How It Works
A clear, sequential process from first conversation to actionable findings. No ambiguity about what happens when.
From initial conversation to documented findings.
Initial Conversation
We start with a short conversation about your situation. What AI tools are you using? Where are you uncertain? What prompted you to look for external evaluation? This isn't a sales call. It's genuinely about figuring out whether we can help and what form that help should take.
If we're not the right fit, we'll say so. If we think a different type of engagement would serve you better, we'll suggest it.
Scope Agreement
Before any work begins, we agree in writing on what the engagement covers. Which tools are in scope, what access we'll need, what deliverables you'll receive, and what the timeline looks like. No surprises.
Scope is kept deliberately narrow. A focused audit produces more useful findings than a broad one that skims everything.
Discovery and Mapping
We begin by building a complete picture of how AI tooling is currently used. This involves conversations with your engineers, review of your development workflows, and documentation of where AI output enters your codebase or decision processes.
This phase often surfaces things teams didn't know were happening. Not because anyone was hiding them, but because AI tool usage tends to spread informally and isn't always tracked systematically.
Code and Output Evaluation
For engagements that include code review, we examine samples of AI-generated code in your codebase. We look at how it was reviewed before merging, what patterns it follows, and where it diverges from your team's established conventions or introduces patterns worth flagging.
We're not looking for bugs. We're looking at the structural characteristics of AI-generated code in your specific context and how well your existing review process catches the things that matter.
Risk Assessment
Based on discovery and code evaluation, we map the risks we've identified across categories. Technical risks, process risks, dependency risks, and any compliance considerations relevant to your context. Each risk is described with enough specificity to be actionable.
We distinguish between risks that exist now and risks that could emerge as your AI tool usage scales. Both matter, but they call for different responses.
Findings and Handoff
The engagement closes with a written findings document and a walkthrough session with your team. The document is structured for practical use, not for filing away. Findings are prioritized, each with a clear description, context, and suggested response.
We stay available for questions after delivery. If something in the findings raises a question as you start implementing, we want to help you work through it.
What we actually look at when reviewing AI-generated code.
AI coding assistants produce code that can look impeccably well-structured while carrying assumptions that don't fit your context. The review challenge isn't catching obvious errors. It's identifying the subtler patterns that experienced reviewers might accept because they look familiar.
We look at several specific dimensions.
Error Handling Patterns
Whether generated error handling matches your application's actual error model and recovery requirements.
Security Context Fit
How well generated code handles security concerns specific to your architecture and data sensitivity.
Architectural Coherence
Whether generated code integrates with your existing patterns or introduces divergent conventions.
Test Coverage Quality
Whether AI-generated tests cover meaningful behavior or just add coverage numbers without substance.
Deliverables designed for practical use.
Everything we produce is written to be used by your team, not archived.
Integration Map
A documented overview of all AI tools in scope, their integration points, and how AI output moves through your workflows. Useful for onboarding new engineers and for future evaluations.
Risk Register
A structured list of identified risks, each with a description, category, potential impact, and suggested response. Prioritized so you know where to focus first.
Review Checklists
Practical checklists for reviewing AI-generated code in pull requests, tailored to your stack and the specific patterns we identified during the audit.
Findings Report
The main engagement document. Observations, context, and next steps written for your technical leads and decision-makers. Structured for clarity, not length.
Ready to start with a discovery conversation?
The first step is a short, no-pressure conversation about your current situation. We'll figure out together what makes sense.
Start the Conversation