Eridian

Notes on Institutional AI.

Practical notes on building institutional AI: better decisions, clear records, protected data, and the engineering behind work teams can trust.

// ENGINEERING BLOG · 20 notes

Retention Clocks and the Signed Record
GOVERNANCE9 min

Retention Clocks and the Signed Record

Deletion is a control action. We treat retention clocks, legal hold, and dual-control purge as part of the same signed record as the original inference.

Elena Volkov
What We Hand an Examiner
GOVERNANCE10 min

What We Hand an Examiner

When a supervisor asks how a model was used on a live matter, we produce a pack: policy version, route, redaction proof, approvers, and the retained output.

Phil Hofsteder
The South Africa Operating Window
OPS8 min

The South Africa Operating Window

Johannesburg covers the African morning overlap with Dubai. Here is how on-call, residency pinning, and POPIA-aligned retention work from that office.

Joseph Kadart
Routing Policy Is a Control, Not a Preference File
ROUTING11 min

Routing Policy Is a Control, Not a Preference File

Model choice is a risk decision. We version routing policies, require dual control on chain edits, and log every fallback as an auditable event.

James Okafor
Residency Pinning Across Dubai, Hong Kong, and Johannesburg
COMPLIANCE10 min

Residency Pinning Across Dubai, Hong Kong, and Johannesburg

A workflow that can run in three regions still has one residency rule. Pinning, failover, and cache scope have to agree or the request fails closed.

Phil Hofsteder
Incident Report: Provider Timeout, 14 November 2025
INCIDENT8 min

Incident Report: Provider Timeout, 14 November 2025

Claude returned 503s for 11 minutes. Fallback held. Two legal workflows paused on dual control. This is the write-up we issued to customers.

James Okafor
Running Institutional Ops from Hong Kong
OPS9 min

Running Institutional Ops from Hong Kong

Hong Kong is our Asia operating office. It is not a second headquarters. Here is how we staff follow-the-sun review, HKMA-shaped logging, and regional pinning.

Joseph Kadart
UAE PDPL and GDPR on One Control Plane
COMPLIANCE11 min

UAE PDPL and GDPR on One Control Plane

RENEDOR LLC is seated in Dubai. European desks still need GDPR. We map both regimes onto the same invocation controls instead of running two products.

Phil Hofsteder
Model Evals That a Committee Can Read
EVALS12 min

Model Evals That a Committee Can Read

An eval suite that only engineers understand will not survive model risk. We ship scorecards a legal and risk committee can sign without a translation layer.

James Okafor
Contract Review as an Operating Line, Not a Chat Window
LEGAL10 min

Contract Review as an Operating Line, Not a Chat Window

Clause extraction is a queue with owners, SLAs, and dual control on redlines. We ran this as production ops for six months. Here is the operating model.

Elena Volkov
On-Call When the Model Is in the Path
OPS9 min

On-Call When the Model Is in the Path

The on-call assistant is generally available. It can query logs and propose mitigations. It cannot page a vendor, mute an alert, or change a routing chain without dual control.

James Okafor
Cost Attribution by Desk, Workflow, and Model Route
FINOPS10 min

Cost Attribution by Desk, Workflow, and Model Route

Token invoices are not a cost system. We attribute spend to project, desk, workflow template, and route so finance can explain a Tuesday spike without a war room.

James Okafor
Semantic Caching: The Untapped 40% Cost Reduction in LLM Inference
ENGINEERING12 min

Semantic Caching: The Untapped 40% Cost Reduction in LLM Inference

We measured a 38% reduction in inference costs for enterprise RAG workloads using our semantic caching layer. Here's how it works, how we tuned it, and the tradeoffs we made.

James Okafor
Why Your LLM Inference Pipeline Is Broken (And How to Fix It)
ARCHITECTURE15 min

Why Your LLM Inference Pipeline Is Broken (And How to Fix It)

Your LLM inference pipeline is not 'just an API call.' It's a distributed system that needs observability, caching, and governance. Here's why most teams get it wrong - and how to fix it.

James Okafor
PII Redaction at Inference Time: A Practical Guide for Financial Services
COMPLIANCE10 min

PII Redaction at Inference Time: A Practical Guide for Financial Services

In the financial sector, PII redaction is not optional. Here's how we built a real-time NER-based redaction layer into our inference pipeline, and the accuracy benchmarks we hit.

Phil Hofsteder
Multi-Model Routing: How to Build a Fault-Tolerant Inference Stack
ROUTING14 min

Multi-Model Routing: How to Build a Fault-Tolerant Inference Stack

No single model is perfect. Our routing engine dynamically selects the optimal model for each request based on cost, latency, and quality. Here's the architecture.

James Okafor
The Rise of Agentic Workflows: Orchestrating Multi-Step LLM Pipelines
AGENTS18 min

The Rise of Agentic Workflows: Orchestrating Multi-Step LLM Pipelines

The future of enterprise AI is not a single prompt-response. It's a multi-step agentic workflow. Here's how we orchestrate them, and the patterns we've learned from 12 enterprise deployments.

Elena Volkov
Audit Trails That Survive Examination
GOVERNANCE9 min

Audit Trails That Survive Examination

A log you can grep is not an audit trail. We sign every invocation with policy version, actor, route, and retention class so a supervisor can reconstruct the decision.

Joseph Kadart
Dual Control for Model Actions That Can Move Money or Change Policy
GOVERNANCE8 min

Dual Control for Model Actions That Can Move Money or Change Policy

If a workflow can change a limit, send a notice, or publish a template, one human is not enough. Dual control is enforced at the gateway, not in a slide deck.

Phil Hofsteder
Data Residency Has to Hold at Inference, Not Only at Rest
COMPLIANCE9 min

Data Residency Has to Hold at Inference, Not Only at Rest

Storage in Dubai does not help if the prompt leaves the region for a model call. From the start we treated residency as an invocation rule, not a disk policy.

Phil Hofsteder