8 tools. 5 ordered guardrails. 3 pluggable LLM providers (Anthropic, OpenAI, Bedrock). End-to-end OpenTelemetry observability into Tempo/Loki/Grafana.
View the portfolio →GenAI and AppSec Advisory for Regulated Industries
Your CISO needs to sign off. Your engineers want to ship. That gap is the engagement.
Be Digital advises technology and security teams at banking, insurance, asset management, and healthcare payer organizations on how to deploy generative AI systems that satisfy compliance requirements without stalling the engineering roadmap.
Start a conversationWhy regulated industries need a different approach
Deploying generative AI that drafts, monitors, and scans inside a regulated environment is not a model selection problem — it is a controls problem. Banking institutions under SR 11-7, insurance carriers with NAIC guidance, and healthcare payers subject to HIPAA all operate under model risk management frameworks that require explainability, auditability, and documented human oversight. Dropping an LLM into a workflow without addressing those requirements creates regulatory exposure that the security team will discover at the worst possible time.
The Model Context Protocol (MCP) server built for this advisory practice is a reference implementation of exactly those controls. It runs eight tools through five ordered guardrails — input sanitization, prompt injection detection, policy enforcement, output filtering, and rate limiting — before any response reaches the application layer. Three pluggable LLM providers (Anthropic, OpenAI, and AWS Bedrock) mean you are not locked into a vendor, and you can route traffic based on data residency requirements without rewriting the integration.
End-to-end OpenTelemetry observability — traces into Tempo, logs into Loki, dashboards in Grafana — means every inference request is a structured event with a trace ID. Each guardrail and tool call runs as a child span under the request's parent span, so the propagated trace context stitches the whole pipeline into one timeline, and the same trace ID is injected into every log line so traces and logs join up instead of living in separate silos (OpenTelemetry instrumentation). That trace is your audit trail. When a regulator asks what the model was asked, what guardrails fired, and what was returned, you answer with correlated logs rather than reconstruction.
The advisory engagement applies those patterns to your specific system: your data classification, your approval workflows, your existing security tooling. The goal is a deployment your CISO can sign off on without blocking the team that built it.
Platforms and tooling
- → Amazon Q Business — enterprise knowledge assistant deployment: data source integration, IAM Identity Center SSO, retriever configuration, guardrails, and custom plugins
- → Amazon Q Developer — org-wide coding assistant rollout with repo-trained customizations
- → Kiro — spec-driven development environment for structured requirements, design, and task execution
- → MCP servers — custom Model Context Protocol implementations with ordered guardrails and OpenTelemetry observability
Published reference implementation
Published reference implementation — Observability
End-to-end OpenTelemetry instrumentation — parent/child spans across an ordered guardrail pipeline, trace-ID-correlated logs into Tempo and Loki, and Grafana dashboards. One correlation ID ties every span, trace, and log line together.
View the portfolio →More published work
Reference implementations and case studies from enterprise platform engineering and security engagements.
Platform engineering & GitOps
GitOps on AWS EKS
Enterprise GitOps platform on EKS — multi-cluster DEV/PROD isolation, ArgoCD, Terraform, Karpenter, and a 352-test validation suite.
Backstage internal developer portal
Self-service developer portal implementation for a regulated enterprise.
Platform engineering evolution
Platform maturity case study — from reactive operations to self-service.
Lean ML/Ops platform starter
GitLab migration, tool-agnostic guardrails enforced at CI, and an AWS baseline scoped to run without dedicated infra headcount.
GenAI & AppSec
AppSec MCP server
8 tools, 5 ordered guardrails, 3 pluggable LLM providers, end-to-end OpenTelemetry observability.
Claude Skills & context engineering
Field notes on progressive disclosure — how Claude Skills change the economics of agentic coding work.
Claude Code implementation field notes
Part two — wiring the playbook across a polyglot platform: memory load order, path-scoped rules, and managing the live context budget.
Amazon Q Developer POC
Structured 4-week proof of concept — org setup, repo-trained customizations, baseline metrics, and a go/no-go decision package.
Coverage automation — tests only, production untouched
91% SonarQube coverage using Claude Opus 4 + GitHub Copilot with three enforcement layers that make production edits architecturally impossible.
Copilot coverage workflow
A Copilot-only, cost-aware workflow that raises Java test coverage to 91% — autonomous agent loop, defense-in-depth guardrails, and token engineering.
Token cost optimization
Field notes on the economics of agentic AI that drafts and scans: why token cost grows every turn, and the four levers that cut it.
Context & token cheat-sheet
Copilot vs Claude Code — how each tool builds context, what costs tokens, and the levers that cut it.
The Credit Fire — Copilot spend parable
A Phoenix Project-style narrative on why token cost is a work-in-progress problem, not a model problem. Six levers, in order.
Two meters for your coding tools
What your coding assistant costs vs whether the service is up — in plain terms, applied to Copilot and Claude.
GitLab Orbit & agentic coding tools
What Orbit's SDLC graph does for agents, where it helps, and the code it won't read.
ML/MLOps platform advisory — reference architecture
From legacy delivery to a team-owned, self-service platform that is agentic-native and compliant by default. One-page briefing with layered architecture and phased migration.
Background
Technical leadership profile
Executive-director-level background spanning platform engineering and security.
Sample engagement types
Engagements start at $18,000/month. Scope and cadence defined at kickoff.
Fractional advisory
Monthly retainer
- GenAI deployment review against your compliance framework
- Recurring threat modeling sessions for new features where AI drafts, monitors, or scans
- CISO briefings — written summaries and live Q&A
- Scope and cadence defined at engagement start
Fixed-scope threat model
Time-boxed engagement
- Threat model for a specific GenAI integration — data flows, trust boundaries, attack surface
- Written deliverable suitable for model risk management review
- Presentation to security leadership and CISO
Ship GenAI your CISO will sign off on.
The gap between what engineers want to deploy and what security will approve is a scoping problem, not a technology problem. Let's close it.
Start a conversation