How we build
Built properly
AI lets us build at a speed that used to take a whole team. 35 years of experience decides what gets built, how it's secured, and when it's ready for production.
Adrian, our founder, has spent 25 years hands-on as a developer and architect, and 10+ years managing software projects and delivery teams. We use AI coding agents every day, and we wrap them in the controls a large organisation would expect: right-sized, not bureaucratic.
- Total experience
- 35 years
- Hands-on coding & architecture
- 25 years
- Leading projects & delivery teams
- 10+ years
Vibe coding and building properly
“Vibe coding” (describing what you want and letting an AI write it) is a genuinely great way to explore an idea. The trouble starts when a prototype quietly becomes the product. Here's what changes when the same speed is guided by experience.
-
Requirements
Vibe coding on its own
The prompt is the spec, so it changes every session.
Built properly
A short written requirements document (PRD) first, numbered and versioned, so the AI and the client work from the same page.
-
Pace
Vibe coding on its own
Fast at the start, then slows as fixes break other things.
Built properly
Fast and steady: small, tested increments that each leave the product working.
-
Environments
Vibe coding on its own
One environment, usually production.
Built properly
Separate dev and production, defined as code, so a change is proven before customers see it.
-
Releases
Vibe coding on its own
Deployed from a laptop.
Built properly
CI/CD pipelines with no stored cloud passwords, and a human approval before production.
-
Secrets and data
Vibe coding on its own
API keys in the code; every user can query every row.
Built properly
Secrets in a key vault, per-user credentials encrypted, and the database itself enforcing who can see what.
-
Testing
Vibe coding on its own
“It worked when I tried it.”
Built properly
Automated smoke tests on every deployment, with screenshots kept as evidence.
-
AI spend
Vibe coding on its own
Discovered on the monthly bill.
Built properly
Cost estimates and a person’s approval before any expensive AI call runs.
-
When something goes wrong
Vibe coding on its own
Guesswork.
Built properly
Telemetry, alerts and an audit log of who did what, and when.
Eight things we always do
Where we can, each one comes with an example from our own products and client work. The rest are enterprise practices we design in from the start.
-
Requirements before code
Every product starts with a plain-English product requirements document. Features are numbered PRDs with clear acceptance criteria, which gives AI agents a precise brief and gives clients something they can check.
In practice: Our AI video studio, YTCC, is specified in more than 50 numbered PRDs, from the show bible through to video assembly.
-
Small, shippable increments
We ship in small slices that each leave the product working, to a live dev environment. You see real progress every week, and the cost of changing direction stays low.
-
Infrastructure as code, with separate dev and prod
Cloud resources are written in Bicep, so environments are repeatable, reviewable and easy to rebuild. Dev and production are separate, and nothing reaches production untested.
In practice: YTCC’s Azure App Service, serverless Cosmos DB, Blob Storage, Key Vault and Azure OpenAI are all defined in Bicep, with matching dev and production environments.
-
Gated, password-free deployments
GitHub Actions builds, tests and deploys every change. Pipelines sign in to Azure with short-lived OpenID Connect (OIDC) tokens rather than stored passwords, and production deployments wait for a human approval.
In practice: YTCC has separate dev and production GitHub Actions workflows. The production workflow signs in to Azure with OIDC and waits for a person to approve before it deploys.
-
Security in the foundations
Sign-in uses Microsoft Entra or Supabase Auth. Multi-tenant data is isolated by row-level security in the database, not just in the app. Secrets live in Key Vault, and shared Zod schemas validate the API contracts between front end and back end.
In practice: Our field-work media platform, Before & After, isolates each business’s data with Supabase row-level security. YTCC signs users in with Microsoft Entra External ID, encrypts each user’s credentials with a Key Vault key (envelope encryption), and shares Zod schemas between its web app and API.
-
Tested, with evidence
Playwright smoke tests run against real deployments and save screenshots and results, so “it works” is something you can see, not just something we say.
In practice: For an Australian university’s project registry, Playwright smoke tests check each release and save screenshots and results as evidence.
-
AI with a person in charge
AI does the heavy lifting; people make the decisions that matter. Expensive steps show a cost estimate and wait for approval. Where quality matters, several models are compared blind.
In practice: In YTCC, five writers from OpenAI, Anthropic, Google, xAI and Azure OpenAI draft the same episode and rank each other’s work without names. A person picks the winner, and no video is generated until someone approves the estimated cost.
-
Designed to be observable and auditable
For production systems we design in monitoring with Azure Application Insights, so problems surface before customers notice them, and an audit log of important actions such as approvals, spend and admin changes. It’s standard enterprise practice, and it’s far easier to build in from the start than to bolt on later.
What you get
-
Speed you can see
Working software early and often, on a live dev environment you can click through.
-
Requirements in writing
A PRD you can read, question and sign off, kept up to date as the product evolves.
-
A codebase you own
Your GitHub repository, your cloud subscription, and infrastructure as code, so you’re never locked in.
-
Production-ready from the start
Separate environments, gated deployments, secrets management and automated tests from the very first release.
-
AI costs under control
Model choices matched to the job, cost estimates up front, and approvals before anything expensive runs.
-
Experience on call
35 years across development, architecture and delivery leadership, applied to your project directly.
Training & certifications
- Microsoft Certified: Azure Solutions Architect Expert (AZ-305)
- Microsoft Certified: Azure Administrator Associate (AZ-104)
- Microsoft Certified: Azure AI Engineer Associate (AI-102)
- Microsoft Certified: Azure Developer Associate (AZ-204)
- Microsoft Certified: Azure AI Fundamentals (AI-900)
- Microsoft Certified: Azure Fundamentals (AZ-900)
- Scrum Master certified (2013 and 2021)
Plus a Bachelor of Science in Computer Science from the University of Melbourne. See Adrian's career.
Want it fast and built properly?
Tell us what you’re working on. We’ll tell you honestly what it takes to build it well.
Start a conversation