02 / PRINCIPLES · THE WORKING DOCTRINE
Rules that were
paid for.
Every system in the fleet runs under a written rule set that loads before any code gets written — by a human or by AI. None of it is aspirational. Each rule below exists because its absence cost something real: money, an outage, an exposed port, a wrong answer delivered confidently. This page is that rule set, translated for guests.
The 95/5 rule
The core bet: roughly 95% of what AI should do is generate — code, assets, drafts, transforms — and roughly 5% is invention and judgment, which stays human. The industry keeps arguing about the 5%. The entire practical gain lives in making the 95% trustworthy, and that is a guardrails problem, not a model problem.
So the scaffolding comes first and the generation second. Thousands of lines of rules, canonical helpers, deploy gates, schemas, and test harnesses exist across the fleet not as product code but as the substrate AI builds from. Handed a blank page, a model produces a plausible demo. Handed the substrate — this database helper, this deploy path, this error format, these published criteria — it produces another room in a house that already stands. The same prompt, wildly different asset value. The difference is everything on this page.
The doctrine
Cite or delete.
Every factual claim carries a source — a file and line, a query result, a rerunnable command. A claim that cannot be cited is deleted, not hedged. Claims of absence carry the search that proved them: pattern, scope, zero hits. This applies to reports, dashboards, and anything an AI asserts on this practice’s behalf.
Numbers reconcile, or they’re wrong.
“Accurate” is an opinion; reconciled is a state. Margin dashboards tie out to the penny against finance’s own exports. AI spend reconciles nightly against the provider’s own cost report. A number that agrees with nothing external is a rumor with a decimal point.
The harness is the product — never the output.
When a generative run fails, the fix lands in the durable pipeline, never in the individual artifact. The discriminating test, verbatim from the fleet’s own rules: would this fix have prevented the failure for every future run, with no human touching it? If no, it’s a bandage, and it doesn’t ship.
Every dollar is disclosed before it’s spent.
Any loop that touches a paid API carries disclosed cost math, a hard stop, and live progress logging — before it runs. This rule has a scar: a batch job that was “about $80” and became a four-figure invoice in an afternoon. Caps, meters, and a killswitch are now architecture, not policy.
Nothing data-shaped touches the public internet.
Databases, caches, queues, buckets — reachable through connectors and allowlists, never an open port. Any change that widens access gets a written exposure check first: what opens, to whom, what breaks if it’s wrong, how fast it reverts. Least privilege per app, no superuser connections, ever.
One implementation, used everywhere.
Twenty-five production systems share one database pattern, one deploy command, one secrets hub, one logging wrapper. Before any helper is written, the fleet is searched for the one that already exists. Duplication isn’t a style problem — a stale copy beside a fixed original is how systems learn to lie.
Ship through the gate, every time.
Every commit is a deploy, and every deploy passes a secret scan and a smoke test before it goes anywhere. There is no “quick push.” The gate is boring on the ten thousand deploys where nothing is wrong, which is precisely the price of the one where something is.
Probe, don’t theorize.
When a provider misbehaves, a live probe with full raw-response capture answers the question before any theory gets written. Vendor dashboards lag; inference doesn’t. The same rule governs debugging generally: read the file, run the query, then speak.
Fix the system, not the instance.
An error that surfaces even once — even in a throwaway test — gets fixed at its source, not stepped around. Edge cases are messages from the architecture. Answering them per-incident is how a codebase accumulates the sediment that eventually stops it cold.
Done means verified, end to end.
A UI change means the page was loaded. A pipeline change means the output was watched. A data change means the query was run. “It should work now” is not a state of the world; it’s a forecast, and forecasts don’t close tickets here.
HOW AI IS ACTUALLY RUN HERE
Leverage, metered.
Model choice is routing, not loyalty
A database-driven catalog of providers with health probes, fallback chains ordered by measured speed and quality, and a lifecycle ladder — providers get demoted on evidence, never retired on mood. Which model answers a given call is infrastructure, not preference.
The expensive model is a gated exception
The default lane costs nothing and is architecturally forbidden from reaching the paid one — not discouraged, unable. Premium calls require explicit sign-off, per use. Most AI cost horror stories are architecture failures; this one can’t happen by construction.
Every call is attributed
Which app, which feature, which provider, what it cost — every AI call in the fleet lands as a structured row. Failures return the provider’s verbatim error inside a typed payload; consumers are forbidden from inventing their own error strings. When something breaks, the evidence is already collected.
Capability is built once, shared everywhere
Text, vision, image generation — one routed surface with one typed client, consumed by every system in the fleet instead of wired per-app. Adding a provider is a config row, not a project. DRY, applied to AI itself.
What this buys a client
Speed without the usual bill for it. The guardrails read like caution, but their actual effect is velocity: generation can be aggressive precisely because the gates catch what aggressive generation gets wrong. That’s how one operator ships and runs a fleet that spans revenue operations, games, AI platforms, media pipelines, and IoT — the breadth on the front page isn’t a team, it’s a method.
And it transfers. An engagement doesn’t leave behind a consultant’s dependency; it leaves the harness — your infrastructure, your keys, your gates, documented — plus systems that keep passing through it after the engagement ends. The method is the deliverable that makes all the other deliverables safe to keep.
Guardrails aren’t the brake. They’re why you get to drive fast.