Four stages, each with a decision gate.
Every engagement moves through the same four stages. Each one has stated inputs from you, work we actually perform, outputs you keep, and a gate where you decide whether to continue, change course or stop. Stopping at a gate is a legitimate outcome.
-
Stage 01
Diagnose
- You provide
- Time with process owners and staff; sample documents or redacted extracts; the list of systems and the contracts that govern their data.
- Tracee does
- Process walk-throughs, data inventory, baseline sampling, opportunity scoring, and a comparison of rules, classical ML and language models for each case.
- You receive
- Process and data map, use-case register, scorecard, pilot decision brief.
- Decision gate
- Is there a pilot worth running, with an owner and a measured baseline? If not, we say so and the engagement ends here.
-
Stage 02
Architect
- You provide
- The chosen use case and its owner; IT and security contacts; constraints from your data protection officer or counsel.
- Tracee does
- Workflow specification, control design, deployment pattern selection, supplier comparison and evaluation design.
- You receive
- Design specification, data and deployment assessment, control matrix, supplier shortlist with documented reasons.
- Decision gate
- Do operations, IT security and data protection accept the design, and is the cost of running it understood?
-
Stage 03
Validate
- You provide
- Labelled sample cases, which we help you build; reviewer time; access to a test environment or sandbox.
- Tracee does
- Builds a prototype against the specification, runs it on the evaluation set, measures it against the acceptance criteria and tests the failure scenarios.
- You receive
- Prototype, test report against the go or no-go criteria, log of residual risks and open issues.
- Decision gate
- Do the measured results meet the criteria written before testing began?
-
Stage 04
Integrate and enable
- You provide
- Integration access; the team that will own operation; a business sponsor for the change.
- Tracee does
- Integration with your systems alongside your IT team or implementation partner, reviewer interface and runbook, training for users and reviewers, handover of monitoring.
- You receive
- The integrated workflow in your environment, runbook, monitoring specification, trained reviewers, version register.
- Decision gate
- Does the owner accept operation, with monitoring and rollback in place and rehearsed?
Controls designed in, not added afterwards.
These eight controls appear in every design specification. The control matrix maps each one to the risk it addresses and names its owner.
| Control | What it means in practice |
|---|---|
| Role-based access | Users, reviewers, administrators and the system's own service accounts get only the permissions their role needs. Retrieval respects document permissions of the person asking. |
| Data minimization | The model receives only the fields the task needs. Identifiers are removed or masked where the task allows. |
| Versioned prompts, models and rules | Every output can be tied to the exact prompt template, model version, rule set and retrieval index that produced it. |
| Source traceability | Extracted values and retrieved passages link back to the source document and location. |
| Review queues | Thresholds decide what a person must approve. Each queue has an owner and an expected response time. |
| Logging | Inputs, outputs, decisions and overrides are recorded, with retention set by purpose rather than by default. |
| Rollback | A previous version can be restored, and the workflow can fall back to manual handling without losing cases. |
| Evaluation | A labelled test set is rerun at every change, and the results are kept alongside the version register. |
Design and integration, or a managed service.
The two are different contracts with different responsibilities. We state which one applies before work starts.
| Design-and-integration mandate | Ongoing managed service | |
|---|---|---|
| Who operates the system | Your team, or the implementation partner you choose. | A named operator, under a separate contract with service levels. |
| Who owns the infrastructure and accounts | You. | As contracted, stated explicitly. |
| Tracee's role | Diagnose, design, specify, prototype, support integration, train, hand over. | Only when separately agreed, scoped and resourced. |
| End point | The owner accepts operation at the stage 04 gate. | Ongoing, with periodic review. |
We do not promise a "production deployment" when the infrastructure, the business systems or the implementation partner sit outside the agreed scope. In that case the deliverable is a validated design and supported integration, and the contract says so. Production is something your organization accepts at the final gate, not something a consultant declares.
Founder-led, technology-agnostic.
Founder-led delivery. Bassel Assaad leads every engagement and carries out the design work directly. When specialist skills are needed, such as a particular business system or infrastructure, they are named in the proposal with their role.
Technology-agnostic supplier selection. Tracee has no reseller agreements and takes no referral fees. Supplier comparisons are written down with their criteria, so you can check the reasoning and reuse it.
Public frameworks as reference methods. We draw on the NIST AI Risk Management Framework to structure risk work around its four functions (govern, map, measure, manage), on CNIL guidance for personal data in AI systems, and on the European Commission's AI Act materials for classification questions. Tracee holds no certification against these frameworks and none is implied.
Start at stage one, decide at every gate.
The diagnostic is the usual first step. You commit to one stage at a time.