AI coding assistants for a regulated, healthcare-adjacent company — with every request controlled, logged and capped

Sector: Regulated, healthcare-adjacent, ISO 27001-certified
Need: Let developers use AI without code, data or credentials leaving controlled boundaries
Delivered: A governed AI development environment (MVP), demonstrated October 2026
Outcome: The client approved delivery to completion

Context

An ISO 27001-certified company in a regulated healthcare-adjacent sector wanted its developers to benefit from AI coding assistants — without exposing source code, data or credentials.

Challenge

Processing had to stay in the EU.
Every AI interaction had to be auditable.
Spending had to be capped.
Access had to follow least privilege.
No developer data could sit on uncontrolled infrastructure.

Approach

We built the controls first and proved each one by watching it fail before it counted. A threat model maps every identified threat to a control.

What we delivered

AI reachable only through the company VPN (device certificate + single sign-on) and a personal one-time login
A policy gateway in front of the AI model: only approved models in approved EU regions; anything else is refused and logged
Spending caps per run and per month, plus cloud budget alarms with automatic stop
A tamper-proof audit trail on write-once storage, with a separate auditor role
A locked-down developer workspace that can reach only the gateway — not the internet
Spend visibility for developers and operators

Results

Around 3,000 automated tests across gateway, harness, evidence tooling and infrastructure; every control observed failing before it was accepted; MVP demonstrated to the client’s product owner and approved for full delivery.

How we measure

What we learned

In regulated environments, the controls are the product. Building them first made the AI rollout a governance decision, not a leap of faith.