AI systems · automation · engineering
I build AI systems that run, and know when to stop.
Agents, automations and software for research, monitoring and operations, with evidence attached and a human approving the steps that matter.
Decision rail
one proposal · one gateReviewable file
The proposal crosses the human gate.Output: —
Reason recorded: evidence is incomplete.Work · selected systems
Claims on the left.
Proof on the right.
Each system is shown by the decisions it encodes and the evidence it leaves behind.
One working memory, many agents
Claude, Codex and ChatGPT read the same work history instead of starting from zero.
Read the caseHistory and context, never orders.
Agents may query it; they may not refresh it or use it to skip approval.
Read-only for agentsAI Control Tower: delegation behind a gate
Premium agents keep the reasoning. Bulk work goes to cheaper models, only after an exact approval.
Read the caseSearch monitoring that diagnoses before it alerts
n8n collects, an AI step diagnoses, a human decides.
04Evidence-first agentic audits
Agents audit a site end to end without writing a single byte to it.
05An evidence-gated research digest
Collection runs without a model. Writing runs with one. Evidence rules decide what gets in.
06A daily-focus app
Capture a reminder in one gesture. See the day as an editorial page.
Method · seven rules
A short index of
non-negotiables.
- 01
Evidence first.
If it isn’t in the source, it doesn’t get written. Every claim, number and recommendation points back to a source. Gaps are labelled as gaps, never filled with a plausible guess.
- 02
A human decides.
Agents detect and propose. They don’t publish. Publishing, changing a live site, spending money or sending a message is a human act, every single time.
- 03
Fail closed.
When in doubt, the system stops instead of guessing. A missing file, an unknown state or an unverified claim is a stop with a reason, not a warning that scrolls by.
- 04
Deterministic where possible, LLM where needed.
A model never does what a script does better. Parsing, counting, comparing and formatting are code. The model gets the steps that genuinely need judgment, and nothing else.
- 05
Privacy by design.
Collect less. Protect what remains. Keys stay in the keychain, memories stay on disk, and personal data is redacted before anything is indexed.
- 06
Write down the traps.
Every mistake paid for becomes a rule for the next agent. The same trap is never paid for twice: it goes into the instructions the next agent reads first.
- 07
Every output is inspectable.
Versioned, reviewable, verifiable. Reports, plans and digests are files you can diff and review. If you can’t inspect it, you can’t approve it.
Proof · authentic artefact
The interface is a contract.
This excerpt comes from the actual AI Control Tower interface. It names the tools, the privacy classes and the stop conditions, without exposing a real plan identifier.
See the system around it- ai_provider_statuschecks locally that credentials exist; never shows keys
- ai_plan_jobnon-executing plan: provider and model pinned, finite limits,
- and an exact approval phrase
- ai_submit_jobruns only if the phrase matches exactly
- ai_job_statusreads local state
- ai_get_resultnormalised results with provenance; partial is not complete
- ai_cancel_jobstops future work, keeps what was already created
- privacy classes
- publicexplicit or automatic routing
- privateonly after the provider data policy is assessed for that job
- sensitiveprovider must be named; stop if retention or region is unknown
- a cost estimate of "unknown" means unverified. never free.
Approval format: APPROVA plan_‹id›. The identifier is a placeholder, never a fake value.
About
Geneva, Switzerland
I’m Renato Baldo, an AI systems builder based in Geneva. I design agents, automations and software that run in production, with written rules and a human approving every step that matters.
Contact
Where should the human stay in control?
Tell me what the system should do, what evidence it can use and where it must stop.
contact@renatobaldo.com