract / DPA status, authorization posture, and a triaged risk register flagged against EU AI Act prohibited / high-risk categories and GDPR Article 28 / 30 obligations.
Agency-side mini for £200-600k pitches where the architecture narrative has to survive hostile AI and regulatory questioning in the room. Three-day artefact: architecture-and-approach one-pager, AI / agentic posture statement (WARRANT-aligned), regulatory pre-flight (GDPR / EU AI Act exposure call-outs), three anticipated hostile-question rehearsals with answers, optional named co-sign for the proposal. Scoping-call escape hatch if the pitch story doesn't hold.
Buyer-side AI-washing detector for PE / VC tech DD when AI capability is material to the valuation thesis. Model inventory (proprietary vs wrapped third-party APIs), training-data lineage and licensing posture, reproducibility audit on the claimed model artefacts, and an eval-pipeline existence check. Output: signed memo with a go / no-go recommendation on the AI premium in the valuation, plus the three follow-on questions for the next IC meeting. Pairs with Sprint 13 - EU AI Act Triage when the target is EU-HQ.
EU AI Act Article 17 quality management system framework readiness for one high-risk AI system (provider or deployer). QMS documentation outline mapped to Article 17(1)(a)-(m) sub-clauses, accountability ownership map across product / engineering / legal / risk, NIST AI RMF Govern + Map function cross-walk, and a gap register with prioritized remediation. Not a 'named AI officer' deliverable - that is best-practice scaffolding, not the statute itself.
Article 17 right-to-erasure readiness for AI / ML estates. Inventory of every place personal data lands - operational stores, warehouses, embeddings, vector indexes, fine-tuning corpora, model checkpoints, prompt logs, eval sets, backups. Per-surface deletion mechanism (hard delete, tombstone, re-embed, re-train trigger, retention expiry) with owner and SLA. Gap register flagging surfaces where deletion is technically impossible today.
Article 15-22 readiness audit when embeddings, vector stores, fine-tunes, or RAG corpora are in scope - the layer where personal data leaves the relational world. Inventory of where data-subject personal data has landed; access, rectification, erasure, and portability paths per surface; controller / processor split across model and infra vendors; supervisory-authority defensibility note. Technical-readiness memo + DSAR-handling runbook for the LLM / vector layer.
Design-only mini for the platform / AppSec team at a company where agent-generated code already merges to main. Signed gate specification, OWASP-Top-10-for-AI-output coverage matrix mapped to the existing pipeline, IaC permission-scope linting policy, and an eval-gate hookup design wired against the agent pipeline's PR stage. WARRANT-Standard-aligned authorization boundary. We design it; your platform team installs it.
Tabletop exercise plus incident-response runbook for agentic-AI failures on production data: paging tree for agent-driven incidents, decision tree for pause / revoke / rollback of agent authority, communication templates, one facilitated tabletop, and a written runbook the on-call rota can actually execute at 03:00. WARRANT-Standard authorisation principles frame the revoke / contain decisions. €3,500 as a Sprint 14 follow-on; €4,500 standalone.
Independent honest-reset on a new VP Eng / CTO at the 90-day mark, commissioned by the chair, lead investor, or PE operating partner - not the hiring CEO. Structured interviews with the new hire, direct reports, two peer executives, and the CEO; review of the first 90 days of artefacts (roadmap, hiring plan, architecture calls, on-call posture); written readout covering trajectory signal, three things going right, three things at risk, and the specific board-level decisions needed in the next 90 days.
| Code | Mini-engagement | Days | Converts upward to |
|---|---|---|---|
| A1 | DPIA (standard) One DPIA on a well-bounded processing activity, single-system, with existing data-flow documentation. | 5 days | ↑ GDPR Technical Compliance Sprint |
| A2 | DPIA (complex) One DPIA on cross-system, multi-vendor, special-category, or novel ML/AI processing - including supervisory-authority consultation prep. | 8–10 days | ↑ GDPR Technical Compliance Sprint |
| A3 | DPIA Bundle (×3) Three DPIAs across distinct processing activities, sequenced and cross-referenced. | 12–15 days | ↑ GDPR Technical Compliance Sprint |
| A4 | ROPA Build Article 30-compliant Record of Processing Activities for a single business unit or product line, structured for ongoing maintenance. | 5 days | ↑ GDPR Technical Compliance Sprint |
| A5 | Vendor DPA Review Sub-processor inventory + DPA gap-list + Standard Contractual Clauses status + transfer-impact assessment scoping. | 4 days | ↑ GDPR Technical Compliance Sprint |
| A6 | Breach Response Runbook 72-hour notification clock, decision tree, supervisory-authority drafting templates, internal communication plan, one tabletop exercise. | 4 days | ↑ GDPR Technical Compliance Sprint |
| A7 | Postmortem Facilitation Independent facilitator for a high-stakes incident postmortem; structured write-up; remediation register with owners. | 2 days | ↑ Engineering Health Check / Performance & Goals |
| A8 | Single Senior Interview Round One senior-round technical interview (panel participation + structured write-up + calibration debrief). | 0.5 days | ↑ Senior Engineering Hire Sprint |
| A9 | Vendor Selection (single decision) One vendor decision (observability / IAM / CDP / search / data warehouse / similar) - weighted matrix, TCO math, recommendation memo. | 3 days | ↑ Foundation Sprint / Tech Audit |
| A10 | Customer Compliance Questionnaire Response One enterprise security / DPA / vendor-risk questionnaire drafted, reviewed, returned with the supporting evidence pack. | 2 days | ↑ Compliance & DD Readiness Sprint |
| A11 | On-Call Health Check Audit on-call rota, paging discipline, incident-response posture, runbook coverage; prioritised remediation list. | 3 days | ↑ Engineering Health Check / Performance & Goals |
| A12 | LLM Vendor / Routing Decision One decision: OpenAI vs Anthropic vs open-source vs gateway routing - cost / latency analysis, recommendation, eval-gate plan; informed by WARRANT-Standard authorisation principles where agent behaviour is in scope. | 3 days | ↑ AI Integration Strategy Sprint |
| A13 | Data-Room Tech Section Audit Review of the tech section of a data room before opening to buyers - gap list, narrative coherence, risk pre-flagging. | 3 days | ↑ Acquisition Tech DD Sprint |
| A14 | ADR Facilitation One Architectural Decision Record-shaped engagement - option framing, weighted trade-off, design-review session, signed ADR artefact. | 3 days | ↑ Foundation Sprint |
| A15 | Vendor Portfolio Cost Review Review of the existing vendor / SaaS portfolio for overspend, overlap, renewal traps, and consolidation opportunities - quantified rationalisation plan with renewal-window calendar. | 4 days | ↑ Tech Audit / Engineering Health Check |
| A16 | Annual Tech Budget Advisory Pre-fiscal-year working session with CFO + CTO - tech budget model, headcount-vs-SaaS trade-offs, quarterly allocation, board-ready financial narrative and Q&A pack. | 5 days | ↑ Fractional CIO |
| A17 | Cloud Cost Architecture Review Architecture-led review of cloud spend - right-sizing, scaling patterns, environment hygiene, architectural inefficiencies driving cost. Not a line-item FinOps audit. | 3 days | ↑ Tech Audit / Engineering Health Check |
| A18 | SBOM & License Audit Software Bill of Materials across the codebase, open-source license inventory, copyleft/viral flagging, license-compatibility matrix, remediation list, regulatory-readiness note (EU CRA, enterprise procurement, M&A buyer-side legal). | 4 days | ↑ Acquisition Tech DD / Tech Audit |
| A19 | MCP Server Scaffold Bootstrap one MCP server for a single existing API or data source. Tool definitions with input schemas, /.well-known/mcp.json manifest, robots.txt allowance, Claude Desktop and Cursor smoke-test. Hand-over package: code + deployment notes + observable behaviour. | 5 days | ↑ MCP Server Implementation sprint |
| A20 | x402 Integration Pilot Wire one endpoint to x402 on Base Sepolia. Test wallet, facilitator setup, server-side 402 response with payment requirements, verify-and-settle flow, receipt header echoed back, tested 402-pay-retry end-to-end. Foundation for the full Agentic Payments sprint when scope grows. | 4 days | ↑ Agentic Payments sprint |
| A21 | Agentic Modernization Pilot Stand up the governed agent pipeline on one bounded legacy service. Dependency map, containerization (Docker), an agent-opened pull request under branch protection and a human merge gate, characterization smoke-test, and a structured audit trail of agent actions. Proof-of-concept for the full Agentic DevOps sprint. | 5 days | ↑ Agentic DevOps sprint |
| A22 | MCP Supply Chain Audit Inventory of every MCP server the company runs or consumes - first-party, third-party, registry-pulled. Per-server supply-chain audit: origin and publisher provenance, permissions surface, tool-call signing and message gating, secret-handling posture, kill-switch and revocation path. Findings mapped to OWASP MCP Top 10 and the current MCP-ecosystem CVE disclosure landscape. Deliverable: prioritised remediation memo with severity, owner, and fix-window. | 5 days | ↑ Agent & MCP Governance Sprint or MCP Server Implementation sprint |
| A23 | Shadow Agent & Shadow AI Inventory Telemetry-backed discovery of agents and AI tools the company never centrally procured. Inputs: egress / DNS logs, SSO / IdP logs, repo SDK and dependency scans, expense-report keyword sweep, browser-extension audit. Output: a single inventory document - tool name, business unit using it, data classes touched, contract / DPA status, authorization posture, and a triaged risk register flagged against EU AI Act prohibited / high-risk categories and GDPR Article 28 / 30 obligations. | 5 days | ↑ EU AI Act Triage Sprint or GDPR Technical Compliance Sprint |
| A24 | Pre-Pitch Technical Credibility Pack (Agency) Agency-side mini for £200-600k pitches where the architecture narrative has to survive hostile AI and regulatory questioning in the room. Three-day artefact: architecture-and-approach one-pager, AI / agentic posture statement (WARRANT-aligned), regulatory pre-flight (GDPR / EU AI Act exposure call-outs), three anticipated hostile-question rehearsals with answers, optional named co-sign for the proposal. Scoping-call escape hatch if the pitch story doesn't hold. | 3 days | ↑ Pitch Support Sprint |
| A25 | AI Acquisition Verification Memo Buyer-side AI-washing detector for PE / VC tech DD when AI capability is material to the valuation thesis. Model inventory (proprietary vs wrapped third-party APIs), training-data lineage and licensing posture, reproducibility audit on the claimed model artefacts, and an eval-pipeline existence check. Output: signed memo with a go / no-go recommendation on the AI premium in the valuation, plus the three follow-on questions for the next IC meeting. Pairs with Sprint 13 - EU AI Act Triage when the target is EU-HQ. | 5 days | ↑ Acquisition Tech Due Diligence Sprint |
| A26 | Article 17 + Accountability Readiness EU AI Act Article 17 quality management system framework readiness for one high-risk AI system (provider or deployer). QMS documentation outline mapped to Article 17(1)(a)-(m) sub-clauses, accountability ownership map across product / engineering / legal / risk, NIST AI RMF Govern + Map function cross-walk, and a gap register with prioritized remediation. Not a 'named AI officer' deliverable - that is best-practice scaffolding, not the statute itself. | 6 days | ↑ EU AI Act Triage Sprint or Compliance & DD Readiness Sprint |
| A27 | GDPR Deletion-Readiness Register Article 17 right-to-erasure readiness for AI / ML estates. Inventory of every place personal data lands - operational stores, warehouses, embeddings, vector indexes, fine-tuning corpora, model checkpoints, prompt logs, eval sets, backups. Per-surface deletion mechanism (hard delete, tombstone, re-embed, re-train trigger, retention expiry) with owner and SLA. Gap register flagging surfaces where deletion is technically impossible today. | 5 days | ↑ GDPR Technical Compliance Sprint |
| A28 | DSAR-Against-LLM-Stack Article 15-22 readiness audit when embeddings, vector stores, fine-tunes, or RAG corpora are in scope - the layer where personal data leaves the relational world. Inventory of where data-subject personal data has landed; access, rectification, erasure, and portability paths per surface; controller / processor split across model and infra vendors; supervisory-authority defensibility note. Technical-readiness memo + DSAR-handling runbook for the LLM / vector layer. | 5 days | ↑ GDPR Technical Compliance Sprint or AI Integration Strategy Sprint |
| A29 | Agent-Generated Code AppSec Gate Design Design-only mini for the platform / AppSec team at a company where agent-generated code already merges to main. Signed gate specification, OWASP-Top-10-for-AI-output coverage matrix mapped to the existing pipeline, IaC permission-scope linting policy, and an eval-gate hookup design wired against the agent pipeline's PR stage. WARRANT-Standard-aligned authorization boundary. We design it; your platform team installs it. | 4 days | ↑ Agent & MCP Governance Sprint or Agentic DevOps Sprint |
| A30 | Agent Incident Tabletop & Runbook Tabletop exercise plus incident-response runbook for agentic-AI failures on production data: paging tree for agent-driven incidents, decision tree for pause / revoke / rollback of agent authority, communication templates, one facilitated tabletop, and a written runbook the on-call rota can actually execute at 03:00. WARRANT-Standard authorisation principles frame the revoke / contain decisions. €3,500 as a Sprint 14 follow-on; €4,500 standalone. | 4 days | ↑ Agent & MCP Governance Sprint or Fractional Chief AI Officer |
| A31 | Senior Hire 90-Day Board Readout Independent honest-reset on a new VP Eng / CTO at the 90-day mark, commissioned by the chair, lead investor, or PE operating partner - not the hiring CEO. Structured interviews with the new hire, direct reports, two peer executives, and the CEO; review of the first 90 days of artefacts (roadmap, hiring plan, architecture calls, on-call posture); written readout covering trajectory signal, three things going right, three things at risk, and the specific board-level decisions needed in the next 90 days. | 6 days | ↑ Tech Board Member / NED continuing engagement |
If after the first sprint the work isn't justifying continuation, you pay only Sprint 1 and the engagement ends.
If your board rejects a deliverable on substantive grounds, it's reworked at no charge.
Maximum three concurrent clients. No delegation, no associates, no juniors.
Every recommendation is one the Consultant would execute if the company were his own.
Five NDA-safe sample artefacts - Diagnostic Report, Systems Map, Vendor Shortlist, 12-Month Roadmap, Board Deck - built on a fictional Series A B2B fintech (Marlowe & Park). Available after a brief acknowledgement: samples are watermarked, sent PDF-only, and not for redistribution.