Work

Nine problems, and what each one turned out to be about.

Every one is written the same way: what was happening, why it mattered, what was decided and what came of it. If you want the methods and the architecture, each case carries them in a section you can open. Nothing is assumed of you to follow the story.

Organisations are anonymised deliberately. The point of each example is the decision, not the logo. Where something was published afterwards, it is linked.

All nine

Start here

Three that show the range.

A legacy estate that had to disappear on a deadline. An AI system that needed real limits on its authority. A model that removed a costly step from a real customer process.

Ninety days to retire an estate of legacy systems

Replacing a fragile collection of ageing systems before a failure made the decision for us.

Rows of box files on open shelving, seen straight on — Everything in its place, and no way to find any of it.

What was happening

An organisation in the trust and advisory sector was running on systems that had quietly stopped being safe. Documents held with no version history and no record of who changed what. Correspondence sitting on a server the manufacturer no longer supported. Years of scanned paper that could only be found by someone who already knew where it was. And a piece of software that nobody left in the business knew how to rebuild.

Why it mattered

None of it had failed yet. That is the normal position and it is the dangerous one. A system can look healthy right up until the moment the one machine, or the one person, keeping it alive disappears. In a regulated business the day it finally goes tends to be an audit or an incident rather than a quiet Tuesday, and by then the choice has been made for you.

The decision

Move the whole estate inside ninety days rather than repair it piece by piece. Doing it gradually would have meant paying for the old arrangement and the new one at the same time, and carrying the same risk for longer while doing so.

What changed

Everything moved, on schedule. The unsupported server went. The software nobody could rebuild was rebuilt, so it no longer depends on a single machine or a single memory. The paper archive became searchable text. Reporting moved onto a platform the organisation itself controls.

Result

Finding a document fell from hours to seconds. A substantial share came off the annual licensing bill, because retiring the old systems retired what they cost to license. Most of the intended users were working in the new systems inside the first month, which is what actually decides whether a migration worked or merely finished. And recovery was not assumed. It was demonstrated, in a ransomware exercise.

How it worked technically

One component survived only as a compiled artefact, with no source and nobody left who had written it. It was reverse-engineered and containerised, which removed the dependency on one host and made it reproducible from a build file instead of from institutional memory.

The scanned archive went through optical character recognition and was indexed for full-text retrieval. Scan quality varied enormously across it, so the indexing had to tolerate poor source material rather than assume clean text.

Reporting was rebuilt on a cloud analytics platform under the organisation's own tenancy. The licensing reduction came mostly from retiring overlapping products, not from renegotiating any single one of them.

Recovery was tested against a simulated ransomware event, measuring how long a restore actually took and how much recent work it lost, rather than accepting a documented target as evidence that either number was true.

Client anonymised. Only the problem, the decisions and non-identifying outcomes are described here.

An AI agent is privileged infrastructure

When AI can read company information and take action, its access deserves the same scrutiny as a powerful employee account.

A curved concrete wall meeting a plain floor in low light — A door is only a door until somebody decides who holds the key.

What was happening

Organisations were connecting AI systems to their own documents, their own tools and, increasingly, to the ability to do things rather than only answer questions. The connection is usually made by whoever is closest to the problem, quickly, and to be helpful.

Why it mattered

Giving an AI system access to a tool is much closer to giving a new employee a company account than to installing an application. It can read whatever that account can read and act wherever that account can act, without any of the judgement about consequences that a person brings, and without any reluctance to do something irreversible.

The decision

Treat such a system as privileged infrastructure from the beginning rather than as a productivity feature that the rules would catch up with later. In practice that means deciding what it may see, what it may only suggest and what it may actually carry out, before anyone chooses a model.

What changed

The questions stop being about the model and start being about authority. Who is this system when it acts? Where do its requests travel, and which other companies handle them on the way? What happens when a document it reads contains instructions written to manipulate it? Can anyone reconstruct what it did afterwards, and stop or reverse it?

Result

Security, identity and AI governance stop being three departments with three budgets and three different answers. Settled in advance, this is an afternoon's conversation. Settled afterwards, it is an incident.

How it worked technically

The control surface is agent authorisation: explicit separation of read, recommend and execute, with a distinct workload identity per agent rather than a shared service account, short-lived credentials and least privilege on every tool binding.

Reconstruction requires telemetry at four points: which model served the request, which tools were called with which arguments, what data was accessed, and what changed as a result. Without the fourth, an investigation can describe intent but not effect.

External content an agent reads is untrusted input that may carry instructions addressed to the agent rather than to the reader. Treating retrieved documents, web pages and email bodies as data rather than as instruction is a design decision, not a filter that can be added afterwards.

Provider governance covers subprocessors, retention, training use and the jurisdiction in which processing happens, and it has to survive the provider changing any of them.

Read why the AI threat is usually misread Read on cloud and AI where the obligations are heaviest

A price without the site visit

Everyone in the marketplace was waiting on the same thing: somebody driving out to measure the job.

Wind ripples running across a dune, photographed from above — The shape of the ground, read without walking over it.

What was happening

Quoting this kind of work meant sending somebody out to look at it first. The homeowner waited days for a number. The trade firm wrote offers by hand, and most of those offers never became work.

Why it mattered

That visit was most of what an estimate cost to produce, and it was being spent on jobs that mostly would not happen. Both sides of the marketplace were paying for it, and both were waiting on it.

The decision

Stop trying to predict the price. Predict the size of the job instead. Size is a physical fact recorded on thousands of completed projects. Price is an opinion laid on top of it, and opinions are much harder to learn from.

What changed

A model trained on completed projects estimated how big a job was directly from its description, so the scale of the work could be established without anyone travelling to measure it. A second method addressed the other complaint: three quotes arriving with three very different numbers on them.

Result

Roughly a fifth came off what evaluating a job cost the customer. Offers could be issued immediately rather than after days of exchange, taking close to a fifth off the time spent producing them. Both approaches were filed for patent consideration.

How it worked technically

The size model is supervised learning over completed projects, with job size as the target rather than price, which keeps the label objective and removes the pricing behaviour of individual firms from what the model learns.

The convergence method is polynomial interpolation over historic offers, which strips out per-firm bias and narrows the range to something a customer can act on rather than arbitrate between.

Underneath both sits a multi-year data strategy that decided what the models were permitted to learn from. A model predicting job size is only ever as good as the records it was given, and those records are a product decision made years earlier.

Both models were filed for patent consideration, which is why neither is written up. The company is simply not named here.

More work

Coordination, organisations and the traps in the data.

Where the technology was the easy half, and the difficulty was in everything around it.

Teaching a fleet to fly in formation

One drone is an engineering problem. A fleet of them holding a shape in the sky is a coordination problem wearing the same clothes.

A large flock of birds turning together against a pale sky — Thousands of them, no leader, no collisions. All of it is the coordination.

What was happening

Flying a single aircraft reliably is a solved problem with parts you can buy. Flying many of them together, in a deliberate pattern, in public, is not.

Why it mattered

Almost none of the difficulty is flight. It is knowing precisely where each unit is, keeping the information flowing honestly at distance, and having already decided what happens when one of them stops answering while it is still in the air.

The decision

Design the failure behaviour first and the choreography second. What a fleet is allowed to attempt should follow from what it is guaranteed to do when something goes wrong, not the other way round.

What changed

Battery capacity sets flight time, flight time sets what patterns are possible at all, and the lights have to be bright enough to read from the ground while staying light enough to carry. Those constraints, taken seriously, decide the design long before any creative choice does.

Where it stands

Venture work, still being built. The interesting part has consistently been everything that has to be true before anyone is permitted to take off.

How it worked technically

Centimetre-level positioning, telemetry that stays reliable at range, and power budgets that bound the whole design. The safety model is defined in terms of what each unit does autonomously when it loses contact, not in terms of what an operator will do about it.

Current venture work. Nothing published yet.

The org chart is not the organisation

Communication data revealed which people actually held the teams together, without the analysis becoming a way to watch anyone.

A dense tangle of pale rope filling the frame — The real structure, which is never the published one.

What was happening

Every company has a formal structure and a real one. The formal one is published. The real one is visible in who actually talks to whom, and it is usually nobody's job to know it.

Why it mattered

Decisions about reorganisation, succession and where to place effort were being made against the published chart, which is the less accurate of the two descriptions and the one that hides its errors.

The decision

Map the communication patterns across a large software business, and design the privacy boundary before running the analysis rather than after seeing what it produced.

What changed

The map surfaced people holding entire functions together while sitting nowhere near the top of the chart, and showed precisely where information stopped moving between teams.

Result

The same technique is a surveillance tool if handled carelessly. The genuinely hard part was not the analysis. It was building something that could answer questions about the network without ever becoming a way to watch an individual, and that sat inside privacy law rather than alongside it.

How it worked technically

The graph is built from message metadata only, never content: who corresponded with whom, how often, in which direction. Structural measures over that graph identify brokers between otherwise weakly connected groups.

The privacy design does the real work. Results are reported at group level with minimum-size thresholds, purpose is fixed before collection rather than discovered afterwards, and no view in the system resolves to a single named person. That constraint removes some analyses entirely, which is the correct outcome.

Read how to find the people who hold an organisation together Read how to do it without it becoming surveillance

Ice cream and murder

Why two things moving together does not mean one caused the other, and why product teams lose money to that mistake.

A river delta from the air, channels branching through pale sand — Two channels rising and falling together. Neither one is causing the other.

What was happening

Ice cream sales and murder rates rise and fall together. Nobody concludes that ice cream causes murder, because the summer is obviously causing both.

Why it mattered

Product teams make exactly this mistake constantly, with variables where the summer is not obvious. A feature correlates with customers staying, so it gets invested in. The hidden cause is that already-committed customers are the ones who go looking for the feature.

The decision

Before spending against a correlation, look for the thing that could be causing both sides of it. This is cheap to do and it is almost never done, because the correlation already agrees with what somebody wanted to build.

What changed

Framed this way, most data-driven product work turns out to be the search for hidden causes wearing a different job title.

Result

The mistake is not random. It sends investment in a predictable direction: towards whatever the most engaged customers already do, and away from whatever would have brought new ones.

How it worked technically

The formal name for the hidden third variable is a confounder, and the discipline for handling it is causal inference. The practical tools are controlling for the suspected common cause, stratifying the population before comparing, and preferring an experiment over an observation whenever one can be afforded.

Read the full argument

Infrastructure and measurement

Where the argument was settled by going and looking.

Three problems that were not solved by asserting anything. Somebody had to go and take the measurement.

How to know when an operations team is about to fall behind

Support teams are sized by last year's headcount plus a percentage. There is arithmetic that answers the question properly.

Rippled sand in raking light, receding into the distance — Flow looks steady right up until the moment it does not.

What was happening

Operations teams are usually sized by intuition. Last year's headcount, plus something for growth, minus whatever the budget will not carry.

Why it mattered

This works until it abruptly does not. Waiting times do not degrade gently as a team gets busier. They hold steady, and then they go vertical, and by the time a backlog is visible on a report it is already structural.

The decision

Use the numbers the team already has. How much work arrives, how fast it is handled, and therefore where the cliff is, before anybody drives off it.

What changed

The staffing conversation stops being a negotiation about opinions and becomes a calculation with a defensible answer, including the uncomfortable one: that the team is closer to the edge than anyone thought.

Result

Operations teams almost always already hold every number this requires. They very rarely use them to answer the staffing question, which means the cliff is usually found by going over it.

How it worked technically

The model is queueing theory: arrival rate, service rate and the resulting utilisation. Waiting time rises non-linearly as utilisation approaches capacity, which is why a team at ninety per cent load behaves nothing like a team at seventy per cent, and why headcount planned on averages fails at the peak.

Read the full argument

When the traffic stopped leaving the country

Two people in the same city, on different providers, whose messages crossed a continent and came back.

A coastline from the air, pale shallows meeting darker water — Everything local, taking the long way round.

What was happening

Two people in one city, using different internet providers, sending each other a message. The message travelled abroad and returned, because there was nowhere at home for the two networks to meet.

Why it mattered

Everything domestic was slower than it needed to be, and every provider was paying a foreign carrier to move local traffic on a long detour.

The decision

Build the meeting point. Almost none of the difficulty is technical. It is persuading competitors to sit in the same room and to trust whoever operates the neutral ground between them.

What changed

Once it existed, domestic traffic stayed domestic.

Result

Delay fell for everyone in the country at once, and so did the transit bills that had been paying to send local traffic abroad and back.

How it worked technically

An internet exchange is a neutral layer-two fabric where networks peer directly rather than paying for transit. The engineering is modest. The governance model, deciding who operates it, on what terms and with what guarantees of neutrality, is what determines whether competitors will connect to it at all.

Read the conference presentation

Nine wireless networks per kilometre

A national argument nobody could settle, because nobody had taken the one measurement that would have settled it.

A headland half lost in sea fog — The argument nobody could settle, because nobody had gone and measured it.

What was happening

A national policy debate assumed the population was barely online. The available statistics could not settle the question either way.

Why it mattered

Public money was about to be directed at a problem that might not have existed in the form everyone assumed.

The decision

Go and count. The regional roads were driven and the wireless networks in range were counted along them.

What changed

Nine per kilometre, on average. Connectivity turned out to be comparable to countries that had never thought to doubt themselves.

Result

The policy question stopped being how to get people connected and became what to do with a population that already was. Almost every argument that cannot be settled turns out to be missing one measurement nobody thought to take, usually because taking it looks like too much trouble.

How it worked technically

The survey combined a geographical count of wireless networks observed along regional road transects with household and individual usage sampling, so that a physical measurement could be set against what people reported about themselves. Where the two disagree, the disagreement is usually the finding.

Read the study

Public institutions

Public-sector and international programmes.

National systems for ministries, agencies and internationally funded programmes: e-government, labour market, health, foreign affairs, emergency telecommunications. Heavily scrutinised, slow to move, and where the governance habits come from.

A national e-government portal

Built for a public administration ministry, with the migration, workflow design and business-process definition that a government portal actually consists of.

A national labour market information system

Designed so that ministries and agencies could actually exchange data with each other, with the legislative review needed to make a shared public data system lawful as well as functional.

Health information systems

Assessment of a national health ministry's systems, then the design of how the data, the network and the services behind a country-wide health portal would fit together.

Foreign ministry systems

Auditing information flows, data classification and access levels across a foreign ministry and its diplomatic missions, then designing the security around them.

ICT employment programmes

Analysing a national education-to-employment value chain in technology, then building the interventions and the portal that connected the two.

Emergency telecommunications

Radio watch-keeping, vehicle tracking and incident reporting for a humanitarian operation. The first job, and the one that made everything afterwards feel calm.

Funders, agencies and institutions are not named here. They are on request.

If you are dealing with something like one of these, start with the problem.

You do not need to know whether it is an advisory engagement, an interim role or a one-off review. A short description of the situation is enough.

Start a private conversation on LinkedIn Read the writing behind these