Developing enterprise AI and data capabilities

I authored the AI and data strategy and developed the function's operating model and roadmap. I work with business owners and IT on priorities and approvals. Every initiative begins with an owner, an outcome, and a measure. I recommend expanding investment when a project shows value, adoption, and demand.

Business owners define the outcome, source owners own their data and content, and IT and security review architecture and releases. My part is the strategy, the architecture, and hands-on delivery.

The decision was whether each new use case would bring its own data integration, access model, and hosting, or whether they would share them. I chose a shared, governed platform. Its sources are authoritative systems, documents, and machine data. The platform prepares that data once, then serves it to reporting, search, applications, and automation under the same permissions. A new use case reuses the data integration, access model, and hosting already in place. A control added once applies wherever it is used.

Business owners agree on each data definition before anyone automates it.

I designed and implemented permission-aware enterprise search and retrieval-augmented generation (RAG). The system grounds its answers in internal sources, with citations and access controls. The system is designed to decline when supporting evidence is insufficient, and evaluation includes abstention behavior. I used evaluation sets, pilot feedback, and production monitoring to refine retrieval and answer quality. The diagram below shows how the system ingests content, answers a question, and measures quality. It also shows the order in which access widens.

Answer quality depends on the source content, so content upkeep is part of the system. AI helps draft content and flag problems, and a named person decides what to publish. Access widens in stages, starting with the people who own the content and the subject-matter experts who can test the answers against what they know.

I developed security controls for internal AI applications and AI-assisted engineering. The work includes threat modeling, permission boundaries, controlled releases, documented testing, and explicit treatment of residual risk.

That work covers identity and access, the permissions given to agents and their tools, release controls, and human accountability for judgment calls. Testing shows how a control behaved at the time of the test. The testing supports review by IT and leadership and is not an audit or a certification.

I built and iterated internal reporting and document-generation capabilities with business users, including weekly reporting that rolls up the management chain and stays searchable afterward.

For document generation, a working prototype already existed. I extended it rather than rebuilding it. I added business-managed templates and version control so engineering would not have to own every content change.

I am documenting the end-to-end process, identifying waste and failure modes, and determining where automation or AI would materially improve throughput or quality. I combine interviews, existing documentation, and operational data to map and measure each workflow before deciding what to automate.

The constraints include work that spans physical production, files, and several systems. They also include inputs that vary by customer, knowledge held by experienced people, election-cycle timing, and the need to preserve auditability.