Prakash Kantumutchu

Consulting

Short, scoped engagements in the areas where I have production evidence. Each one has a written scope, deliverables you keep, and a clear list of what it does not include.

Safe AI access to your internal data

The problem. You want an AI assistant or agent to answer questions from your own systems, and the obvious shortcut — a database connection or an API key — would give it far more power than the job needs.

Scope. Design, or design and build, a read-only connector (MCP or similar) for one system: identity for the agent, the tool contract, bounds on every query, audit logging and the failure behaviour when data is missing.

Related case study: Doors, not keys

You get
  • Threat model and access design for one data source
  • Tool contract: what each tool returns, refuses and caps
  • Reference implementation or a reviewed implementation by your team
  • Test plan covering authorisation, bounds and partial-data refusal
Not included
  • Write or action tools without a separate human-approval design
  • Model fine-tuning
  • Guarantees about model answers
To assess your request I need
  • The system and data the assistant should read
  • Who should be allowed to ask, and what they must never see
  • Your current auth setup

AI pipeline reliability and privacy review

The problem. You have shipped an LLM feature. You are not sure what happens when the model is wrong, slow or down, where personal data flows, or how you would reconstruct a bad answer next week.

Scope. A fixed-length review of one AI feature: privacy boundary, input and output checks, tracing, cost controls, fallback paths and evaluation readiness.

Related case study: The AI trace store

You get
  • Written findings ranked by risk, each with a concrete fix
  • A data-flow diagram showing where personal data goes
  • A minimal evaluation and tracing plan you can run yourselves
Not included
  • Security certification or compliance sign-off
  • Guaranteed accuracy or cost reductions
  • Building the feature from scratch
To assess your request I need
  • What the feature does and who uses it
  • Models and providers in use
  • What you log today

Production audit for Node, Next.js and Postgres apps

The problem. Your product grew faster than its foundations. Authorisation is spread across routes, migrations are run by hand, and you suspect at least one green CI check cannot actually fail.

Scope. A code and configuration review of one application, focused on authorisation, data model and migrations, payments or ledgers if present, and CI gates.

Related case study: Multi-tenancy without a migration

You get
  • Findings report with severity, evidence and a fix for each item
  • A list of CI checks that cannot fail, and how to make them
  • A prioritised remediation plan sized for your team
Not included
  • Penetration testing
  • Infrastructure migrations
  • Ongoing on-call support
To assess your request I need
  • Repository access (read-only is enough)
  • Your deployment setup
  • The incidents or worries that prompted the review

What I don't promise

No guaranteed model accuracy, no security certification, no fixed cost savings and no timelines before a scope is agreed in writing.

Send a consulting enquiry

Fields marked optional can be left blank.

What is happening now, and why it matters. Please do not include passwords, keys or confidential documents.

How should I reply?