Building an enterprise AI platform: permission-aware RAG that holds up in production
A reference architecture for enterprise AI: hybrid retrieval, user-scoped tools, fail-closed access control, event-driven deletes, and eval-gated CI/CD.
Practical AI engineering tutorials
Hands-on tutorials and case studies for building AI systems you can trust: hybrid retrieval, evaluation, agent tools, and the data pipelines behind them.
From the journal
Latest articles
How I built a governed dependency pipeline: no package ships until it earns trust
A case study of a governed open-source intake pipeline: quarantine, Trivy scanning, OPA policy as code, promotion to an approved registry, and SBOM monitoring with Dependency-Track.
Score match quality and load results into Postgres
Use eval/score.py to compute precision, recall, and F1 for a reconciliation run against the ground_truth.json answer key, then optionally load the same run into a Postgres target schema.
Reconcile ERP and CRM records with the pipeline
Run the reconcile CLI to ingest, clean, validate, and resolve ERP and CRM exports into a single crosswalk, quarantine log, and Markdown reconciliation report.
Customize messiness and build a reproducible configuration file
Tune the missing-value, bad-date, encoding, duplicate, orphan, and amount-drift ratios that control how messy a generated dataset is, and save your choices to a config file datagen can replay exactly.
Compare ERP and CRM field mappings and the ground truth answer key
Read the same customer, invoice, and payment across a flat ERP CSV export and a nested CRM JSON export, and learn what the ground_truth.json answer key does, and doesn't, record.
Selected work
Featured projects
Entra identity posture MCP server
An MCP server that lets AI agents audit Microsoft Entra ID app registrations and Conditional Access policies against Zero Trust rules, then propose fixes a human reviews before anything changes.
Validated against a live test tenant, with ruff and pytest running in CI.
Claude chat CLI with hybrid RAG
A streaming Claude chat client with a hybrid retrieval system built from first principles, plus an evaluation harness for testing prompt changes before adopting them.
Ships with 122 tests and CI on every push.
Enterprise RAG with access control
A permission-aware enterprise AI assistant that answers from documents and databases while respecting who is asking. It implements every control from the Brimmora case study and runs locally on Docker Compose.
Proves each control with 14 security regression tests and 10 end-to-end scenarios, and fails the CI build if a 19-question golden-set evaluation drops below its thresholds.
Governed dependency pipeline
A quarantine-to-approved npm pipeline that scans every requested package, judges it with a tested Open Policy Agent policy, and keeps evidence for every decision before developers or AI agents can install it.
Runs 8 of 8 policy unit tests, opa fmt, and ShellCheck in CI, and records three evidence files for each request.
Learning paths
Build one lesson at a time
6 lessons
Claude Chat CLI with hybrid RAG retrieval
Build the hybrid retrieval pipeline behind a Claude-powered command-line chat assistant: chunk a real codebase, rank chunks with Okapi BM25 and cosine similarity, fuse both rankings with Reciprocal Rank Fusion, then benchmark and evaluate the results.
Start lesson 15 lessons
ERP and CRM reconciliation pipeline
Generate a synthetic, deliberately messy enterprise resource planning (ERP) and customer relationship management (CRM) dataset, then reconcile the two divergent exports back into a single source of truth by matching customers, invoices, and payments on name, email, phone, and date and amount proximity, never on ID-format shortcuts.
Start lesson 1Open to AI-focused software engineering roles
HLAB Journal is written by Kiarie Henry Mbugua, a software engineer in Nairobi building AI systems that are grounded, evaluated, and secure.