The principles behind every engagement.

The channel stays open. Email me a question at any point in the engagement and I answer it, and nothing is metered, because it is inside the fixed price. A question about a finding on a Tuesday gets an answer on Tuesday, not a line on an invoice.

What I don't do is take on work outside the scope we agreed, and I say so when something is.

Fixed prices. Every stage after the First Look is a fixed price quoted before it starts, and no hour is ever billed as it is spent. You decide whether to ask a question without watching a meter.

The plan is priced after the First Look and remediation at acceptance, each before it starts.

No access needed. I never hold credentials or access to your systems. A practice that gets systems through security sign-off should not be a new access path into one.

I work from your review, your architecture, and working sessions where your engineer's hands are on the keyboard.

Your hands, my plan. In every plan, I decide what to fix and how to approach each fix, while your engineers design and implement the fixes in your system. In an Engineering Session, your engineers' hands are on the keyboard, and I steer the architecture, the design, and the fix itself until they're unblocked.

The work stays with the people who own the system, and I never become your contractor or the bottleneck in your delivery.

The plan stands on its own. The plan is written to be run without me, and its guarantees do not weaken if you run it alone or with someone else. A client who takes the plan and never books another session still holds Accepted and Done Right.

I earn nothing from what happens next, which is what makes the plan worth trusting.

Name every gap. Nothing is left off the list, and every finding and gap gets a decision. A questionnaire with sixty questions yields sixty entries, including the ones you would rather skip.

The register is complete before the plan is priced, and a finding that surfaces later moves the date or becomes its own entry.

Critical path. The plan takes the least work on the shortest path to sign-off, and nothing that can run in parallel waits. Two fixes that share one architecture change ship as one change.

The plan marks what blocks the release and orders it, and the weekly Checkpoint re-orders the remaining work as things move.

Posture alignment. Your approver's posture is the standard they hold and the precedents their organization has set. When I write a Security Sign-off Plan, the case is written to that posture, in the approver's own language. For example, if your approver has accepted a compensating control twice before, the case for the third acceptance is written the same way: their name for the control, and the evidence they asked for the last two times.

The Discovery Package names the standard and the approver, the plan draft cites the precedents, and the Register Refresh realigns the register to any change in the posture.

Shift left. Where a fix can live in how your team builds, it goes there, so the next review is smaller. A manual check before each release becomes a gate in the pipeline.

Every plan marks the fixes that belong in code or in the pipeline, and the Shift-Left Plan is the service that does only that.