Business & Operations

Author the operator-executable runbook for a DATA move — backfill, re-shard, store cutover, tenant move, CDC initial load — that a stranger can run under pressure: preconditions gated on verified backups and dry-run evidence, batching with throttles and pause/resume, per-batch and per-stage verification queries (counts, checksums, sampled equality) with expected outputs, explicit abort criteria naming the safe halt state, rollback per stage composed from rollback-runbook-author conventions, a...

Identify, negotiate, and track the cross-team dependencies an effort needs — map what you need from other teams AND what they need from you, surface each dependency EARLY (before it's a blocker), negotiate a CONCRETE commitment (specific deliverable, interface/contract, date, owner on both sides) rather than a vague "we'll help", de-risk it (fallbacks if it slips, decoupling via a stubbed interface, parallel paths), account for the reality that other teams have their own priorities (align inc...

Run ONE parameterized compliance gap audit — current state vs the chosen framework(s): ISO 27001:2022, ISO 42001:2023, SOC 2 (TSC), optionally a NIST AI RMF profile — never a per-framework fork. Consumes the compliance-control-foundation catalog, multi-framework-crosswalk rows, the SoA, and compliance-evidence-collector coverage; verdicts per requirement: MET / PARTIAL / GAP / UNVERIFIABLE from cited evidence — missing evidence is never MET (agent-governance-audit discipline, org-wide). Outpu...

Design the operating-effectiveness evidence program SOC 2 Type 2 demands and ISO surveillance audits reuse — evidence OVER TIME, not point-in-time. Per control (from compliance-control-foundation): evidence type, cadence matched to control operating frequency, population for auditor sampling, named collector, retention, and audit-window coverage with a hole map. Formalizes the Phase 5 evidence pack (screenshot-evidence-planner, manual-test-case-creator), audit-log-architect trails, and agent-...

On a cadence, extract decisions, bugs, and backlog items that exist only in ephemeral AI-chat history into dated repo docs, then AUDIT every item against PR/source evidence — classified completed / partial / active / not-active / unknown with citations; a chat "done" caps at unknown until repo evidence upgrades it. Enforces the standing rule: do not rely on stale chat history — tracked repo docs are the working record. Produces the dated extraction doc, the per-item audit table, and survivors...

Design cell-based (blast-radius) partitioning for a multi-tenant SaaS — a cell is a self-contained stack subset (compute + data + cache + queue) that serves a subset of tenants end to end, so a failure, bad deploy, or noisy tenant is contained to ONE cell instead of the whole fleet: cell definition, tenant→cell mapping and placement policy, a thin cell-router, cell-by-cell deployment/canary, cross-cell/global concerns, and cell migration/rebalancing. SCALE-STAGE — most SaaS never needs it; re...

Decide what gets cached, where, and how it stays correct — candidate analysis first (read/write ratio, miss cost, staleness tolerance stated per item), layer choice (HTTP/CDN edge, in-process, distributed cache, DB materialization), invalidation designed BEFORE the cache ships (TTL, event-driven purge with backstop, write-through/behind — with the consistency envelope each buys), key design where tenant scoping is a correctness boundary (tenant-qualified keys; a NEW cache store's isolation de...

Design the async job/worker EXECUTION model for a multi-tenant SaaS — offload slow work off the request path: worker pools, scheduled/cron jobs, job idempotency + resumability/checkpointing, retry with backoff, a job dead-letter queue, visibility timeouts, and per-tenant fairness so one tenant''s flood cannot starve others. Produces the job catalog, the execution/retry/DLQ contract, and a fairness + scaling plan. Use when moving slow work out of the request, adding scheduled jobs, or when job...

Diagnose access changes that failed to take effect: revoked roles or memberships, logout, plan changes, or deletion. Inventory old authority in sessions, JSON Web Token (JWT) claims, client and server caches, live subscriptions, database context, search indexes, and signed links. Locate the holder with evidence, design invalidation against an owner-confirmed revocation bound, and verify denial first. Composes caching-strategy-designer, realtime-subscription-architect, plan-entitlement-archite...

MANUAL-ONLY; never auto-invoke. Design the centralized model-routing layer all AI calls flow through — one internal interface in front of every provider/model so credentials live server-side only (never in the client bundle), routing picks the model by task/cost/availability, per-call telemetry is emitted, and budgets/rate limits from ai-cost-guardrail-designer are enforced at the choke point, with failure handled by retries/backoff, provider fallback, degraded responses, and a kill switch. C...

Review the governance and risk posture of an artificial intelligence (AI) feature: classify impact, assign a human owner, match human oversight to risk, check disclosure, consent, data use, retention, and a feature card, then map applicable European Union (EU) AI Act obligations and voluntary National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF) functions to controls. Composes ai-sdlc-operating-model, agent-governance-audit, and human-approval-boundary. Use ...

Design cost and consumption guardrails for a large language model (LLM) feature, covering spend and unbounded-consumption abuse (Open Worldwide Application Security Project identifier LLM06). Specify token caps, per-user/tenant/plan budgets, cost-aware rate limits, task-aware model choice, concurrency and queue bounds, agent loop limits, input limits, a fail-closed spend kill switch, degraded fallback, and telemetry. Compose saas-cost-architect for unit economics and observability-operator fo...

Design an agentic loop's shape and bounds — decide explicitly whether a loop is needed; clamp iteration ceilings; classify failures before retrying; stop on policy denials and permanent errors; retry a transient failure at most once on identical input only when the operation is safe to repeat; distinguish retry exhaustion and unknown outcomes from proven permanent failures; report empty results honestly. Consumes cost caps from ai-cost-guardrail-designer, gives recovery checkpoints to agent-f...

Run at the start of any repository or coding task, before reading or writing code. Verifies the working directory and workspace role from available evidence, reads project instructions and status docs, and separates verified facts from assumptions and missing information. A fresh product repository may have no remote, commits, application files, or project-state document. Use when starting work in a repo, when told to cd into a path and build something there, or when resuming a session whose ...

Design the governed operating environment an AI agent runs inside — the harness: ONE server-side mediation point every model/tool call crosses; identity from credentials (never from model-supplied payload), propagated; a deny-by-default pre-flight ladder (authenticate → authorize → entitlement → budget → input policy) BEFORE the model runs, each rung fail-closed; a CLOSED tool/provider registry (unknown capability fails, never improvised); instructions as server-side versioned artifacts no un...

Audit whether an artificial-intelligence-assisted change followed governance rules: classification, scope, human approvals, merge/deploy authority, validation, security review, closeout, and memory or documentation updates. Each control receives a PASS, FAIL, or UNVERIFIABLE verdict citing primary evidence; missing evidence never passes. Use for retrospective review of a change or pull request (PR), post-incident review, autonomy spot checks, or closeout verification. Read-only; changes nothi...

Use when twitter AI influencer work spans multiple steps and needs planning plus execution coordination.

Use when tag expertise is needed to unblock implementation decisions.

Use when implementing stripe functionality with production-grade patterns and safeguards.

Use when startup expertise is needed to unblock implementation decisions.

Use when seo content planner knowledge must be documented clearly for implementation or operations.

Use when sales automator expertise is needed to unblock implementation decisions.

Use when research coordinator work spans multiple steps and needs planning plus execution coordination.

Use when a multi-phase project needs planning, delegation, and progress control across agents.