Language & Agents

Language models made a new class of software possible: systems that read, write, decide and act on unstructured input. They also made a new class of demo possible - the kind that impresses everyone in the room and then quietly never ships, because nobody can say how often it is wrong.

We build the shipping kind. The difference is not the model; it is everything around it.

What we build

Evaluation is the deliverable

Ask a vendor how good their LLM feature is and you get a demo. Ask how often it fails and you get silence. That gap is where these projects die - so we invert it: the evaluation harness is built first, and the system has to earn its way through it.

1. 1

   Define failure

   What does wrong look like here - a hallucinated citation, a missed extraction, an action taken without grounds? Made concrete, with your experts, before any prompt is written.

2. 2

   Build the eval set

   Real cases from your domain, labelled once, versioned forever. Every prompt change, model swap and retrieval tweak reruns against it.

3. 3

   Measure, then ship

   Failure rates per category, not a vibe. The system ships when the numbers clear the bar you set - and the numbers are yours to keep.

4. 4

   Watch it in production

   Sampled review queues and drift checks, because the distribution of real questions never matches the eval set forever.

This is the same discipline as the rest of our method - measured behaviour, calibrated confidence, failure that announces itself - applied to systems whose raw material is language. When the model is uncertain, the system should be able to say so and hand off to a person, exactly like our vision and tabular deployments flag their hardest cases.

Private by architecture

Scientific and industrial language data - lab records, process documentation, support tickets - is usually the most sensitive text an organisation holds. Where it runs is an architecture decision, made deliberately:

• EU-hosted APIs with contractual data-processing terms, for work where managed frontier models earn their cost.
• Self-hosted open-weight models on your infrastructure or ours, for data that must not leave - smaller models on well-shaped tasks close most of the gap.
• No training on your data, verified in the terms rather than assumed, whichever path is taken.

Deployment, monitoring and the serving infrastructure follow the same patterns as everything else we run - an LLM endpoint is a model endpoint.

Built to be attacked

Every system on this page takes instructions from text, and some of that text will eventually be hostile. Prompt injection through retrieved documents, leakage through patient questioning, agents talked into misusing their tools - these are design constraints from day one, not findings to be discovered later: output validation at the trust boundary, tool permissions scoped to the task, and untrusted content treated as data rather than instructions.

We also red-team these systems professionally - including ones we did not build. Building and attacking the same class of system is exactly why we are reasonable at both.

Where to go next