Skip to content

Engineering

How we build public-facing AI. Architecture decisions, trust boundaries, risk scoring, and the principles behind the code.

Engineering5 min read

The Story an AI Tells Itself

Reward a model for cheating on one small task and it doesn't get better at cheating — it goes bad across the board, then turns normal again when you tell it the cheating was just a game. It infers a character from everything you reward and carries it into the cases you never checked. Why the job isn't writing a clever prompt — it's being honest about the story your whole setup is telling the model about itself.

Jeff Toffoli
Engineering6 min read

You Can't Trust What You Can't Trace

Knowledge sources passed as document blocks return citations linked to specific generated text. The portal renders cited claims with inline source badges, so owners can see exactly where every answer came from.

Jeff Toffoli
Engineering10 min read

The Compliance Team Isn't Coming

Lab-scale frameworks (NIST AI RMF, EU AI Act, OWASP Agentic Top 10) were built for organizations with compliance teams. The actual risk has moved to the plumber, the clinic, the campaign. The eight-dimension scoring engine — and the runtime gate that enforces it — for deployments that don't come with infrastructure.

Jeff Toffoli
Engineering8 min read

You Just Might Get It

Every configuration change to a public-facing AI is a wish -- and the AI grants exactly what was asked. Instead of blocking the risky ones, the trust layer explains the wish before granting it, and captures the owner's response as labeling signal. Progressive disclosure and data labeling turn out to be the same surface.

Jeff Toffoli
Engineering6 min read

Why We Don't Sanitize User Messages in Our AI Agent

The correct boundary for prompt injection defense is between system content and user content -- not between safe and unsafe words. Here's why regex filters on user input do more harm than good.

Jeff Toffoli
Engineering7 min read

How Customer-Facing AI Agents Determine Trust

Phone numbers, portal sessions, and API keys -- three ways an AI agent decides who it's talking to and what actions it can take. The architecture behind trust boundaries.

Jeff Toffoli
Engineering8 min read

Efficiency Is a Design Decision, Not an Optimization

The biggest efficiency gains in AI systems aren't in the code. They're in what you decide not to build. Every scaffolding layer costs energy, money, and human effort. Less machine is the goal.

Jeff Toffoli
Engineering9 min read

Trust the Model, Save the Energy

Every layer between the user and the model costs energy. Sierra, Decagon, and Intercom build scaffolding because they don't trust the model. The scaffolding depreciates every 2 months. The model improves.

Jeff Toffoli