Research & development
Agentic frameworks
Agent systems with declared control flow, typed tool contracts, least-privilege access and a trace that can answer questions years after the run.
An agent is a program that decides what to do next. That is useful and it is also the whole problem: a system whose path through a task is discovered at runtime is a system nobody can price, reproduce or approve.
We build agents where the routing is declared and the judgement is delegated. The model decides how to read a document, what a passage means, whether the evidence supports a conclusion. An engineer decides which step follows which, where a human must approve, and what happens when confidence runs out.
What you get
Named artefacts, not a slide pack. Each one is a thing your team can open, run, or hand to an auditor.
| Artefact | What it contains |
|---|---|
| Task decomposition | The graph: named nodes, explicit edges, typed state, and the escalation path drawn before any code exists. |
| Tool contracts | Typed inputs and outputs per tool, exposed over MCP, with scopes bound to the calling agent rather than the system. |
| Policy layer | Least-privilege authorisation, quota and budget enforcement, redaction rules, and fail-closed defaults. |
| Trace format + store | Append-only event stream recording node transitions, tool calls, policy decisions and human interventions. Framework-independent. |
| Human-in-the-loop design | Approval gates that interrupt and resume from checkpoint, with the reviewer interface treated as a first-class component. |
| Agent evaluation suite | Trajectory scoring, tool-call precision and recall, escalation calibration in both directions, cost per resolved task. |
| Adversarial test set | Prompt-injection and tool-abuse cases run as part of the regression gate. |
How it runs
01 · 1–2 weeks
Frame
What decisions the system may make, what it must escalate, and what evidence a reviewer will need. Written before architecture.
02 · 3–6 weeks
Prove
One end-to-end path with real tools, real authorisation and the trace format in place from the start.
03 · 8–16 weeks
Build
Remaining paths, policy enforcement, reviewer interface, adversarial testing and the regression gate.
04 · 2–4 weeks
Hand over
Your engineers add a node, extend the evaluation set and interpret a trace, unaided.
What we use
Chosen per engagement against your constraints. We have no reseller relationships and no incentive to recommend one of these over another.
Orchestration & agents
Protocols
State & memory
Evaluation
Security
What we do not do
Knowing where our usefulness stops saves everyone a procurement cycle.
- We do not build agents with standing access to systems that can take irreversible action without a human gate. If that is the requirement, we will decline it and explain why.
- We do not recommend a framework before understanding the constraints. Several named above are excellent for prototyping and a poor fit for supervised processes; the reverse is also true.
- We do not add agent-to-agent protocol layers between components that ship together. That is a module boundary, not an organisational one, and the protocol buys nothing.
- We do not present emergent multi-agent behaviour as a feature. Where a single well-instrumented agent does the job, that is what we build.
Questions we are asked
Do we need MCP, A2A, or both?
MCP earns its place almost immediately. It removes repetitive tool integration and gives you one place to enforce authorisation. A2A earns its place at a genuine organisational or deployment boundary: two teams shipping independently, or a capability that must be swappable without redeploying the caller. If you are building both sides and shipping them together, you have a module rather than an agent, and it should stay a module.
Is a declared graph not just a workflow engine with a model attached?
The routing is declared; the work is not. Inside a node the model has real latitude, how to query, which passages matter, whether evidence supports a conclusion. What we remove is authority over which step comes next, because that is where auditability is lost and where cost variance is created. We also allow a bounded free-form node, with hard token and turn limits, where a task genuinely requires open-ended exploration.
How do you defend against prompt injection?
Layered, and without claiming it is solved. Least-privilege scopes so an injected instruction cannot reach tools the task does not need; typed tool contracts so malformed calls fail rather than improvise; human gates on irreversible actions; and an adversarial test set in the regression gate so a change that weakens a defence fails the build. We treat retrieved content as untrusted input throughout.
What happens when the framework we chose is obsolete?
The trace format is deliberately independent of it, because retention requirements outlive libraries. The evaluation set and golden data are plain artefacts. Replacing the runtime is then a migration rather than an archaeology exercise.
Can you work with the agent code we already have?
Usually. The common path is to keep the working parts, put a declared outer graph around them, add the trace format, and instrument evaluation, often before changing any of the model-facing logic.
Start with the constraint.
Most of these projects are shaped by what you cannot do rather than what you want. Data that cannot leave the estate, a model you cannot host with a third party, a decision somebody has to justify to a regulator. Tell us yours and we will say honestly whether we can work inside it.