# Make More Digital

> Make More Digital is an AI-accelerated digital delivery agency founded by Chris Barry. We build software using AI-augmented development with strict governance, full traceability, and human accountability. Our approach is designed for organisations where compliance and auditability matter.

## About Us

- **Location**: United Kingdom
- **Founder**: Chris Barry, senior full-stack engineer with experience delivering complex systems in demanding environments
- **Philosophy**: AI should be treated as powerful tooling operating within strict human-defined boundaries, not as autonomous decision-makers
- **Team Model**: Senior-heavy teams augmented by AI, delivering the output of larger traditional teams
- **Our Approach**: We've built governance frameworks and methodologies specifically designed to meet the requirements of regulated industries—ready to apply when those opportunities arise

## Services

- **MVP & Product Builds**: Full product delivery including authentication, billing, dashboards, backend APIs, frontend, and deployment
- **AI Enablement**: LangGraph-based agent systems, LLM integration into existing workflows, RAG implementations, AI workflow automation
- **Fractional CTO**: Technical leadership, architecture review, team guidance, AI strategy
- **Rapid Prototypes**: Fast validation and proof-of-concept builds for stakeholder alignment
- **AI Team Training**: Hands-on workshops to upskill engineering teams on AI-assisted development practices
- **Platform Modernisation**: Legacy system migration with AI-assisted analysis and code transformation

## Technical Expertise

- Backend APIs and cloud infrastructure (AWS, Azure, GCP)
- DevOps, containerization, CI/CD pipelines
- AI/agent systems (LangGraph, custom agents, RAG architectures)
- Frontend interfaces (React, Vue, Nuxt, Angular)
- Real-time applications and interactive media
- Database design and data pipelines
- Integration with third-party APIs and legacy systems

## AI Usage Transparency & Governance

### Where AI Is Used in Development
- Requirements analysis and documentation drafting
- Code generation for well-specified tasks (CRUD, APIs, UI components)
- Test case generation from specifications
- Code review and refactoring suggestions
- Documentation maintenance

### Where AI Is Explicitly Prohibited
- Authentication and authorisation logic
- Cryptographic operations
- Financial calculations and regulatory rule engines
- Security-critical components
- Audit logging systems
- Any code without human review

### AI at Runtime vs Development
- AI is used during development to accelerate delivery
- AI is NOT embedded in production systems unless explicitly required by the project scope
- Production AI features (e.g., triage, classification) are clearly scoped and documented separately

### Auditable AI Policy
- Documented AI usage policy provided with every engagement
- AI interaction logs maintained for traceability
- Every AI-assisted output has a named human accountable for review and approval

## Intellectual Property & Training Data

### IP Ownership
- Clients own 100% of delivered code with no encumbrances
- Clean IP ownership contractually guaranteed
- No retained rights or licenses by Make More Digital

### AI Training Data Protection
- Client code is NEVER used to train AI models
- We use enterprise AI agreements (Anthropic, Azure OpenAI) with data protection clauses
- Prompts and outputs are not retained by AI providers
- Business logic and proprietary information remain confidential

### License Compliance
- Automated dependency scanning for GPL/copyleft contamination
- Software Bill of Materials (SBOM) provided on request
- License audit on all third-party dependencies
- No viral license risk in delivered code

## Model Selection & Vendor Lock-In

### AI Models Used
- Primary: Anthropic Claude via enterprise agreement
- Alternative: Azure OpenAI for Azure-native environments
- On-premise options available for highly sensitive environments
- Model selection tailored to client security and compliance requirements

### Avoiding Vendor Lock-In
- AI is development tooling, not embedded in production (unless required)
- Models can be swapped without code refactoring
- No proprietary AI frameworks in delivered code
- Standard languages, patterns, and architectures throughout

### Post-Project Independence
- At project completion, clients can build, test, and deploy without any AI tooling dependency
- Standard build tools (npm, dotnet, maven, etc.) with no AI dependencies
- Conventional test frameworks with full coverage documentation
- Standard CI/CD pipelines deployable on client infrastructure

## Code Quality & Human Accountability

### Human Review Standards
- 100% of AI-generated code reviewed by humans before merge
- Named senior engineer signs off every pull request
- Architectural consistency enforced across codebase
- Logic duplication actively prevented

### Definition of "Done" for AI-Assisted Code
- All acceptance criteria met and verified
- Tests written, reviewed, and passing
- Security scan passed with no high/critical issues
- Senior engineer approval documented
- Code traceable to specification ticket

### Accountability for Defects
- Human reviewer who approved the code is accountable for defects
- Root cause analysis includes review of AI interaction logs
- Process improvements implemented to prevent recurrence
- Defect resolution follows agreed SLA commitments

## Security Controls

### Automated Security Scanning
- SAST (Static Application Security Testing) on every commit
- DAST (Dynamic Application Security Testing) in staging environments
- Dependency scanning for known vulnerabilities
- Secret detection to prevent credential leaks in code

### Preventing AI-Introduced Vulnerabilities
- Pre-commit hooks block hard-coded secrets
- Security-focused code review checklist for all AI-generated code
- AI prohibited from security-critical code paths
- Mandatory human review for all security-related changes

## Security & Compliance Tooling

We integrate industry-standard tools into CI/CD pipelines that create automated checkpoints for safety and compliance—without slowing down AI-accelerated development.

### License Compliance Scanning
Automated scanning of all dependencies (direct + transitive) to detect GPL/AGPL/copyleft licenses and block forbidden licenses in PRs.
- **Snyk Open Source**: License policies, vulnerability scanning, GitHub/GitLab PR checks. Supports npm, pip, Poetry, Docker.
- **FOSSA**: Purpose-built for license compliance. Excellent reports for legal/compliance teams. Deep CI integration.
- **Mend (formerly WhiteSource)**: Enterprise-grade transitive scanning. Policy enforcement. Widely recognised by procurement teams.

### Static Application Security Testing (SAST)
Analyse source code for security vulnerabilities before deployment. Runs on every commit.
- **SonarQube / SonarCloud**: Code quality and security analysis. Quality gates block vulnerable code from merging.
- **Semgrep**: Lightweight, fast static analysis. Custom rules for organisation-specific patterns.
- **CodeQL (GitHub)**: Semantic code analysis. Native GitHub integration. Excellent for finding complex vulnerabilities.

### Dynamic Testing & Penetration Testing
Test running applications for vulnerabilities. Automated scanning plus periodic manual assessments.
- **OWASP ZAP**: Open-source DAST. Automated scanning in CI/CD. OWASP Top 10 coverage.
- **Burp Suite**: Industry-standard web security testing. Manual and automated testing capabilities.
- **Periodic Penetration Tests**: Third-party penetration testing for critical releases. Reports provided to stakeholders.

### Secret Detection
Prevent credential leaks before they reach production.
- **GitLeaks**: Pre-commit secret detection. Blocks API keys, passwords, tokens.
- **TruffleHog**: Deep git history scanning. Finds secrets in commit history.
- **GitHub Secret Scanning**: Native GitHub integration for detecting exposed secrets.

### Dependency Scanning & Management
Catch vulnerable dependencies and keep packages up to date.
- **Dependabot**: Automated dependency updates. Security alerts for vulnerable packages.
- **Renovate**: Automated dependency management. Configurable update policies.
- **Snyk**: Vulnerability scanning across package ecosystems.

### Container & Infrastructure Security
Scan container images and infrastructure-as-code for misconfigurations and vulnerabilities.
- **Trivy**: Container image scanning. Finds OS and application vulnerabilities.
- **Grype**: Fast vulnerability scanner for container images and filesystems.
- **Checkov**: Infrastructure-as-code scanning. Terraform, CloudFormation, Kubernetes.
- **tfsec**: Terraform-specific security scanner. Catches misconfigurations early.

### Key Principle
These tools integrate into CI/CD pipelines and run automatically on every commit and PR. They create safety checkpoints that catch issues early—without requiring manual intervention or slowing down AI-accelerated development velocity.

## Testing Strategy

### AI-Generated Tests
- AI assists with test generation from specifications
- Tests reviewed to ensure independent validation (not just re-implementing code)
- Edge cases and negative tests explicitly required
- Human verification of test quality and coverage

### Coverage & Quality Standards
- Minimum 80% code coverage for business logic
- Regular manual testing by humans for critical paths
- Regression suite run on every deployment
- Post-refactor test validation mandatory

## Knowledge Transfer & Maintainability

### Documentation Deliverables
- Architecture Decision Records (ADRs) explaining key choices
- System documentation describing component interactions
- API documentation (auto-generated and maintained)
- Runbooks for operational procedures
- AI decision log documenting where AI assisted and what was reviewed

### Handover Process
- Code walkthrough sessions (recorded for future reference)
- Pair programming with client team during transition
- Environment setup guides for developer onboarding
- Included post-handover support period

### Preventing Over-Abstraction
- Code reviewed for unnecessary complexity
- "Boring technology" preference: standard patterns over clever solutions
- Readability prioritised: code your team can understand and maintain

## AI Timeline Claims

### Where AI Accelerates Delivery
- CRUD operations and data entry screens
- API integrations with documented endpoints
- Test generation from specifications
- Documentation and code comments
- Boilerplate and scaffolding
- Code refactoring and modernisation

### Where AI Provides Limited Benefit
- Novel algorithm design
- Complex business rule implementation
- Security-critical components
- Undocumented legacy system integration
- Stakeholder alignment and discovery
- Performance optimisation

### Timeline Assumptions
Our estimates assume: clear requirements and acceptance criteria, timely stakeholder availability, documented APIs for integrations, and stable scope.

### Timeline Risks
Factors that could impact delivery: undocumented legacy system complexity, scope changes during delivery, third-party API instability, extended stakeholder review cycles.

## Ongoing Support

- **Warranty Period**: Included defect resolution post-delivery
- **Retainer Options**: Ongoing development capacity for continuous improvement
- **Emergency Support**: Priority response for critical issues with SLA-backed agreements available

## Our Official Project Management Approach: Spec-Driven Development with Augment Intent

**Augment Intent is our official tool for managing all AI-augmented development projects.** We use Intent (https://www.augmentcode.com/product/intent) as the central hub for project coordination, specification management, and multi-agent orchestration. This is not optional tooling—it's how we work.

This represents a paradigm shift from traditional development: specifications become the source of truth, AI agents work in parallel, and everything stays aligned automatically.

### What is Spec-Driven Development?

Traditional approach: Write requirements, then code separately. Documentation drifts from reality. Re-explain context to each AI session. Refactoring breaks things, then fix.

Spec-driven approach: The spec is the source of truth. Documentation auto-updates as agents work. Agents inherit context automatically. Refactoring is spec-guided.

Instead of writing code and hoping it matches the plan, we write the spec and let agents implement it. As they work, the spec updates to reflect what was actually built. The result: specs that are always accurate, agents that stay aligned, and code that matches intent.

### How We Use Intent

**Self-Maintaining Specifications**: Traditional specs rot the moment code ships. Ours don't. When an agent completes work, the spec updates to reflect reality. When requirements change, updates propagate to all active agents. This is how we maintain living documentation that never drifts from the codebase.

**Coordinator + Specialist Agents**: Intent's multi-agent model mirrors how teams actually work. The Coordinator breaks down specs into tasks. Specialist agents execute in parallel—each in their own context. The Coordinator keeps everything aligned and handles handoffs. This is how we achieve the output of larger teams with smaller, senior-heavy crews.

**Industry-Leading Context Engine**: Every agent is powered by Augment's context engine. Whether it's the coordinator planning work or specialists executing tasks, they all share deep understanding of the entire codebase—code, dependencies, documentation, style, recent changes. This eliminates the "re-explain everything" problem that plagues other AI development approaches.

**Resumable Sessions & Auto-Commit**: Workspace state persists across sessions. Close Intent, reopen it tomorrow, and everything is exactly as you left it. Auto-commit captures work as it completes. Branch management is built-in. This provides the audit trail and traceability that governance requires.

### Why This Matters for Clients

- **Living Documentation**: Specs stay accurate because they update as work completes. You always know what was built and why.
- **Faster Delivery**: Parallel agents working from a shared spec means more gets done simultaneously without conflicts or rework.
- **Full Traceability**: Every piece of code traces back to a spec. Every decision is documented. Audit trails are automatic.
- **Governance-Ready**: The spec-driven approach creates natural checkpoints for human review, approval workflows, and compliance documentation.

### Model Flexibility

Not every task needs the same AI model. Intent supports all major state-of-the-art models, letting us match capability to complexity:
- Claude Opus 4.5 for complex architecture and planning
- Claude Sonnet 4.5 for rapid iteration and implementation
- GPT 5.2 for deep code analysis and review
- Haiku for fast, lightweight tasks

### Specialist Agents

Intent provides purpose-built agents for different phases of development:
- **Investigate**: Explore codebase, assess feasibility, understand existing patterns
- **Implement**: Execute implementation plans with full context awareness
- **Verify**: Check implementations match specs, run tests, validate behaviour
- **Critique**: Review feasibility, identify risks, suggest improvements
- **Debug**: Diagnose issues, trace problems, propose fixes
- **Code Review**: Automated reviews with severity ratings and actionable feedback

### Additional Capabilities

- **In-App Browser**: Built-in Chrome for local development preview without leaving the workspace
- **Context Expansion**: Manually add local files, markdown notes, or any content to agent context
- **Workspace Layout**: Custom tiling layouts that persist across sessions
- **MCP Support**: Full Model Context Protocol support for external tools and data sources
- **Git Integration**: Stage, commit, branch management, and auto-commit on task completion

## Technology Choices

Our technology stack is deliberately chosen to maximise AI-assisted development effectiveness.

### Why Python for AI-Assisted Development

Python is structurally better suited for LLM-assisted development than alternatives:

- **Natural Language Proximity**: Python's syntax closely resembles natural language with keywords like `in`, `is`, `not`, `and`, `or`. When an LLM sees `if x in collection:` versus C#'s `if (collection.Contains(x))`, the Python version maps more directly to how the problem would be described in English.
- **Reduced Syntactic Noise**: Python's lack of mandatory type declarations, braces, and semicolons means less syntactic noise for an LLM to generate correctly. C# requires precise placement of curly braces, semicolons, access modifiers, and type annotations—more opportunities for subtle errors.
- **Smaller Context Window Footprint**: Python code is typically 30-50% more concise than equivalent C# code. This means an LLM can fit more of the codebase into its context window—critical for understanding relationships between files.
- **Training Data Dominance**: LLMs have seen orders of magnitude more Python code across more domains than any other language. This statistical advantage means the LLM has encountered similar patterns before.
- **One Obvious Way**: Python's philosophy of "there should be one—and preferably only one—obvious way to do it" means LLMs encounter more consistent patterns across codebases.

### Language Comparison: Python vs Ruby vs C#

| Factor | Python | Ruby | C# |
|--------|--------|------|-----|
| LLM Training Data Volume | Excellent | Good | Moderate |
| Syntax Simplicity | Excellent | Good | Verbose |
| Pattern Consistency | High | Variable | Variable |
| Context Window Efficiency | Excellent | Good | Poor |
| Type Safety | Optional (mypy) | None | Strong |

**Our Assessment**: Python wins overall for AI-assisted development. Ruby is a close second. C#'s type system provides guardrails but the cognitive overhead is significant for LLMs.

### Django: Batteries Included, Decisions Made

We favour "batteries included" frameworks where sensible defaults eliminate decision fatigue:

- ORM with migrations built-in
- Authentication system ready to use
- Admin interface auto-generated
- Form handling and validation included
- Security middleware by default
- Templating engine built-in

**Why This Helps LLMs**: Consistent project structure across codebases, standard patterns LLMs have seen thousands of times, less custom code means fewer surprises, mature ecosystem with proven solutions.

Every decision you don't have to make is a decision you can't get wrong. Django makes hundreds of small decisions for you—database abstraction, session handling, CSRF protection, password hashing—and makes them well.

### The Pragmatic Monolith

Microservices have their place. For most applications, that place is "later, if ever." We build monoliths first—not because we don't understand distributed systems, but because we do.

**Why Monoliths Win for AI-Accelerated Development**:
- **Single Codebase, Full Context**: An LLM can understand your entire application. With microservices, context is fragmented across repositories.
- **Simpler Debugging**: When something breaks, there's one place to look. No distributed tracing, no "which service owns this?" conversations.
- **Faster Iteration**: Change your data model and update every affected view in one commit. No API versioning, no backwards compatibility gymnastics.
- **Lower Operational Burden**: One deployment pipeline. One monitoring dashboard. One database to backup. One thing to scale.
- **Team Efficiency**: Small teams thrive with monoliths. You don't need a platform team, an infrastructure team, and service owners.
- **Refactoring Freedom**: Move code between modules without worrying about API contracts, service boundaries, or breaking other teams.

**When Microservices Make Sense**: Genuinely independent scaling requirements, multiple large teams needing independent deployment, regulatory requirements for isolation (payment processing, healthcare data), or integrating systems in different languages that can't share a runtime.

**Modular Monolith = Future Options**: Build with clear module boundaries inside your monolith. If you genuinely need to extract a service later, you can. But you probably won't need to.

### Infrastructure: Terraform on Google Cloud

Our default infrastructure stack is Terraform deploying to Google Cloud Platform.

**Why Terraform**:
- Infrastructure as Code: Version controlled, reviewable, repeatable
- LLM-Friendly: Declarative HCL syntax that AI understands well
- Cloud Agnostic: Same patterns work across GCP, AWS, Azure
- State Management: Track what exists, plan changes safely
- Mature Ecosystem: Modules for common patterns readily available

**Why Google Cloud**:
- Cloud Run: Container deployment without Kubernetes complexity
- Cloud SQL: Managed PostgreSQL with automatic backups
- Simpler IAM: More intuitive than AWS's permission model
- Competitive Pricing: Often cheaper than AWS for similar workloads
- Excellent AI/ML: Vertex AI, BigQuery ML for future expansion

**The Complete Stack**: Python 3.11+ → Django/FastAPI → Terraform + GCP → PostgreSQL. Boring technology, chosen deliberately. Every component is well-understood, well-documented, and well-supported by LLMs.

## Docs

- [AI Development Overview](https://makemoredigital.com/ai-development): Our AI-augmented delivery approach and business outcomes
- [Spec-Driven Development](https://makemoredigital.com/ai-development/spec-driven-development): Our official project management approach using Augment Intent
- [Delivery Methodology](https://makemoredigital.com/ai-development/methodology): Process framework, specification standards, human review checkpoints, quality assurance
- [Governance & Risk Control](https://makemoredigital.com/ai-development/governance): Data handling, access controls, logging, traceability, regulatory compliance
- [Due Diligence Guide](https://makemoredigital.com/ai-development/due-diligence): IP ownership, vendor control, security, knowledge transfer for enterprise procurement
- [Technology Choices](https://makemoredigital.com/ai-development/technology-choices): Why Python, Django, and pragmatic monoliths maximise AI development effectiveness
- [Services](https://makemoredigital.com/services): Service offerings and engagement models
- [Our Work](https://makemoredigital.com/work): Portfolio and case studies
- [Team](https://makemoredigital.com/team): Meet the people behind Make More Digital
- [Contact](https://makemoredigital.com/contact): Get in touch to discuss your project

## Contact

- **Website**: https://makemoredigital.com
- **Email**: hello@makemoredigital.com