AI systems with an owner, scoped permissions and a measured error rate.
We build predictive models, language and vision systems, and LLM agents. Before any of them touches production data, we decide what each one is allowed to see and do, and how we'll know when it's wrong.
Cohash plans, builds and governs AI systems for clients.
That covers predictive models, NLP and computer vision, and also generative AI apps and agents running on Anthropic Claude or the OpenAI API. We came to this from identity work, so every agent we ship gets its own identity and narrow permissions. Governance is mapped to the NIST AI RMF, ISO/IEC 42001 and the EU AI Act.
From the first call to a setup your own team can run.
Here's what usually prompts a call about your AI & Machine Learning, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · where you end up
incident board · ai & machine learning3 open
openTeams are trying AI tools on their own and nobody has a list of what is in use.
recurringA chatbot pilot worked in a demo but nobody trusts it with real customer data.
blockedAn agent has to act in Salesforce or a ticketing system, and right now it would run on a shared admin account.
exposure
AI strategyGenerative AI and agentsAI governance and securityMachine learning modelsLanguage, vision and deep learning
ready to hand over
There is a register of AI systems with owners.
We showed the team which features drive spend.
chapter 01 · where it hurts
Why teams reach out
Teams are trying AI tools on their own and nobody has a list of what is in use.
A chatbot pilot worked in a demo but nobody trusts it with real customer data.
An agent has to act in Salesforce or a ticketing system, and right now it would run on a shared admin account.
chapter 02 · what we change
How we solve it
AI strategy
Generative AI and agents
AI governance and security
Machine learning models
Language, vision and deep learning
chapter 03 · where you end up
What changes
There is a register of AI systems with owners.
We showed the team which features drive spend.
what we do
Where we spend the hours
5 areas of work, each one done by an engineer who has run it in production.
A ranking of use cases by value, data readiness and risk. One is scoped for production. For the rest, we write down why they were dropped.
Retrieval over your documents, agents that act through tools, and MCP servers secured with OAuth, each agent running under its own identity.
An AI system inventory, risk classification and controls mapped to NIST AI RMF, ISO/IEC 42001 and the EU AI Act, plus testing for prompt injection and data leakage.
Forecasting, churn, fraud and risk models on Databricks, Snowflake or Microsoft Fabric. We set up the registry, drift monitoring and retraining too.
Text extraction and classification, image and video models, and neural networks we fine-tune or compress for wherever they'll actually run.
capability 01 / 05in production
AI strategy
A ranking of use cases by value, data readiness and risk. One is scoped for production. For the rest, we write down why they were dropped.
An AI system inventory, risk classification and controls mapped to NIST AI RMF, ISO/IEC 42001 and the EU AI Act, plus testing for prompt injection and data leakage.
We pieced these together from AI & Machine Learning situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Dozens of AI pilots, two in production, and no inventory
composite · not a client story
Beforethe situation
Business units have started dozens of pilots across several model providers, and some SaaS vendors have turned on AI features by default. Security can't say which systems send customer data to a model, and legal has started asking about the EU AI Act.
What we dothe work
First comes the inventory: every pilot, provider and SaaS AI feature, with an owner and the data it touches. Each entry gets a risk class. Then we pick the one or two pilots worth finishing, give them evaluation sets and service identities, and pause any that send sensitive data without contract terms that cover it.
Afterwhere you end up
There is a register of AI systems with owners. The pilots that continue have a path to production, and the ones that stop are documented with a reason.
case file 02
An internal assistant whose token bill grew faster than its users
composite · not a client story
Beforethe situation
An internal assistant on a hosted LLM caught on quickly. Every request goes to the biggest model, retrieval stuffs whole documents into the prompt, and monthly spend has grown several times over since launch.
What we dothe work
We logged token counts by request type and scored answers against an evaluation set. Then we routed simple requests to a smaller model, trimmed retrieved chunks, and turned on prompt caching for the long system prompt where the provider supports it. Each change shipped only if evaluation scores held.
Afterwhere you end up
We showed the team which features drive spend. Then we cut the waste, with no measured drop in answer quality.
Where AI systems sit between your data, identity and governance
Governed data comes from the data platform. Models and agents read it and act on business systems through their own scoped identities, nothing else. Governance keeps the inventory, risk assessments and evaluation evidence for each production system.
01 · Data
Data platformDatabricks · Snowflake · Fabric → Predictive models · features
Put these to anyone bidding on your AI & Machine Learning work. The ones who've done it answer differently from the ones who've read about it.
Q1
How will you measure whether the system is right, before launch and after?
Demos look good on hand-picked examples. Ask for an evaluation set built from your real cases, a scoring method, and proof it runs on every release.
Q2
What identity will each AI system or agent run under, and what can it reach?
Agents that borrow a user's session or a shared API key can't be scoped or revoked cleanly. Each one needs its own identity and least-privilege access.
Q3
Which of our use cases could fall under the EU AI Act or Colorado's ADMT law?
Hiring, lending and insurance uses can count as high-risk or consequential decisions. A partner should flag that early, so your counsel can confirm the position before anything gets built.
Q4
How much work would it be to switch model providers after launch?
Prices and terms change often, and model quality does too. Hard-code one provider's SDK and prompt format and the application gets expensive to move.
Q5
What will this cost to run each month at our expected volume?
Token costs grow with usage and with document size. Ask for an estimate based on test runs with your own prompts. A list-price calculation won't tell you much.
01Where should we start with AI?
With one process where errors are cheap to catch and the data already exists, such as drafting, triage or search over internal documents. A narrow first use case with a measured result teaches more than a broad pilot.
02Do we need to train our own model?
Rarely. For most business use cases a hosted model, retrieval over your data and a decent evaluation set are enough. Training or fine-tuning starts to pay off for narrow tasks at high volume, or when the data can't leave your environment.
03Are you tied to one model vendor?
We don't. We use Anthropic Claude, the OpenAI API and open-weight models, and build applications so the model can be swapped after an evaluation run.
04How do you keep our data out of a provider's model training?
By reviewing the provider's commercial terms and data retention settings with you before anything is sent, choosing a deployment route that matches your data rules, and redacting sensitive fields where needed.
05Can you help with AI features already switched on inside our SaaS tools?
Yes. A copilot inside your CRM, office suite or ticketing tool is an AI system too. We look at what data it can reach and which admin settings control that, and it goes in your AI inventory alongside what you build.
related
Often paired with
Projects on AI & Machine Learning usually end up touching one of these, so they're worth a look.
