The judgment behind Hulbon

20+ years in systems where a failure is a regulated event, not a bug ticket. Now I bring that judgment to AI.

Senior Principal on a $2B+/yr healthcare/PBM platform (CVS, Walmart, 11 state Medicaid; high-consequence regulated-scale delivery) · national-government secure-systems leadership · founder-built multi-tenant agentic-AI platform. That combination — regulated-scale architecture, secure-systems depth, and hands-on production AI — is what makes Hulbon workflow-risk judgment credible.

$2B+ regulated healthcare/PBM
Multi-tenant financial platform for CVS, Walmart, and 11 state Medicaid programs, with regulated-scale architecture, access boundaries, audit evidence, and AI-powered document processing at scale.
National-government secure-systems leadership
Senior technical roles building and operating complex secure systems where reliability, access boundaries, and evidence handling carried national-level stakes.
Founder-built agentic AI (Lantanios)
Live multi-tenant platform: Stripe Connect payouts, multi-tenant isolation, AI composer gated by role and approval, multi-model agentic AI. I build and operate one — so I know exactly where AI-built workflows break under real customers and real money.
See How I Work

Synthetic sample

Sample Decision Memo: one AI workflow before customer review

Fast AI-built software often looks ready before the evidence is ready. This representative Decision Memo format shows how Hulbon reviews one write-capable AI workflow before handoff, launch, customer review, funding, or agent/API exposure.

This is a fictionalized sample, not a client case study. It is not a security certification, compliance review, legal opinion, investment recommendation, or guarantee that a system is safe.

Review object

AI renewal assistant for a B2B SaaS product

Business event

Customer-facing pilot before an enterprise account renewal review

Decision question

Can this workflow proceed to pilot, or must it be hardened first?

Decision

Proceed after hardening

The workflow is not a pause-level failure. It is bounded to one business process, but it should not face enterprise renewal review until the write-capable tool boundary, tenant checks, approval trail, and replay evidence are hardened.

What the memo decides

It does not try to prove every line of code. It answers the commercial decision:

  • Proceed.
  • Proceed after hardening.
  • Pause until the riskiest boundaries are fixed.

Evidence Reviewed

Provided

  • Product walkthrough
  • Architecture diagram
  • Agent prompt and tool manifest
  • CRM and billing-tool permission notes
  • Staging workflow replay
  • Sample logs from five test accounts
  • CI test list
  • Deployment checklist
  • Support escalation policy

Missing or incomplete

  • Tenant-boundary test cases for cross-account retrieval
  • Signed approval record for discount or billing-affecting actions
  • Tool-call replay with before/after state
  • Rollback procedure for incorrect CRM stage changes
  • Documented owner for weekly agent behavior review
  • Red-team or abuse-case test pack

Highest-Risk Boundary

The highest-risk boundary is not the language model itself. It is the transition from agent recommendation into a write-capable system action.

Agent recommendation -> tool call -> customer/account record change.

Risk Summary

Sample findings

  • Tool credentials are broader than the renewal workflow needs.
  • Tenant boundary relies on prompt and route convention.
  • Discount request path lacks signed human approval.
  • Logs are useful for debugging but not review-grade evidence.
  • Rollback path is informal.
  • Prompt-injection, stale-account, conflicting-source, and abuse-case tests were not provided.

Tool credentials

High

One broad service token can update CRM stage and open billing-support tasks across account types.

Tenant boundary

High

Cross-account retrieval is assumed by prompt policy and route convention, but not proven by negative tests.

Approval trail

Medium-high

Discount and billing-adjacent actions lack a sealed human approval identity, time, policy version, and payload.

Replay and rollback

Medium

Logs support debugging, but reviewers cannot reconstruct source records, before/after state, or tested reversal.

Required Hardening Before Pilot

1. Tool authority

  • Replace broad service token with scoped tool tokens.
  • Separate read-only account context from write-capable CRM actions.
  • Block billing-adjacent tool calls unless a human approval event exists.

2. Tenant and data boundaries

  • Add negative tests for cross-account retrieval.
  • Enforce tenant/account boundary server-side before agent context is assembled.
  • Record which source records were made available to the agent.

3. Approval and audit

  • Seal approval identity, approval time, policy version, and tool-call payload.
  • Store before/after state for CRM stage changes and billing-support tasks.
  • Add a review export for customer security or internal risk reviewers.

4. Replay and rollback

  • Replay at least ten representative account states.
  • Add a rollback checklist for incorrect CRM and billing-support actions.
  • Assign a weekly behavior-review owner for the pilot period.

Proceed / Harden / Pause Recommendation

Proceed nowInternal demo only, with read-only recommendation mode.
Proceed after hardeningCustomer-facing pilot with write-capable tools only after Priority 1-4 are complete and evidence is exportable.
PauseIf tool scopes cannot be narrowed, tenant-boundary enforcement cannot be tested, or approval and before/after evidence cannot be produced.

Out-of-scope boundaries

  • Full platform redesign
  • SOC 2, HIPAA, PCI, legal, or compliance certification
  • Model replacement
  • Broad penetration test
  • Renewal strategy consulting

Evidence requested for final review

  • Final tool manifest
  • Scoped token policy
  • Tenant-boundary test results
  • Approval event schema
  • Sample before/after tool-call records
  • Replay outputs
  • Rollback playbook
  • Pilot behavior-review owner
  • Customer-review evidence packet
See the Decision Memo offerView Evidence Flight Recorder

The Evidence Flight Recorder below shows the same kind of review-ready trace as an interactive workflow artifact.

Interactive proof

A workflow should be able to explain itself under pressure.

The useful proof is not another screenshot. It shows one action moving through identity, permissions, approvals, audit evidence, tests, rollback, and agent/tool authority before a handoff or review event.

Evidence Flight Recorder

A write-capable AI action becomes an inspectable review artifact.

Illustrative scenario. Not anonymized client engagement.

MomentAgent/API exposure
PostureHarden first
Step 4 of 8: approval boundaryEvidence present

Diff, policy scope, queued write, audit target, and rollback condition are visible.

AI reviewer

Source visible
Question

The tool boundary is mapped, but the approval event is not tied to a named human decision. Should the write action pause?

Named approval is missing; pause the write action.

Evidence presentDiff, policy scope, queued write, audit target, and rollback condition are visible.
Gap foundApproval is implied by workflow state, not captured as a signed human event.
Proof packet readyBoundary map, scoped-token evidence, missing approval, recovery path, memo posture.
Approval boundary needs signed evidence.
See the hardening sprint

Decision outcomes

How the memo turns evidence into a commercial recommendation.

The memo does not try to prove every line of code. It answers the commercial decision: whether the product can move into the next review, needs a focused hardening sprint first, or should pause until the riskiest boundaries are fixed.

ProceedThe workflow can enter the next review with normal engineering follow-through.
Proceed after hardeningThe workflow is bounded and useful, but write-capable tool boundaries need focused hardening before review.
PausePilot, launch, funding, acquisition, or handoff should wait until the highest-risk boundaries are fixed.
  • Which trust boundary can block the next commercial event.
  • Which fixes should be funded now, deferred, or excluded.
  • What evidence should be packaged for customers, reviewers, investors, buyers, or clients.
See the Decision Memo offer

Tool credentials

High

One broad service token can update CRM stage and open billing-support tasks across account types.

Tenant boundary

High

Cross-account retrieval is assumed by prompt policy and route convention, but not proven by negative tests.

Approval trail

Medium-high

Discount and billing-adjacent actions lack a sealed human approval identity, time, policy version, and payload.

Replay and rollback

Medium

Logs support debugging, but reviewers cannot reconstruct source records, before/after state, or tested reversal.

Systems I built myself

Founder-built systems prove the platform depth behind Hulbon.

Hulbon's public proof should not pretend these are client case studies. They are founder-built systems that demonstrate architecture, implementation depth, and the ability to reason across money, identity, agents, real-time workflows, game state, and launch pressure without exposing private internals.

Lantanios Solutions Inc / Lantanios platform

Founder-built multi-tenant ecommerce and site-builder platform with AI operations, marketplace payments, custom domains, and platform/tenant boundaries.

  • P/T multi-tenancy pattern with data isolation across platform and tenant surfaces.
  • Stripe Connect marketplace, subscriptions, affiliate flows, checkout, orders, and webhook handling.
  • Cloudflare custom hostnames, DNS, SSL automation, and cross-domain auth paths.
  • Multi-agent reasoning system with model routing, budget tracking, team spawning, and Socket.IO monitoring.

Lost In Time game project

Founder-built Roblox asymmetric horror game system used as proof of real-time workflow orchestration, durable state, bounded AI behavior, and release-oriented asset pipelines.

  • Server-owned Luau/Rojo architecture with state-machine and event-driven workflow control.
  • Server-authoritative outcome resolution across multiple actor roles, with consistent event-finalization evidence.
  • Durable player/session state across progression, currency, products, rewards, quests, leaderboards, admin tools, and DataStore-backed persistence.
  • Bounded AI behavior, animation/sound pipelines, brand asset variants, build tooling, and release-oriented validation harnesses.
Stripe Connect onboarding, payouts, marketplace flows, subscriptions, and webhooks
Cloudflare custom domains, SSL automation, DNS, and cross-domain auth boundaries
React/TypeScript editor, admin, storefront, and operator surfaces
MongoDB, Redis, Socket.IO, Docker, GCP, AWS, and server-side rendered React
OpenAI, Anthropic, Groq, multi-agent reasoning, tool routing, and budget-aware AI operations
Real-time multi-actor workflows, server-authoritative state machines, durable session state, and release-asset pipelines through Roblox Luau/Rojo

Lantanios architecture

A useful platform proof shape without exposing private implementation details.

This diagram represents the Lantanios platform proof track. Lost In Time remains separate founder-built proof for real-time workflow, game-state, AI behavior, and release-pipeline complexity.

Builder and admin UI

React/TypeScript surfaces for editing, products, stores, files, and operators.

Platform services

Node/Express, MongoDB, Redis, Socket.IO, email, storage, auth, and deployment flow.

Money and domains

Stripe Connect, orders, payouts, custom domains, DNS, SSL, and rollout boundaries.

AI and tools

OpenAI, Anthropic, Groq, AI widgets, reasoning layers, and agent-style operations.

Why it matters

Hulbon can evaluate and fix cross-system risk.

Auth, payments, data, AI tools, cloud, real-time events, and UI cannot be evaluated in isolation when agents or users touch production workflows.
Lantanios and Lost In Time prove the ability to reason across very different systems while still shipping practical implementation work.
That is the same judgment needed to harden AI-built products, package evidence, and expose SaaS workflows to agents or reviewers.

Next step

Bring the workflow, the diligence question, or the ongoing AI/tech leadership need.

Whether you need a Workflow Risk Snapshot before a pilot, technical due diligence before a deal, or an ongoing fractional AI/Tech CTO — a 30-minute scoping call confirms fit before any paid step.