Agentic AI systems · United Kingdom
We build agentic AI systems for mid-market businesses.
Agents that pick up a whole job and finish it, inside one place you control, with permissions you set and a record of everything they do. You work with the person who builds them.
Book half an hour See what an agent is allowed to touch → The times are live, so you book the slot there and then instead of waiting for a reply.
Fixed priceAgreed before the build starts
Six to ten weeksFrom go-ahead to working
You own all of itAccounts, system, documentation
By introductionNew clients only that way
01 · What we build
An agent reaches what you allowed. Nothing else.
Not a chatbot bolted onto a process. A system that picks up the whole job — the inbox, the document, the record, the follow-up — inside a boundary you draw before it starts work.
ExampleA permission map for a sales operation. Yours is drawn at discovery, against your own systems.
Permitted Waits for a person Out of reach
Sales inbox: permitted
Quote folder: permitted
CRM records: permitted
Supplier invoices: permitted
Sending to a customer: waits for a person
Payroll: out of reach
Price list: permitted
Order history: permitted
Shared drive: permitted
Bank: out of reach
HR files: out of reach
Everything else: out of reach
Permissions are set per tool, and anything irreversible waits for a person by design. Every request and every action the agent takes is recorded, listable and reconcilable by event ID, so the answer to “what did it do on Tuesday?” is a query rather than a guess.
02 · How we work
Three steps. Stop after any of them and keep what it produced.
Nothing starts without the step before it, and each one leaves something behind that is yours whether or not you carry on.
First · 5–10 days
Paid discovery
Where the time and the money actually go. Which jobs are worth handing over and which are not, and a review of your estate against the questionnaire your own reviewer will ask.
What you keepA costed plan in plain English, and a threat model for your estate.
Then · 6–10 weeks
The build
The platform and the first agents. Permissions, the record, spend ceilings, the guardrail set, and evaluations written against your own procedures rather than a generic list.
What you keepA working system on infrastructure you own, and the documentation to operate it without us.
Ongoing · monthly
Governance
The model underneath moves every few months. Guardrails are re-tested against each version, evaluations kept current, and the quiet failures monitored for. Your running cost is managed here too: prompts tightened, and each job moved onto the cheapest model that still does it properly.
What you keepThe evidence a re-review asks for, kept current rather than reconstructed.
- Someone who can say yes. Not a committee.
- Access at the point we agree it, not before.
- Your own procedures, however scruffy. They are the specification and the test.
- An account in your name with the AI provider. The bill goes to you at their prices.
03 · What it costs
Published, so you can qualify us at eleven at night.
Without spending a favour on a call to find out. Everything below is ex VAT.
First
£8–12k
Paid discovery
Five to ten days. You keep the plan either way.
Then
£30–40k
Fixed-price build
Agreed before we start, so the number does not move. Further agents £8–15k each.
Ongoing
from £1,500
A month, governance
One to two days a month. No lock-in, one month’s notice either side.
Why we are cheaper than a firm charging the same day rate. Our rate is £1,250–1,500 a day, which is not our opinion of ourselves: it is the published G-Cloud 14 SFIA rate card for level 5, “ensure or advise”. You can look it up. A competing UK firm publishes its own card at £1,250 for a senior practitioner, inside the same band.
That firm prices its readiness audit at £30,000–90,000 over six to eight weeks. Ours is £8,000–12,000 over five to ten days. At the same day rate, thirty to forty days is £37–50k and five to ten days is £6–12k. The rates agree. The scope differs. We are not discounted, we are scoped smaller, because a mid-market business does not need a six-week audit before anything is built.
If you need the six-week version, we are the wrong firm and the comparison is fair. The discovery writes no code either: it produces a plan and a threat model, not a prototype.
You pay for the AI itself, directly. The account is in your name and the provider’s bill reaches you without passing through us. We do not resell model capacity and we do not mark it up, so no part of your running cost is revenue for us. At least one competing UK firm now publishes the same position. It also means bringing that cost down sits inside the retainer rather than against our interests.
04 · What you end up holding
You own it, and you can run it without us.
Every part of what we build ends up in your name, on your infrastructure, documented well enough for your own people to operate. That is a design decision, and these are the four places it shows.
- Nothing is in our name. The AI account, the cloud account and the domain are yours. There is no switch we hold.
- It is built to be operated by someone else. Documentation is a deliverable, not a favour, and the handover is scoped into the build rather than promised afterwards.
- The model is a choice you keep making. We pick per job on what the work needs and what it costs, not on a vendor relationship, and the guardrails, evaluations and record are written so that changing your mind later is a swap rather than a rebuild.
- The retainer has no lock-in. One month’s notice, either side. You can stop paying us and keep running.
- We take on six to seven retained clients. The ceiling is published rather than discovered, because past it the service is worse and you would be the one to find out.
05 · For the person who has to sign this off
What your IT team will ask, answered before they ask it.
Written for the reviewer rather than the buyer, and deliberately specific about what is not true as well as what is.
| Component | Where it runs | What it holds |
|---|---|---|
| Tool execution bash, files, code the agent wrote |
A sandbox on infrastructure you control. Outbound only; nothing dials in. | Your data, while it works. It sees credentials only as opaque placeholders. |
| Agent loop reasoning, tool selection |
The model provider. | Session state in flight. Not your data at rest. |
| Credential vault | The model provider. | Real secrets, per tenant. Substituted into the request after it has left the sandbox, so code running in the sandbox cannot read one. |
| Your systems | Yours. | Files, mail, line-of-business apps, source control. Reached only through permissions you set. |
The load-bearing row is the third. An agent cannot read a credential, including from code it wrote itself, because the credential is added after the request has already left. That is an architectural answer rather than a promise about model behaviour.
Things we deliberately do not claim
Checked against the provider’s own documentation. Several are commonly overstated, including by us in an earlier draft.
- The event stream is listable, not replayable. You reconcile by listing and de-duplicating on event ID. Webhooks are not a durable log: three attempts, then dropped, with no ordering guarantee.
- Permission policies are per tool, not per user. Anyone describing per-user entitlements at this layer is describing something else.
- Task budgets are not a cost control. They bound work, not spend. Spend is capped separately, and if someone sells you a task budget as a financial guardrail, press on it.
- Every platform has an agent layer of its own. A managed-agent surface is first-party to whichever provider built it, so a client committed to Bedrock or Azure builds on that cloud’s primitives instead: AgentCore for runtime, identity, memory and observability, Foundry for content-safety guardrails, tracing and policy. An earlier draft of ours called that constructing every primitive by hand. It is a re-target, and it still changes the price, the timeline and what your reviewer is reading.
- Nobody can fast-revoke a leaked environment key on the provider side. Key custody and rotation are yours. So is container hardening, egress restriction — there is no default — and log retention once output reaches your infrastructure.
Data protection
We are a processor under UK GDPR Article 28 and will sign your DPA; if you do not have one, we bring ours. Sub-processors are the model provider and, where you choose a hosted sandbox, its infrastructure. If data cannot leave a jurisdiction, that is a self-hosted sandbox, which answers residency and moves hardening, egress and key custody to you. On the provider account, which is yours, we configure zero data retention and the training opt-out, so your material is not kept once a request has been answered and is never used to train a model. Retention is the provider’s to grant rather than ours, and switching it off rules out the models that require it. We would rather complete your vendor security questionnaire before the commercial conversation than after it.
06 · The system we run ourselves
We run our own firm on the thing we sell.
Twenty-six agents handle the marketing, the research, the monitoring, a retail operation and the back office — unattended, on schedules, under the controls below. You can ask to see any part of it working.
Our own operation
As at 4 August 2026
26Agents running the operations
of this firm
July 2026Running unattended on
schedules since
5Controls hand-built before the
platform offered equivalents
- A write guard that jails file operations. Agent writes are confined to a review folder. Anything outside it is refused at the hook, not caught at review.
- A command guard on the shell. Blocks exfiltration, publishing and sensitive paths, and default-denies connectors rather than default-allowing them.
- A secret scanner ahead of human review. Output is checked for leaked credentials before a person reads it, on the assumption that a human reviewer is a poor last line of defence.
- A hard spend ceiling and a halt switch. Enforced, not advisory.
- Approve-before-publish on agent-written work. It reaches a person before it reaches anyone else.
Several of these were hand-built before the platform offered equivalents, which is why we can write the section above rather than quote a brochure. We also keep a failure log for this system — a system without one is a system nobody has looked at. It is not published, and we will take you through it at discovery.
07 · Evidence
Every figure on this page has a source.
The day rate comes from the published G-Cloud 14 SFIA card. The security answers come from the provider’s own documentation. The rest is our own system, which you can inspect. Ask for any of it and you get the citation rather than a summary.
What we will not put on this site
- Logos that are not clients. Several firms in this category display a wall of household names that turn out, on their own About page, to be the founder’s previous employers.
- Round percentages with no baseline. “40% hours saved” with no client, no window and no denominator is decoration.
- Badges whose issuer cannot be checked in thirty seconds, including any implied partner status we do not hold.
- Anonymous testimonials. “CFO, EdTech” is unverifiable praise.
- Scale-of-us numbers. Projects delivered, years in business, combined experience. One person cannot produce them honestly, so we do not compete on them.
- A figure without its sample size. Consensus among secondary sources is not verification: if six blogs agree, that is one source repeated six times.
Something here wrong, or a source you cannot reproduce? Tell us and it gets corrected or deleted. That has happened more than once.
Start here
Half an hour, and no obligation at the end of it.
Pick a time and it goes into both diaries with a video link. The slots shown are genuinely free, read from a real calendar a moment ago.
New clientsBy introduction only
ReviewersSend the questionnaire first
WhereUnited Kingdom