Agentic AI systems
I build AI agents that do real work — and the controls that make them safe to run.
Agents that read your data, use your systems, and finish tasks your team now does by hand. Permissions are checked in code, a person approves anything that moves money or changes a record, every change is tested, and spending has a hard limit. Thirty years building the internal systems businesses run on — construction management, payroll, CRM, lending and lottery platforms — and the last seven as backend architect of a security-compliance platform. I design the agent, connect it to the systems it needs, and can run it.
- Building software since 1993
- LangGraph agents · typed tools · human approval
- Evals on every change
- Self-hosted LLM inference — nothing leaves your infra
- CISOteria — GRC SaaS architect (7 yrs)
- National Cyber Directorate GRC portal — backend lead
- Flixel founder · 7 patents
- IDF Major (ret.)
- B.Sc. Math & Physics, TAU
What I do
Agentic workflows
Agents that take a request, find the right data, call your systems through typed tools, and check the result before they act. Built on LangGraph with the state saved at every step, so a run can stop for review and continue from where it stopped. Good first targets are the tasks your team repeats every day: customer requests, back-office cases, recurring reports.
Controls on what an agent can do
Permissions checked in code against the logged-in user, never left to the prompt. A person approves any action that moves money or changes a record, and the decision is saved as an audit record. Hard spend limits, so an agent stuck in a loop stops at the gateway instead of on your invoice — the part I built and run as Guardrail.
Agents over your own data
Retrieval over your documents and databases, with answers that cite their sources — built and tested at 35 million chunks. Open-weights models on your own servers when the data cannot leave your infrastructure.
Evals, speed and cost
Tests that run on every change: fast checks on the rules that must never break, plus conversation tests for answer quality. Model choices measured on real tasks, not guessed — in one build, a fine-tuned classifier routed requests more accurately than a general LLM, in 12 ms instead of 2 seconds.
Selected work
LangGraph banking copilot
Agentic workflow · human approval on money
Intent router to retrieval to tool-calling agent to verification, with checkpointed state and a typed Pydantic action layer. Every money-moving action pauses for human approval, and the decision is saved as an audit record. Before a reply reaches the customer, code checks every number against the tool results and redoes the arithmetic; an LLM reviews only what code cannot check.
Fine-tuned intent router
LoRA fine-tune · measured against an LLM
Replaces the LLM routing step at the front of the copilot with a fine-tuned multilingual encoder. On the 77-intent BANKING77 benchmark it scored 94.2% against 85.3% for Claude Sonnet 4.6, at 12 ms per message instead of 2 seconds. Messages it is not confident about still go to the LLM.
RAG on Postgres / pgvector
Open source · 35M-chunk index · agent mode · public demo
Chunking, embeddings and similarity search on self-hosted Postgres with pgvector and local Ollama inference — deliberately without a dedicated vector database. Scaled to a 35M-chunk Wikipedia index with ~1 ms queries; live at ask.amiheines.com behind rate limiting and a token budget. The repo also has an agent mode that plans several searches, reads the evidence, and searches again before it answers with citations.
Guardrail — fail-closed AI gateway
Live · LLM spend & abuse control · LiteLLM plugin
Hard spend caps and denial-of-wallet limits enforced in the request path, so a runaway agent loop stops at the gateway instead of on next month’s invoice. Designed against the OWASP LLM Top 10.
CISOteria
Security-compliance (GRC) SaaS · backend architect, 2019–2026
Multi-tenant CISO / compliance platform, also powering the Israel National Cyber Directorate’s GRC portal. I owned the API, data model, and architecture — Node.js + a modernized PHP core, MariaDB / Redis / Docker, vulnerability dashboards and analytics, SSO / SAML.
CISOteria — asset risk graph (D3)
Compliance data-viz · D3.js hierarchy
A D3 hierarchy I built for CISOteria: an asset’s risk score traced down to the systems and infrastructure it depends on — colour-coded by risk, so the weakest link is obvious.
Israel National Cyber Directorate — GRC portal
grc.cyber.gov.il · built at CISOteria · backend lead
The Israel National Cyber Directorate’s governance-risk-compliance portal, powered by CISOteria (“Cyber OS”). I led most of the backend and built parts of the front end.
IMS — interactive weather map
Israel Meteorological Service · front-end / data-viz
Map-overlay work I contributed to the Israel Meteorological Service (ims.gov.il) — data overlays on their interactive synoptic forecast maps.
ChainVault
Private-blockchain deal room
Tamper-proof real-estate closing platform with on-chain wire-fraud prevention — a 4-node Antelope / BFT chain and a client-side-encrypted document vault.
Verarta
Art provenance on a private chain
Immutable provenance records for artworks — no third-party dependency, full audit trail.
More from me
Controlling the AI you can’t fully trust — its cost, its abuse, and its compliance.
I write near-daily about the practical side — cutting cloud bills and keeping AI spend and abuse under control — at smallestbusiness.com . Get the posts by email, or read them there.
Or read at smallestbusiness.com →Is there a task your team does by hand every day? Tell me what it is. I will tell you whether an agent can do it, which systems it needs, and where a person should approve.