I make AI agents safe to run on customers’ data and money.

I'm Isaac. I design systems and direct AI to build them. PANTHEON is the one I'm known for: AI assistants for small businesses, in production. A database decides whose data they see, a ledger what they spend, a queue when a person signs off. Not a prompt. What is PANTHEON? →

Looking for: an AI product or agent-platform engineering role, owning one hard problem inside an experienced team. Cardiff, UK; open to relocate. CV →

Try to break it → Work with me

How approval works, on the booking flow that is built and switched off: a guest asks for dates, the assistant queues the request, and nothing is booked until the owner confirms. Anything with money waits.

A ledger and a balance that settles level; its leaves turn through four of Leonardo’s drawings (the Vitruvian Man, a giant crossbow, a sectioned skull, the foetus in the womb) and pages of his Codex Arundel. Engraving generated and animated by Runway; the pages laid on in code.
Live · not a recording

Don't take my word for it. Ask it.

This site's assistant runs on PANTHEON. Every message is checked before it answers, and the checks print under each answer. Try to break it.

A gatehouse and its portcullis. Engraving generated by Runway; the portcullis animated in code.
the proof

One real defect, start to finish.

The bug. WhatsApp and Telegram history was stored under the guest's phone number alone, so a guest who messaged two businesses could have the first conversation loaded into the second business's assistant.

Caught by my own adversarial audit in July: not a customer, and not the test suite, which had passed. Fixed by keying the history to the business as well. Kept fixed by a test that fails if the old key comes back.

An outside check: I'm a credited reporter (one of seven) on CVE-2026-104850 ↗, a high-severity flaw in the MCP TypeScript SDK.

More defects, each with a test that can fail → Break-test it yourself → See what it builds →
A lighthouse keeping watch. Engraving generated and animated by Runway.
what holds, and what doesn't yet

What it guarantees, and what it doesn't.

Each business's data is walled off by the database. Each request is bound to its business by a signed key, and a query for another business's rows returns nothing. Three sign-in and payment tables are guarded in code instead.
Help comes before billing. A person in crisis gets help free, ahead of every cap and charge.
Money moves atomically. Each charge and refund is keyed, so a retry can't repeat it. Internal credits only so far: no real charges between businesses yet.

Not solved: prompt injection (limited by scoping, an audit judge and human approval; nobody has solved it), and scale past one production instance (designed for, unproven). The full list → The architecture →

Built solo. Running in production. Open to the right team.

If your AI agent is about to touch real customers' data or money, that's the job I want. Let's talk.

What I'm looking for →Get in touch →See the work on GitHub ↗

Read my one-page CV →