The systems that most need machine learning are the ones least able to tolerate a plausible answer.
An agent that is right most of the time is not a system, it is a demo. The moment an autonomous process touches money, inventory or a control, being approximately right stops being partial credit and becomes a finding with an audit trail. That constraint is what the current wave of agent engineering keeps discovering late, and it is the constraint I have spent a decade building systems under.
My work sits where three fields keep leaving a gap. Agent engineering has produced remarkable capability and almost no vocabulary for verification — the harness, not the model, explains most of the variance, and nobody designs it deliberately. Constrained and neuro-symbolic methods have the right machinery for hard identities but are rarely tested at enterprise scale. AI governance has the right words for control but is almost always written as policy rather than as something a tester can test.
The programme below runs in one direction of travel: harnesses that fail loudly instead of quietly, constraints that hold by construction, confidentiality that is measured rather than asserted, and evidence that survives contact with an auditor. Payments and reconciliation are where I work these ideas out in the concrete, because it is the domain least willing to accept a confident guess — but the argument is about autonomous systems generally, not about ledgers.
- P2
Governed agentic AI
Making agent behaviour auditable where it matters: least-privilege context, approval gates that are not theatre, and evidence a control tester will accept.
1 essay →3 projects - P3
Enterprise AI privacy
Confidentiality failures that survive masking: relationship leakage, rule leakage, and disclosure that accumulates across sessions rather than within one.
2 essays →1 project - P4
Payments & reconciliation
Transaction correspondence, settlement and lineage treated as problems over heterogeneous temporal graphs rather than pairwise string matching.
2 essays →1 project - P5
Constrained & neuro-symbolic ML
Models that must satisfy hard identities — conservation, balance, double entry — and the four places a constraint can actually be enforced.
1 essay →1 project - P1
Agent engineering
The harness around the model — tool surfaces, context assembly, control loops, and how you evaluate an agent when no gold label exists.
2 essays → - P6
Retail & commerce systems
Applied write-ups from production-scale commerce platforms: search architecture, catalogue retrieval, and the parts of a retail stack that carry load.
1 essay →
- 01RGIn progress
ReconGraph — reconciliation as a graph problem
What does reconciliation accuracy mean once you stop assuming records pair off one-to-one?
A representation and evaluation programme for financial reconciliation built on heterogeneous temporal graphs. The hypothesis is that the cases enterprise reconciliation actually fails on — splits, partials, aggregations, out-of-order settlement — are not edge cases of a matching problem but the ordinary case of a correspondence problem over a graph. The manuscript is complete: on RECONBENCH, a synthetic benchmark built from public AML simulation data, global consistency inference reaches 0.949 link F1 and 0.944 graph-consistency accuracy, and the margin over pairwise graph matching widens as the topology moves away from one-to-one.
- ReconGraph manuscript — Complete — abstract, method and results published here; not submitted
- RECONBENCH generator — To be released under an OSI licence with a CITATION.cff
Artifacts - 02NRIn progress
NeuroRecon — constraint-aware learning under accounting identities
Where should a hard constraint be enforced when the model's output must balance exactly?
Neural estimators do not respect conservation. In a domain where the sum of the parts is not approximately the whole but definitionally the whole, that is disqualifying. NeuroRecon puts five constraint families — amount conservation, event ordering, double-entry balance, cardinality and organisation-specific rules — into the training objective as differentiable penalties rather than into an inference-time filter. On a controlled benchmark that reaches 94.6% F1 at a 0.6% constraint-violation rate, and holds 80.6% F1 when three-quarters of reference identifiers are corrupted — evidence that what was learned is financial structure rather than key matching.
- NeuroRecon manuscript — Complete — abstract, method and results published here; not submitted
Artifacts - 03DRRCFramework
DRRC — disclosure risk beyond data masking
What does an enterprise actually leak to an AI system once the obvious identifiers are already gone?
A framework naming the confidentiality failures that masking does not touch: relationship disclosure, where an anonymised graph still reveals who trades with whom; rule disclosure, where the assistant recites the business logic that is the actual asset; and cumulative disclosure, where a sequence of individually harmless answers reconstructs something none of them contained. Published here as a framework, with the threat model stated explicitly enough to argue with.
- Framework write-up — Published essay
Artifacts - 04CFIn progress
Context Firewall — least-privilege context for agents
Why does an agent see the whole context window when a human in the same role would need an access request?
Access control has a settled answer for what a principal may read. Retrieval pipelines mostly do not use it: the agent is handed whatever the retriever returned. This project treats the context window as a protected resource with its own policy surface, and asks what a least-privilege equivalent looks like when the consumer is a model rather than a process. Problem statement only while a provisional application is prepared.
- P2 · Governed agentic AI
- Design note — Withheld pending provisional filing
PillarArtifactsMechanism withheld pending provisional filing
- 05BCLSIn progress
BCLS — making context leakage a measurable quantity
If you cannot put a number on what an agent leaked, on what basis did you approve it?
Confidentiality decisions about AI systems are currently made in prose. This strand asks what it would take to express business-confidentiality leakage as a score that can be tracked over time and traded off against task utility — turning 'is this agent safe to deploy' into a frontier you can choose a point on. Problem statement only while a provisional application is prepared.
- P2 · Governed agentic AI
- Scoring definition — Withheld pending provisional filing
PillarArtifactsMechanism withheld pending provisional filing
- 06AICEPIn progress
AICEP — an evidence package for AI controls
What would you hand a control tester who has never accepted 'the model decided' as a control?
Most AI governance output is policy: statements of intent that a tester cannot test. This strand works the other direction, starting from what a SOX control tester already accepts as evidence and asking what an AI-mediated control has to emit to meet the same bar. Problem statement only while a provisional application is prepared.
- P2 · Governed agentic AI
- Evidence schema — Withheld pending provisional filing
PillarArtifactsMechanism withheld pending provisional filing
Paper, post, repo
Every strand is meant to produce three things: a citable object, a discoverable one, and a usable one. The paper is the citation, the essay is the reach, the repository is what someone else can actually run.
Synthetic data only
Every dataset on this site is generated. Where a generator exists it is published alongside the result, so the numbers are reproducible by anyone who wants to disagree with them.
Statuses do not inflate
A framework is not a result and a draft is not a preprint. Statuses on this page move in one direction only, and only when there is a link to point at.
Working on any of this? Get in touch. I read everything, and I am particularly interested in disagreement from people who have run these systems in production.