Scope in writing. Test before go-live. Hand over the evidence.
The rules every engagement runs by, the method we use to check AI output, and how our deliverables line up with Malaysia's proposed AI governance rules.
How every engagement is run.
Assessment or diagnosis first
Larger work starts with a bounded assessment. A small support task starts with an estimate and a cap.
Written scope
Deliverables, assumptions, your responsibilities, exclusions, milestones and acceptance criteria, agreed before work starts.
Changes in writing
New scope goes through a change request with its own estimate.
Fixed fees for bounded work
Time-based billing only where the scope is still moving, and only with your agreement.
No early promises
No promised savings before we've seen the bill, and no promised dates or downtime windows before the work is scoped.
Handover included
Runbooks, rollback steps and a knowledge-transfer session close every delivery.
Contextual Validation Architecture. Four layers, applied in order.
CVA is the method our founder developed for preventing hallucination-class failures in enterprise AI.
Semantic context annotation
Labels each source with its meaning, owner, freshness and sensitivity. Catches answers built on the wrong or outdated source.
Precision filtering
Limits retrieval and tool access to the request and the user's permissions. Catches data shown to people who shouldn't see it.
Output validation
Checks claims against sources, business rules and expected formats. Catches unsupported statements and numbers that don't reconcile.
Confidence scoring
Scores each output against thresholds you set and routes low scores to a person. Catches uncertain answers sent without review.
Malaysia's proposed AI Governance Bill. What our engagements produce for each duty.
The National AI Office published a consultation paper in July 2026. As consulted, the Bill would cover companies that develop AI and companies that deploy it. It isn't law yet, and details may change.
| Duty in the consultation paper | What our AI engagements produce |
|---|---|
| Risk assessment and documentation | A use-case risk assessment, a register of data sources, a system description and the test report. |
| Transparency | Plain-language text telling users they're dealing with AI, and a short explanation of how answers are produced. |
| Human oversight | Confidence thresholds, review queues and named reviewers, tested before go-live. |
| Incident reporting | Trace logs, an incident runbook and a reporting template your team can use. |
This mapping describes our deliverables, not legal advice. Your legal team decides what the final law requires of you.
Your data stays in your environment. We build inside your own cloud account and region, with access that ends when the engagement does.
Data flows are designed with Malaysia's Personal Data Protection Act in mind, and each agent can read only what its task needs.