I was listening to an episode of the Super Data Podcast where Jon Krohn interviewed John Roese, Global CTO and Chief AI Officer at Dell, and one moment stuck with me. They were discussing why so many AI projects fail to move the needle inside organizations, and Roese put it succinctly: in many cases, AI is being used to automate work that was essentially BS to begin with.

That observation mirrors what we see in practice. You can apply AI to almost anything, but if the underlying work or data doesn’t materially matter to the business, making it faster or cheaper won’t suddenly create value.

This article walks through a practical way to identify high-impact opportunities for AI, and how to avoid wasted effort, hidden risks, and unnecessary complexity.

Don’t Automate BS Work

The idea is simple but powerful: before you automate a process, it’s worth asking whether that process should exist at all.

AI can make bad processes run faster. But that often just means you’re producing low-value outcomes more efficiently.

Before reaching for AI, ask:

• If this task disappeared tomorrow, would anyone outside the company notice?
• Does improving this actually change customer outcomes, revenue, or risk?
• Are we optimizing for internal optics rather than real impact?

This kind of upfront discipline is unglamorous, but it’s one of the strongest predictors of whether an AI initiative will matter. The best AI projects we’ve seen don’t start by picking a model or framework. They start by ruthlessly questioning whether the work itself is worth doing.

Start with Friction, Not Technology

A common mistake is starting with a solution:

“We should use AI to do something with customer support.”

Instead, start with friction:

• Where do teams spend time on repetitive or manual work?
• Where do errors regularly creep in?
• Which processes depend heavily on human judgment, but follow recognizable patterns?

Good AI candidates often live in spreadsheets, inboxes, internal tools, and Slack threads.

Examples:

• Support agents rewriting similar responses all day
• Operations teams manually reviewing documents or images
• Engineers babysitting flaky alerts or noisy dashboards
• Sales teams repeatedly updating CRM records, summarizing calls, or chasing down context spread across emails and notes
• Customer success teams manually triaging tickets, identifying churn risk from scattered signals, or preparing account summaries before check-ins
• Marketing teams repurposing the same content across channels with slight variations
• Finance or ops teams reconciling data between systems that were never designed to talk to each other

If a task is already painful, slow, or expensive, that’s a signal worth investigating.

Look for Decisions, Not Just Automation

AI isn’t only about replacing tasks. Some of the best use cases support better decisions.

Ask questions like:

• Where are we making decisions with incomplete or delayed information?
• Where do teams rely on gut feeling because data is hard to interpret?
• Where does context live across too many systems?

AI systems can summarize, classify, surface patterns, and flag outliers. This can often be done without being fully autonomous. These “decision support” use cases tend to be lower risk and easier to validate.

Evaluate Cost, Risk, and Reliability Early

Not every problem should be solved with AI. That’s okay.

Before committing, it’s worth testing potential use cases:

• Cost: Does the value outweigh model and infrastructure costs at scale?
• Latency: Does this need to be real-time, or can it be asynchronous?
• Risk: What happens when the system is wrong?
• Compliance: Are there privacy, security, or copyright concerns?
• Maintenance: Do you have enough team members or an agency to keep the system running and up to date?

Auditing prompts, pipelines, and model behavior early can surface these issues before they become production incidents.

Prefer Small, Measurable Wins

The most sustainable AI efforts tend to start small:

• A faster internal workflow
• A clearer signal in noisy data
• A cheaper or more reliable existing system

These projects are easier to test, easier to roll back, and easier to learn from. They also create momentum and trust, both critical for more ambitious AI work later.

Final Thoughts

AI doesn’t need to be complicated to be valuable. The hardest part is often choosing the right problem to solve.

Start with real friction, the kind people complain about in meetings or work around with makeshift solutions. Question whether the underlying work matters.

Focus on measurable improvements. And don’t be afraid to walk away from an AI project if a simpler solution makes more sense.

By starting with real friction, auditing what you already have, and focusing on measurable improvements, teams can use AI in ways that are practical, responsible, and effective.

If you’re unsure where AI fits into your systems, our team at OmbuLabs.ai can help. Let’s talk. 🤖

95% of U.S. adults use the internet, 91% own a smartphone, and 78% subscribe to high-speed internet at home. 41% report being online “almost constantly.” Americans now average over 5 hours a day on their phones, a 14% jump from the prior year, not including time spent working or other types of screen time. (Pew Research Center, survey conducted Feb. 5 to June 18, 2025.)

Of the adult population, more than 7 million Americans are living with uncorrectable vision loss, including over 1 million who are blind. Broader survey data shows that nearly 50 million adults report some difficulty seeing, even when wearing glasses.

In an increasingly digital world, digital accessibility is ever more prevalent. As we rely more on digital platforms for education, work, social interaction, and services, ensuring that these platforms are accessible to everyone has both a strategic advantage and direct implications when managing projects.

As a Project Manager (PM), there are specific considerations to keep in mind when working on projects with Web Content Accessibility Guidelines (WCAG).

What are Digital Accessibility Requirements?

The industry standard guidelines for web content accessibility are organized around four principles, known as POUR:

• Perceivable: Users must be able to see or hear the content (e.g., alt text for images, captions for video)
• Operable: The interface must be navigable by everyone (e.g., keyboard accessibility, enough time to read content)
• Understandable: Content and navigation must be predictable and clear (e.g., consistent layout, readable language)
• Robust: Content must work reliably with a wide range of assistive technologies (e.g., valid HTML, proper ARIA)

The Web Content Accessibility Guidelines (WCAG) are the standard for inclusive design to make websites and digital content more accessible for people with disabilities.

The WCAG guidelines are widely recognized as the international standard for web accessibility, and many laws and regulations reference the WCAG as the benchmark for complying with the law.

The WCAG 2.2 guidelines require websites to include the following:

• Color contrast of at least 4.5:1 for normal text, 3:1 for large text (Level AA)
• Descriptive alt text for all meaningful graphics and images (empty alt for decorative)
• Closed captions and transcripts for video and audio content
• Form labels associated with all input fields
• Visible focus indicators for keyboard navigation
• Full keyboard accessibility with no “keyboard traps”
• Descriptive tags and labels for all navigation links and buttons

There are three levels of WCAG:

WCAG: Level A

This is the basic level of accessibility. It includes guidelines that address the most fundamental barriers for users with disabilities. Meeting Level A ensures that some basic accessibility needs are addressed.

For example: Providing alternative text for images so that screen readers can read aloud what the image is about. This helps people with visual impairments understand the content of the images.

WCAG: Level AA

This is an intermediate level of accessibility, more comprehensive than Level A. Meeting Level AA means going a step further to accommodate a broader range of disabilities. It includes all Level A requirements and additional criteria.

For example: Providing audio descriptions for videos to make them accessible to people who are blind or low vision. This ensures that everyone can understand the content of the videos, not just those who can visually perceive the video.

WCAG: Level AAA

This is the highest level of accessibility. Meeting Level AAA indicates a very high standard of inclusivity and provides the best possible experience for users with disabilities. It includes all Level A and Level AA requirements, as well as more demanding criteria.

For example: Providing text transcripts, sign language interpretation, and extended audio descriptions (which pause the video to add narration when dialogue gaps are too short) for streaming media. This helps people with different disabilities like low vision, blindness, deafness, and hard of hearing perceive content.

What are the implications for my project?

Be aware of standards and guidelines from the client and legal entities from project start

• WCAG Compliance: Ensure the project complies with the Web Content Accessibility Guidelines (WCAG)
• Plan in additional time for first rounds of reviews if team requires education in WCAG requirements
• Be aware of and ensure compliance with local accessibility regulations, such as the Americans with Disabilities Act (ADA) or the European Accessibility Act

Documenting and Reporting:

• Maintain thorough documentation of accessibility features throughout the project lifecycle including review times
• Clearly document any identified barriers and the measures taken

Training and Awareness

• Provide accessibility training for your team to ensure everyone understands best practices and their importance
• Promote a culture of accessibility throughout the organization, encouraging ongoing discussion and improvement

Acceptance Criteria

• Planning documentation must include experiences of real users who use screen readers or other assistive technology (AT)
• Acceptance Criteria must identify risks and needs
• Accessibility acceptance criteria should describe the ideal experience of the user. The criteria should not include a list of steps for addressing the barrier.
• Specificity is key! Acceptance criteria should be specific to the product or feature. If there is not a clear vision, you can depend on frameworks such as WCAG

Ensure inclusive design principles are used

• User-Centered Design: Incorporate feedback from users with disabilities into the design process to ensure the product meets diverse needs
• Universal Design: Aim for solutions that can be used by all people, regardless of their abilities.

Testing and Validation

• Implement regular accessibility audits using both automated tools and manual testing with assistive technologies. Automated tools typically catch only 30-40% of WCAG issues; manual testing with real screen readers and keyboard-only navigation is essential for true compliance.
• Involve users with disabilities in testing to gain valuable insights into practical accessibility challenges

Facilitate Accessible Content Creation

• Ensure all multimedia content (videos, images, infographics) includes text alternatives, such as captions and alt text
• Structure content with clear headings and logical navigation to aid screen reader use
• Use semantic HTML and ARIA (Accessible Rich Internet Applications) landmarks to enhance the usability of web interfaces for assistive technologies
• Ensure keyboard accessibility so that all functionalities can be navigated without a mouse

How to Check Your Website’s Accessibility

Free Browser Extensions (quick audits)

• axe DevTools by Deque: industry-standard automated scanner
• WAVE by WebAIM: visual overlay that highlights issues directly on the page
• Lighthouse: built into Chrome DevTools under the “Accessibility” section
• Accessibility Insights by Microsoft: free, open source, includes guided assessments for WCAG 2.1 AA

For CI/CD Pipelines (automated testing in your build)

• Pa11y: command-line accessibility testing that integrates with CI
• axe-core: the engine behind axe DevTools, usable in Jest, Cypress, and Playwright

Claude Code Skills for Accessibility (open source)

If your team uses Claude Code, several community-built skills can automate accessibility reviews as part of the development workflow:

• skill-a11y-audit: drop-in WCAG 2.1 AA scanner with remediation hints
• accessibility-agents: eleven specialized agents that enforce WCAG 2.2 AA compliance so AI-generated code isn’t inaccessible by default

These skills catch issues early, before code review, and are especially valuable when AI tooling is generating markup that might otherwise skip accessibility best practices.

Frequently Asked Questions

What does WCAG stand for?

WCAG stands for Web Content Accessibility Guidelines. It’s the international standard for making digital content accessible to people with disabilities, published by the W3C.

What’s the difference between WCAG Level A, AA, and AAA?

• Level A: Basic accessibility — the minimum required to remove major barriers
• Level AA: The standard most laws require (including ADA, EAA, and Section 508). This is the typical compliance target for commercial websites.
• Level AAA: The highest level. Often impractical to achieve across an entire site, but important for specialized content.

Should I target WCAG 2.1 or 2.2?

WCAG 2.2 is the current standard (published October 2023) and is backwards-compatible with 2.1. It adds nine new success criteria. Targeting WCAG 2.2 AA is the safest choice for new projects.

How much of accessibility testing can be automated?

Automated tools catch only 30-40% of WCAG issues. Manual testing with screen readers and keyboard-only navigation is essential for true compliance.

What are the core principles of WCAG?

WCAG is organized around four principles known as POUR: Perceivable, Operable, Understandable, and Robust. Every success criterion maps to one of these principles.

Why does Digital Accessibility matter?

When websites are more accessible, it removes the barriers users face when navigating content. Content that adheres to WCAG principles and acceptance criteria results in well structured and streamlined websites that more people are able to use.

This means that there will be an improved user experience, more traffic, less churn and a lower bounce rate. The Web Content Accessibility Guidelines are the basis for nearly all digital accessibility regulations worldwide.

Organizations that fail to comply with digital accessibility laws expose themselves to significant liabilities, including fines and civil lawsuits.

While it may seem intimidating at first, planning for projects with digital accessibility requirements is important as it ensures inclusion for more people, optimizes website functionality, and ensures compliance with federal and international regulations.

Sources

Pew Research on Internet Use, Smartphone Ownership, and Digital Divides in the U.S.

Bureau of Internet Accessibility

Userway WCAG Compliance

WCAG 101

CDC Vision and Eye Health Surveillance System (VEHSS)

American Foundation for the Blind - Adults with Vision Loss from the NHIS

That mindset is what led us to build an internal AI system to automate one of the most important (and time-consuming) parts of our fixed-cost monthly maintenance service (Bonsai): Our quarterly progress reports.

This article walks through how we mapped a very human, manual process to a structured AI-driven workflow and what we learned along the way.

What Is Bonsai?

Bonsai is our signature fixed-cost, monthly maintenance service for Ruby and Rails applications

The idea is simple:

• Gradually pay down technical debt
• Keep applications secure, stable, and maintainable
• Move at a pace that makes sense for each customer

Every quarter, we deliver a detailed report that helps clients understand the technical health of their application and where we are heading next.

Each report has three core sections:

1. Next Priorities: What we recommend working on next, based on impact and risk.
2. Accomplishments: A summary of what was completed during the quarter.
3. Additional Findings: Important observations related to security, complexity, and dependencies.

These reports are valuable but producing them is also unbillable work, which is what sparked this project.

The Original (Very Human) Workflow

Before AI entered the picture, the process looked roughly like this:

1. Gather Data

We collected data from three main sources:

• Jira tickets
• GitHub pull requests
• Static analysis tools (RubyCritic, Brakeman, Bundler Audit, etc.)

2. Analyze, Synthesize, Summarize

This is the most time-consuming part. We extract information from the raw data to build each section of the report by:

• Cross-reference Jira tickets with merged PRs
• Extract meaningful accomplishments
• Review static analysis results and group findings
• Infer next priorities based on gaps, risks, and client goals

3. Write the Report

Writing the report is straightforward once you complete the previous steps. It involves writing all of the raw content into a polished, client-ready document. This content must then be structured and validated to match previous Bonsai reports, ensuring consistent style and progress.

Finally, the entire report must be thoroughly reviewed to double-check for accuracy and completeness before finalization.

This worked but it didn’t scale. And it relied heavily on senior engineers’ time.

Mapping the Process to an AI-Powered Workflow

Instead of jumping straight to a “do everything” agent, we broke the workflow into explicit, specialized components that mirror the real-world process.

Think less autonomous robot, more well-run assembly line with three key stages:

1. Data Providers
2. Curators
3. Reviewers

Data Providers

The data provider layer serves as the initial stage, tasked with gathering and standardizing raw input. This involves collecting data, specifically Jira issues, and linking them to their respective GitHub pull requests.

Furthermore, this layer offers access to the outputs of various static analysis tools, such as RubyCritic, Brakeman, and Bundler Audit.

At this stage, no summarization or interpretation happens. The goal is boring, reliable data access. Exactly what we want.

Curators

Curators take raw data and turn it into structured, usable inputs for report sections.

Accomplishments

Accepts the combined data from Jira and GitHub. Then, with help from an LLM we extract key facts and enrich each completed task with three to seven bullet points.

The prompt for these bullet points looks like this:

For each task, create 3-7 bullet points that capture:
  - **Primary deliverable**: What was completed (reference PR URLs for traceability)
  - **Technical highlights**: Key implementation details from commit summaries
  - **Problem-solving**: Issues resolved or decisions made
  - **Business value**: Why this work matters (when evident from the data)

Additional Findings

With help from an LLM, we group static analysis results into three categories: Security, Complexity, and Dependencies.

Next Priorities

With an LLM, we infer logical action items based on gaps identified in Accomplishments and Additional Findings.

At this point, we have content, but not something we would present to a customer.

That’s where reviewers come in.

Reviewers: The Quality Gate

Reviewers are a key part of this system.

For Accomplishments & Additional Findings

Each subsection is reviewed by an LLM tasked with:

1. Accuracy Check: Does the content reflect the underlying data correctly?
2. Completeness Check: Does it tell a complete, coherent story?
3. Quality Assessment: How does it compare to real Bonsai reports in tone, clarity, and structure? We provide examples from previous high-quality reports to guide this step.
4. Decision: The options are to approve the draft, revise it with an improved version, or request more information.

This is an example from the prompt we used:

1. Accuracy check: Does the subsection content accurately reflect all key information from the bullet points
and task summary and description
2. Completeness check: Does the content paragraph tell a complete story?
3. Quality assessment: Compare the title and the content paragraph with the provided examples from previous
report for content completeness, tone, and style
4. Decision: Decide to either approve, provide an improved draft or request additional information

The reviewer returns a structured JSON response that includes the following fields:

• Accuracy: pass/fail based on accuracy check
• Completeness: pass/fail based on completeness assessment
• Quality: excellent/good/neutral/poor/bad based on quality assessment
• Decision: approve/request_info/revise based on final decision made
• Revised list: [“…”] if the decision is to revise, your revised list.
• Reasoning: 2-3 sentences explaining your decision

The JSON structure looks like this when a revision is needed:

{
  "accuracy": "pass",
  "completeness": "pass",
  "quality": "good",
  "decision": "revise",
  "revised_subsection": {
    "title": "...",
    "body": "..."
  },
  "reasoning": "..."
}

For Next Priorities

The review prompt returns the same JSON structure but the prompt is slightly different for the next priorities section of the report. It focuses on:

• Logical correctness
• High-value coverage (one item per theme)
• Professional writing quality

This is an example from the prompt we used:

1. Accuracy check: Does the list of next priorities accurately reflect the logical next steps for the project
as they can be inferred from the data provided?
2. Completeness check: Does the list contain all high-value items that can be inferred from the data,
keeping it to ONE single item per theme?
3. Quality assessment: Does the writing meet professional standards?
4. Decision: Decide to either approve, provide an improved draft or request additional information.

The output is still structured and machine-readable, making it easy to act on programmatically.

From JSON to Report

Once all sections pass review, the resulting JSON objects are assembled into a complete quarterly report.

At that point, an engineer who worked on the project does a final human review, not from scratch, but from a strong, high-quality draft.

The result: faster reports, consistent quality, and far less cognitive overhead.

Why This Project Matters

Quarterly reports are essential to the Bonsai service, but they’re also unbillable overhead.

By automating the most time-consuming parts of the process:

• We reduce internal cost
• We keep Bonsai pricing competitive
• We maintain (and often improve) report quality

Most importantly, this is not about replacing engineers. It’s about letting LLMs do what they’re good at:

• Synthesizing large amounts of data
• Producing consistent first drafts
• Acting as tireless reviewers

That frees our software engineering team to focus on judgment, context, and real problem-solving work.

What We Learned

Here are a few lessons learned from this internal project.

1. Agents vs. Workflows Matter

Not every problem needs a ReAct-style agent.

In many cases, a well-defined workflow of specialized components is:

• Easier to reason about
• Easier to debug
• Easier to improve incrementally

2. Start from the Real World

Mapping an existing human process to AI works far better than inventing a “clever” AI-first design.

If humans already do it well, you can usually teach a machine to help.

3. Reviewers Are Non-Negotiable

Generation is cheap. Quality is not.

Explicit review steps, especially when guided by real examples, are what make the output trustworthy enough for client-facing work.

This project is one of our favorite examples of using AI to augment engineering rather than replacing them. As most good internal tools do, it started with a simple question:

“Why are we still doing this the hard way?”

Turns out, we didn’t have to.

If you’re maintaining a Ruby application and want to reduce overhead without sacrificing quality, get in touch to learn more about Bonsai and how we apply AI where it actually makes sense.

If you’re interested in a similar, custom AI solution to some of your most time-consuming tasks, get in touch with us and we would be happy to help.

OmbuLabs.ai is a Philadelphia-based software boutique building custom AI solutions. Your data holds untapped potential. We can turn it into a competitive advantage 🚀

What if those moments could be captured visually in a way that felt personal, branded, and inspiring?

That is exactly what we set out to do with a custom GenAI-powered card builder created for the Entrepreneurs Organization of Philadelphia.

A Custom AI Experience for EO Philadelphia

This project started as a small but meaningful side project for the Entrepreneurs Organization (EO) Philadelphia community.

Our founder, Ernesto Tagwerker, has been a part of this community since ‘23.

The goal was simple:

• Celebrate entrepreneurs as 2025 came to a close

• Highlight real moments from their lives and businesses

• Reinforce community, growth, and optimism heading into 2026

Using GenAI, we transform real photos into branded, New Year-themed cards tailored specifically for EO Philadelphia members.

The result is a polished, fun experience that feels personal, authentic, and aligned with the EO brand.

Built Fast, Designed for Impact

Like many of the GenAI tools we build for clients in Philadelphia and beyond, this card builder followed a focused, efficient workflow.

Stack

The EO Philadelphia card builder was created using a modern, production-ready AI stack:

• Python and FastAPI for the backend service that handles the AI interactions.

• React with MaterialUI for the frontend interface.

• LlamaIndex for the orchestration of the LLM and image generation models.

• OpenAI’s gpt-4o-mini for message validation and Google’s gemini-3-pro-image-preview for the image generation.

Because we’ve built similar GenAI-powered tools before, we were able to launch this microsite in just a few days without sacrificing quality, branding, or reliability.

How the AI Workflow Works

Behind the scenes, the GenAI-powered card builder follows a simple but powerful flow.

The process begins with user-provided context: a New Year message and a real photo from the year that serves as the foundation for the card.

The Artificial Intelligence solution is then guided with EO Philadelphia’s branding and New Year themes, ensuring the output aligns with the organization’s identity. Images are transformed into a cohesive, polished visual style while messages are validated and seamlessly integrated into the generated design.

The result is a shareable, high-quality card that feels personal while reinforcing the EO Philadelphia identity. This kind of workflow is adaptable across industries, from internal team celebrations to marketing campaigns and community engagement tools.

The template we designed also included a short message to encourage our entrepreneur friends to reach out and find out more about EO Philadelphia.

Why Playful, Brand-Focused AI Matters

Not every AI project needs to be a massive internal system or complex automation pipeline. Some of the most effective AI tools are brand-forward, emotionally resonant, and designed for sharing and connection.

Experiences like this EO Philadelphia card builder can strengthen community engagement, elevate brand perception, create memorable marketing moments, and showcase innovation without overwhelming users.

At OmbuLabs.ai, we build GenAI products, helping startups and established organizations alike explore practical AI use cases, build custom AI-powered applications, and move from idea to launch quickly.

This project is just one example of how thoughtful, creative AI can support storytelling, marketing, and community while staying authentic to a brand.

Looking Ahead

As we start ‘26, we are excited to keep helping companies experiment, build, and innovate with AI.

Please feel free to give the EO Card Generator a try.

If you’re interested in reading more about our solution, you can find the open source repository on GitHub: EO Philadelphia Card Generator Source Code

Our founder created some fun images based on moments in his life over the last year like visiting Disneyland with his kids, a date night with his wife, and even his cat.

Have an idea for a branded GenAI experience?

Curious how generative AI could support your marketing, community, or internal tools?

👉 Reach out to OmbuLabs.ai. We would love to explore what we can build together.

Here is to a wonderful 2026 with new challenges for entrepreneurs in Philadelphia! 🚀

We’re immortalizing those heroic coding moments with our new Rails Superhero Card Generator! This AI-powered tool creates personalized superhero cards featuring your photo and a catchy superhero name that reflects your coding prowess.

Navigate to the Rails Superhero Card Generator, tell it your superhero skills, upload a picture and generate your custom hero card!

How it Works

The Rails Superhero Card Generator combines the power of large language models (LLMs) and image generation models to create custom cards from a provided picture.

It is a very small application with a pretty simple flow:

Stack

The Rails Superhero Card Generator is built using:

• Python and FastAPI for the backend service that handles the AI interactions.
• React with MaterialUI for the frontend interface.
• LlamaIndex for the orchestration of the LLM and image generation models.
• OpenAI’s gpt-4o-mini for generating superhero names and gpt-image-1 for the image generation.

You can see the code in the rails-superhero-cards repository on GitHub.

AI Workflow

The generator works with a pretty straightforward workflow:

The first step is judging whether the query coming from the user is fit for purpose or contains content we don’t want to process. This is a simple classification task that we delegate to the LLM and provides a simple gateway to filter out inappropriate content.

Then we generate a superhero name based on the user’s input using a simple call to the LLM.

Next, we generate the superhero card image using the image generation model, providing it with the user’s picture and the user’s query as context.

Finally, the card image is created from the generated image and the superhero name, and returned to the user.

The workflow is implemented in the backend/workflow.py file, and is orchestrated using LlamaIndex.

Try it Out!

Not convinced yet? Here are the heroes behind our awesome team:

Check out the Rails Superhero Card Generator, upload your picture, and create your own superhero card today!

Have an idea to improve the generator? Found a bug? Feel free to open an issue or a pull request on the GitHub repository.

Have an idea for another awesome AI-tool? Something else entirely? Reach out to us!

The benefits of AI are clear: increased productivity, automated workflows, enhanced decision-making, to cite a few. But these advantages must be balanced against the risks of data exposure, compliance violations, and security breaches.

In this post, we’ll explore a graduated approach to AI adoption, starting with basic security practices and progressing to fully self-hosted solutions. Each level offers increasing control over your data while requiring more investment and technical expertise.

You can choose which level best fits your organization’s needs, risk tolerance, and resources.

The Importance of Responsible AI Usage

Before diving into specific approaches, it’s essential to understand why AI privacy matters. When team members use AI tools like ChatGPT, Claude, or Copilot, they may inadvertently share:

• Proprietary code or algorithms
• Customer data and personally identifiable information (PII)
• Strategic business plans and financial information
• Trade secrets and competitive intelligence
• Internal communications and confidential documents

Once this information is sent to an external AI service, you may lose control over how it’s used, stored, or potentially incorporated into model training. Even if a provider claims not to use your data for training, data breaches, subpoenas, or changes in terms of service can expose your organization to unnecessary risk.

The key is to implement a strategy that matches your organization’s risk tolerance, technical capabilities, and budget while still enabling your team to benefit from AI capabilities.

Level 1: Policy-Based Approach with Approved Providers

Best for: Small to medium organizations with limited technical resources, lower risk tolerance for sensitive data exposure.

Investment required: Low (primarily time for policy development and training)

The foundation of any AI privacy strategy starts with clear policies and education. This approach doesn’t require technical implementation but establishes guardrails for AI usage.

Key Components:

1. Review and Approve AI Providers

Not all AI providers handle data the same way. Start by researching the privacy policies of major providers:

• OpenAI (ChatGPT): Offers enterprise plans with data processing agreements (DPAs) and commitments not to use customer data for training. Free and Plus tiers may use conversations for training unless opted out.
• Anthropic (Claude): Provides enterprise options with strong privacy commitments. Does not train on customer conversations in their API or enterprise products.
• Google (Gemini): Offers enterprise versions with data residency options and DPAs. Consumer versions may use data for model improvement.
• Microsoft (Copilot): Enterprise versions include data protection commitments and compliance certifications. Consumer versions have different terms.

Create an approved list of providers and specific product tiers that meet your organization’s requirements. Document which features are approved and which are not.

2. Develop Clear Usage Guidelines

Create comprehensive guidelines that specify:

• What types of information can and cannot be shared with AI tools
• Which AI tools are approved for different use cases
• How to anonymize or redact sensitive information before using AI
• Consequences for policy violations

Example guidelines might include:

• Use AI to draft general marketing copy or emails
• Ask AI for coding help with generic algorithms
• Never paste customer data, even for analysis
• Never share proprietary code or business logic
• Never input confidential strategic plans or financial data

3. Implement Training Programs

Regular training ensures employees understand:

• Why AI privacy matters
• How to identify sensitive information
• Techniques for using AI effectively without compromising security
• Real-world examples of data exposure incidents

4. Monitor and Audit

Establish processes to:

• Regularly review AI usage across the organization
• Update policies as new tools and risks emerge
• Conduct periodic audits of employee AI usage
• Gather feedback on policy effectiveness

Limitations:

This approach relies heavily on employee compliance and doesn’t provide technical enforcement. It’s vulnerable to human error and may not satisfy strict regulatory requirements.

Level 2: Managed AI Platforms with Privacy Controls

Best for: Organizations ready to invest in tools, needing better control and audit capabilities.

Investment required: Medium (subscription costs, integration time)

The next step is to adopt platforms that provide centralized access to AI capabilities while offering enhanced privacy controls and administrative oversight.

Options:

1. Enterprise AI Platforms

Services like OpenAI’s Enterprise plan, Anthropic’s Claude for Enterprise, or Google’s Vertex AI provide:

• Data Processing Agreements (DPAs): Legal commitments about how your data is handled
• No training on your data: Guarantees that your inputs won’t be used to train models
• Access controls: Admin panels to manage who can use AI and how
• Audit logs: Track what’s being sent to AI services
• Compliance certifications: SOC 2, GDPR, HIPAA compliance where applicable

2. AI Gateway Solutions

Tools like Cloudflare AI Gateway, Portkey, or Devs.ai act as intermediaries between your team and AI providers:

• Request filtering: Block requests containing sensitive patterns (emails, API keys, etc.)
• Rate limiting: Control costs and prevent excessive usage
• Caching: Reduce costs by caching common queries
• Analytics: Understand how AI is being used across your organization
• Multi-provider support: Switch between AI providers without changing code

3. Secure AI Workspaces

Platforms like Microsoft 365 Copilot or Google Workspace with Gemini integrate AI into existing productivity tools with:

• Data residency: Keep data within specific geographic regions
• Tenant isolation: Your data stays within your organization’s environment
• Existing security controls: Leverage your current identity and access management
• Compliance alignment: Inherit compliance certifications from the platform

Implementation Steps:

1. Assess your needs: Determine which AI capabilities your team requires
2. Evaluate providers: Compare privacy features, compliance certifications, and costs
3. Negotiate contracts: Ensure DPAs and service level agreements (SLAs) meet your requirements
4. Configure controls: Set up access policies, content filters, and audit logging
5. Migrate gradually: Start with low-risk use cases and expand as confidence grows
6. Train users: Ensure employees understand how to use the new platform

Limitations:

While significantly more secure than consumer AI tools, you’re still sending data to external providers. For highly sensitive data or strict regulatory environments, this may not be sufficient.

Level 3: Custom Solutions with Secure Platforms

Best for: Organizations with technical teams, handling sensitive data, needing customization.

Investment required: Medium to High (development time, infrastructure costs)

At this level, you build custom AI applications using secure platforms and APIs, giving you more control over data flow and processing.

Approaches:

1. API-Based Custom Applications

Build internal tools that use AI provider APIs with enhanced security, like custom-built guardrails and data sanitization tools. This gives you control over what data is sent to the AI, what data is kept, and how responses are handled.

2. Private AI Environments

Use platforms that keep your data within your infrastructure:

• Azure OpenAI Service: Deploy OpenAI models in your Azure tenant with data isolation
• AWS Bedrock: Access foundation models with data staying in your AWS environment
• Google Cloud Vertex AI: Use AI models within your Google Cloud infrastructure

These services provide:

• Virtual Private Cloud (VPC) deployment: Models run in your network
• Customer-managed encryption keys: You control the encryption keys
• Private endpoints: No data traverses the public Internet
• Regional deployment: Keep data in specific geographic locations

Implementation Considerations:

• Data classification: Identify what data can be sent externally vs. must stay internal
• Sanitization pipelines: Implement robust data cleaning before AI processing
• Audit trails: Log all AI interactions for compliance and security review
• Access controls: Implement role-based access to AI features
• Cost management: Monitor API usage and implement budgets
• Fallback strategies: Plan for API outages or rate limiting

Limitations:

You’re still dependent on external AI providers, though with more control. Costs can be significant, and you need technical expertise to build and maintain custom solutions.

Level 4: Hybrid Approach with Local Models

Best for: Organizations with strong technical teams, handling very sensitive data, needing offline capabilities.

Investment required: High (infrastructure, expertise, maintenance)

This approach combines external AI services for general tasks with locally-hosted models for sensitive operations.

Architecture:

1. Task Classification

Implement a routing system that determines where to process each request.

2. Local Model Deployment

Host smaller, specialized models on your infrastructure:

• Ollama: Easy local deployment of models like Llama, Mistral, or CodeLlama
• vLLM: High-performance inference server for local models
• Text Generation Inference (TGI): Hugging Face’s inference server
• LocalAI: OpenAI-compatible API for local models

Infrastructure Requirements:

• GPU servers: For reasonable inference speed (NVIDIA A100, H100, or similar)
• Model storage: Significant disk space for model weights (10GB-100GB+ per model)
• Memory: Large RAM requirements (16GB-80GB+ depending on model size)
• Monitoring: Track model performance, latency, and resource usage
• Updates: Process for updating models as new versions are released

Limitations:

Local models are typically less capable than frontier models like GPT-4 or Claude. They require significant infrastructure investment and ongoing maintenance. You’ll need ML expertise to optimize performance and troubleshoot issues.

Level 5: Fully Self-Hosted AI Infrastructure

Best for: Large enterprises, highly regulated industries, organizations with strict data sovereignty requirements.

Investment required: Very High (infrastructure, team, ongoing costs)

The most secure option is to host everything yourself: models, infrastructure, and supporting services.

Components:

1. Complete Model Hosting

Deploy and manage all AI models on your infrastructure:

• Model selection: Choose open-source models (Llama, Mistral, Falcon, etc.)
• Inference infrastructure: Build scalable serving infrastructure
• Model registry: Manage multiple models and versions
• Load balancing: Distribute requests across multiple model instances

2. Supporting Infrastructure

Build the complete stack:

• Vector databases: Self-hosted Postgres with pgvector, Qdrant, or Milvus
• Embedding generation: Local embedding models for semantic search
• Monitoring and observability: Track performance, costs, and usage
• CI/CD pipelines: Automate model deployment and updates

3. Security and Compliance

Implement comprehensive security:

• Network isolation: Air-gapped or strictly controlled network access
• Encryption: At-rest and in-transit encryption for all data
• Access controls: Fine-grained permissions and authentication
• Audit logging: Complete audit trail of all AI interactions
• Compliance: Meet industry-specific requirements (HIPAA, SOC 2, ISO 27001)

Limitations:

This approach requires significant investment and expertise. You’re responsible for everything: model performance, uptime, security, compliance, and updates. It’s only cost-effective for large organizations with substantial AI usage or strict requirements that can’t be met any other way.

Choosing the Right Approach

The best approach for your organization depends on several factors:

Consider Level 1-2 if:

• You’re just starting with AI adoption
• You have limited technical resources
• Your data sensitivity is moderate
• You need quick implementation
• Budget is constrained

Consider Level 3-4 if:

• You handle sensitive customer data
• You have technical teams available
• You need customization and control
• Compliance requirements are stringent
• You’re willing to invest in infrastructure

Consider Level 5 if:

• You operate in highly regulated industries (healthcare, finance, defense)
• Data sovereignty is critical
• You have very large AI usage volumes
• You have the budget and expertise
• External dependencies are unacceptable

Practical Steps to Get Started

Regardless of which level you choose, follow these steps:

1. Assess your current state: Audit how AI is currently being used in your organization
2. Classify your data: Identify what data is sensitive and what isn’t
3. Define requirements: Determine your privacy, compliance, and functional needs
4. Start small: Begin with low-risk use cases and proven approaches
5. Measure and iterate: Track usage, costs, and incidents; adjust your approach
6. Plan for growth: Design your strategy to evolve as your needs change

You can always start with a simpler approach and graduate to more complex solutions as your AI usage matures.

Conclusion

Integrating AI into your organization doesn’t require choosing between innovation and security. By taking a graduated approach, starting with clear policies and approved providers, then progressing to managed platforms, custom solutions, and potentially self-hosted infrastructure, you can leverage AI’s benefits while maintaining control over your sensitive data.

The key is to match your approach to your organization’s specific needs, risk tolerance, and capabilities. Start where you are, implement strong foundations, and evolve your strategy as your AI usage matures.

Check out our AI Readiness & Transformation Assessment if you need help assessing your current state and planning your AI journey.

Remember: the goal isn’t to achieve perfect security at the cost of usability, but to find the right balance that enables your team to work effectively while protecting what matters most.

Want to explore how AI can transform your business while keeping your data secure? Talk to us today!

How ready is our development team for AI? Which AI tools will actually improve our engineering processes? How do we integrate AI into our development workflows without disrupting productivity?

At OmbuLabs.ai, we’ve been helping development teams navigate these challenges and see the common pitfalls that arise. To address these challenges, we’ve developed a structured approach through our comprehensive AI Readiness & Transformation Assessment for Development Teams.

This strategic evaluation helps engineering organizations understand their current AI maturity, identify the right opportunities for AI integration in development processes, and build a roadmap for successful AI transformation in their engineering workflows.

Why an AI Readiness Assessment Matters for Development Teams

The AI landscape is evolving rapidly, with new development tools and technologies emerging almost daily. While the potential benefits for engineering teams are enormous (increased coding productivity, improved code quality, faster debugging, enhanced developer experience), the path to successful AI adoption in development processes is far from straightforward.

Many development teams make the mistake of jumping into AI tool implementation without a clear understanding of their workflows or a defined integration strategy, leading to:

• Wasted resources on AI tools that don’t align with development workflows
• Security vulnerabilities from poorly configured AI coding assistants
• Developer resistance due to a lack of proper training and understanding of how to maximize AI tool benefits
• Inconsistent results from fragmented AI tool adoption across the team
• Compliance issues with code privacy and intellectual property concerns

Our AI Readiness & Transformation Assessment addresses these challenges by providing a structured, comprehensive evaluation of your development team’s AI potential and readiness.

What’s Included in Our Development Team AI Assessment

Our assessment is designed to give you a complete picture of where your development team stands today and where you can go with AI-powered development tools. Here’s what we evaluate:

Current Development AI Maturity Analysis

We start by understanding your engineering team’s current relationship with AI development tools and automation:

• Existing AI coding assistants and development tools currently in use
• Development infrastructure and CI/CD pipeline assessment
• Team skills and AI tool proficiency evaluations
• Current development workflows and processes that could benefit from AI
• Developer culture and readiness for AI tool adoption

Strategic Development AI Opportunity Identification

Not every AI development tool is right for every engineering team. We help you identify the most impactful opportunities:

• High-value use cases specific to your development workflows, coding standards, and team practices
• Quick wins that can demonstrate immediate productivity improvements
• Development process optimization opportunities using AI and automation
• Developer experience enhancements through AI-powered coding solutions

Development Tool and Process Recommendations

The AI development tool landscape is vast and constantly changing. We cut through the noise to recommend:

• Specific AI coding assistants and development tools that align with your team’s needs and budget
• Integration strategies for seamless adoption into existing development workflows
• Vendor evaluation criteria to help you make informed decisions about AI development tools
• Custom vs. off-the-shelf AI solutions analysis for development processes
• Development stack recommendations for optimal AI tool performance

Security and Compliance Framework for Development Teams

AI development tools introduce new security and compliance considerations. Our assessment covers:

• Code privacy and intellectual property protection strategies for AI coding assistants
• Security best practices for AI development tool implementation
• Compliance requirements specific to your industry and codebase
• Risk assessment and mitigation strategies for AI-generated code
• Governance frameworks for responsible AI use in development processes

Cost-Benefit Analysis for Development Teams

We provide a detailed financial analysis to help you make informed investment decisions:

• Total cost of ownership for recommended AI development tools and licenses
• Cost optimization strategies to maximize development productivity value
• Resource requirements for successful AI tool implementation and training

Our Development Team Assessment Process

Phase 1: Discovery and Current Development State Analysis

We begin with comprehensive stakeholder interviews and development environment audits:

• Engineering leadership interviews to understand development objectives and challenges
• Developer surveys to assess current AI tool knowledge and current behaviors
• Development infrastructure review of existing systems, CI/CD pipelines, and tooling
• Development workflow mapping of key coding, testing, and deployment processes

Phase 2: Strategic AI Roadmap Development

Based on our discovery findings, we identify and prioritize AI development opportunities and create a comprehensive roadmap for your development team’s AI transformation:

• Phased implementation plan with clear development milestones
• AI development tool and process recommendations, including specific integration and configuration requirements
• Developer training and skill development requirements
• Change management strategy for smooth AI tool adoption across the development team
• Success metrics and KPIs for measuring development productivity improvements

Phase 3: Custom Configuration and Development Integration Planning

For development teams ready to move forward, we provide full implementation support:

• Custom configuration files for recommended AI development tools
• Integration specifications with existing development systems, IDEs, and CI/CD pipelines
• Security configuration templates and guidelines for AI development tools

Development Process AI Integration

Our assessment focuses specifically on integrating AI into core development processes. We evaluate how to seamlessly incorporate AI into:

Core Development Workflows

• Code generation and completion tools like GitHub Copilot, Cursor, Claude Code, or Augment
• Automated testing and quality assurance using AI-powered testing tools and test generation
• Code review and security scanning with AI assistance for faster, more thorough reviews
• Documentation generation and maintenance automation for code comments and README files
• Bug detection and resolution using AI analysis and debugging assistance
• Refactoring and code optimization with AI-powered suggestions and automated improvements

Development Team Collaboration and Management

• Sprint planning and estimation with AI assistance for more accurate project planning
• Knowledge management and documentation search across codebases and internal documentation
• Developer onboarding and mentoring with AI-powered learning and guidance tools
• Code pattern recognition and best practice enforcement across the development team

Custom Development AI Solutions

In addition to assessment and tool integration and configuration, our team can also identify opportunities and build custom AI-powered solutions tailored to your specific development needs.

We’ll help you identify where a custom development solution makes sense and develop it end-to-end, from ideation to deployment.

Custom development solutions can include:

• RAG-powered knowledge bases for internal development documentation, coding standards, and architectural decisions
• AI code reviewers that specialize in your codebase, domain-specific requirements, and team coding standards
• Custom AI chatbots for developer support, onboarding, and technical question answering
• LLM-powered development services to automate manual and repetitive development processes
• AI-powered code migration tools for framework upgrades, refactoring, and technical debt reduction
• Custom development workflow automation using AI to streamline repetitive development tasks

Getting Started with Your Development Team AI Assessment

Ready to unlock your development team’s AI potential? Our AI Readiness & Transformation Assessment is designed for development teams of all sizes, from startup engineering teams looking to gain a competitive edge to established enterprise development organizations planning large-scale AI tool adoption.

Investment and Timeline

Our comprehensive development team assessment is delivered over 4 weeks and includes:

• Detailed assessment report with findings and development-specific recommendations
• Strategic roadmap with prioritized implementation phases for development workflows
• Follow-up consultation to address questions and refine development plans
• Custom configuration files and integration plans for development tools (if applicable)

The investment for the full assessment is $24,000. Custom development solution development and tooling implementation are priced separately based on scope.

Why OmbuLabs for Your AI Assessment

When it comes to navigating your development team’s AI transformation, you need more than just consultants, you need partners who understand both the technical complexities and the human side of change.

Deep Technical Expertise in AI and Development

At OmbuLabs.ai, we don’t just talk about AI. We build it. Our team has hands-on experience developing custom AI solutions, from RAG-powered solutions, to multi-agent systems, to machine learning models that drive real business impact. We’ve worked with organizations big and small (take a look at our Case Studies) to deliver production-ready AI solutions, and we bring that same practical expertise to every assessment.

We understand development workflows from the inside out because we’re developers ourselves. We know the challenges of integrating new tools into existing processes, the importance of developer experience, and how to balance innovation with stability.

Lean, Agile, and Results-Focused Approach

Our approach is built on solving real problems and driving real value. We don’t believe in one-size-fits-all solutions or unnecessary complexity. Instead, we focus on:

• The right problem to solve: We help you identify where AI will have the most impact on your development processes.
• The most valuable insights to extract: We cut through the AI hype to recommend tools and strategies that align with your specific needs.
• The right tool for the job: We’re technology-agnostic. We recommend solutions based on what works best for your team, not what’s trendy.

People-First Philosophy

Technology is only as good as the people using it. That’s why our assessments go beyond technical recommendations to address the human elements of AI adoption:

• Developer training and skill development strategies
• Change management approaches that reduce resistance and increase buy-in
• Cultural readiness evaluation to ensure your team is set up for success

When you work with OmbuLabs.ai, you’re collaborating with compassionate individuals who understand that successful AI transformation requires both technical excellence and empathy for the people affected by change.

Proven Track Record

Our clients consistently praise our communication, responsiveness, and ability to deliver high-quality results. We’ve helped organizations across industries unlock the potential of their data and technology, and we bring that same commitment to excellence to every AI assessment.

We’re not just consultants who deliver a report and disappear. We’re partners invested in your success, offering ongoing support and flexible engagement models that adapt as your needs evolve.

End-to-End Capabilities

Unlike firms that only assess or only implement, we offer the full spectrum of AI services. After your assessment, we can:

• Configure and integrate recommended AI development tools
• Build custom AI solutions tailored to your specific needs
• Provide fractional AI and machine learning services to complement your team
• Support ongoing optimization and MLOps as your AI capabilities mature

This means you get continuity from assessment through implementation, with a partner who already understands your context and goals.

Your Development Team’s AI Transformation Starts Here

The question isn’t whether AI will transform software development; it’s whether your development team will be leading that transformation or struggling to catch up. Our AI Readiness & Transformation Assessment gives you the strategic clarity and practical roadmap you need to succeed in the AI-driven development landscape.

Don’t let uncertainty hold your development team back from AI’s transformative potential. Let us help you assess your team’s readiness, identify your development opportunities, and build a roadmap for successful AI adoption in your engineering processes.

Ready to work with a team that combines deep technical expertise, practical experience, and a people-first approach? Contact us today to schedule your AI Readiness & Transformation Assessment.

The first article in the series was about local AI in higher ed. This one is about a case study about account provisioning with AI at UCLA.

The Future of Account Provisioning with AI at UCLA

Anna Ahearn and Krithik Udayashankar from UCLA IT Services presented a solution that leaned heavily on custom GPTs to optimize account provisioning at different departments of their institution.

Problem

UCLA’s provisioning workflows are complex, inconsistent, and poorly documented. This causes delays, risk, and common mistakes when onboarding/offboarding people to their systems.

Vision

The team had a vision of an AI chatbot using custom GPTs to provide accurate answers to access-related questions, reduce administrative overhead, and improve compliance and efficiency.

Their vision of a solution streamlined workflows and addressed common challenges in managing access provisioning across departments.

Solution

The team conducted stakeholder interviews to process-map current workflows and identify key challenges. They then developed a domain-specific GPT chatbot tailored to address real scenarios, such as providing guidance on requesting access to the Bruin Financial Aid system or updating a user’s role.

This approach ensured the chatbot could deliver accurate, context-aware responses to streamline access provisioning tasks.

For the implementation, the team decided to use OpenAI’s custom GPTs feature.

Ethical Commitments

From the very beginning, the team prioritized adherence to UCLA’s Responsible AI Principles:

• Appropriateness: The potential benefits and risks of AI and the needs and priorities of those affected should be carefully evaluated to determine whether AI should be applied or prohibited.

• Transparency: Individuals should be informed when AI-enabled tools are being used.

• Accuracy, Reliability, and Safety: AI-enabled tools should be effective, accurate, and reliable for the intended use and verifiably safe and secure throughout their lifetime.

• Fairness and Non-Discrimination: AI-enabled tools should be assessed for bias and discrimination.

• Privacy and Security: AI-enabled tools should be designed in ways that maximize privacy and security of persons and personal data.

• Human Values: AI-enabled tools should be developed and used in ways that support the ideals of human values, such as human agency and dignity, and respect for civil and human rights.

• Shared Benefit and Prosperity: AI-enabled tools should be inclusive and promote equitable benefits (e.g., social, economic, environmental) for all.

• Accountability: The University of California should be held accountable for its development and use of AI systems in service provision in line with the above principles.

They emphasized the importance of stakeholders understanding and trusting the system.

Co-creation was a key focus, which pushed the team to involve collaboration with diverse groups to shape the solution.

Additionally, they worked diligently to mitigate bias, recognizing its potential impact on the effectiveness and fairness of the AI system.

Future Outlook

The team envisions a future where their solution incorporates predictive access assignments, enabling the system to anticipate user needs based on patterns and roles.

They aim to implement dynamic access control, allowing permissions to adjust in real time as circumstances change.

At the same time, they aim to have a solution with automated deprovisioning that will streamline the removal of access when it is no longer needed, reducing risks and administrative overhead.

Additionally, they plan to leverage AI for adaptive cybersecurity, ensuring robust protection that evolves to counter emerging threats.

Final Thoughts

In reflecting on UCLA’s approach, it’s clear to me that the success of AI-powered solutions in higher ed depends on more than just technical innovation. The human factors of trust, bias, and usability remain central to these solutions.

Systems must be designed not only to save people’s time, but also to empower the people who rely on them every day.

When stakeholders are involved in shaping solutions, and when transparency and ethical commitments are prioritized, users are more likely to trust and adopt new tools.

Ultimately, AI should make processes easier and faster, but it must also be easy to understand to those it serves.

The most impactful systems are those that enhance human capabilities, foster collaboration, and build confidence.

At the same time, higher ed organizations don’t need highly customized Generative AI solutions to solve real problems.

For publicly available content, where copyright is not a big concern, custom GPTs on top of OpenAI can work in a cost-effective way and reduce time to market for your solution.

Futher Reading

• Abstract: The Future of Account Provisioning with AI-Enhanced Tools for University Staff

• Slides: The Future of Account Provisioning with AI-Enhanced Tools for University Staff

• UCLA’s Responsible AI Principles

• Creating a Custom Chat GPT

I tried to focus on real-world examples of how higher ed professionals are thinking through and applying AI and ML, with all their limitations, in day-to-day academic life.

Keep Your Data Close and Your AI Closer: Local AI in the Academy

In their presentation, Gerol Petruzella & Trevor Murphy (Williams College) presented 3 case studies that leveraged AI to solve real scenarios at their institution.

These were 3 privacy-first, cloud-free applications of local AI to support pedagogy, accessibility, and student experimentation.

Case 1: 📂 Private Archive Analysis

In this case study, the team needed to analyze 822 historical syllabi for teaching patterns.

“The Rice Center for Teaching sought to use a set of historical Williams syllabi (in a mixture of pdf and docx file formats) to discover patterns in pedagogical design and practice, to inform support for incoming Williams faculty. These documents are not publicly available, and so RCT sought a local (non-cloud) retrieval augmented generation (RAG) application to preserve the privacy of the source documents, while leveraging the power of a chat-based generative LLM to efficiently discover and retrieve useful patterns from a large corpus in a timely way.”

It was very important that the solution should keep sensitive internal documents entirely offline, due to copyright restrictions.

More technical details:

• Tech Stack: Ollama + OpenWebUI
• Key Feature: Retrieval-Augmented Generation (RAG) with embedded citations
• Embed Model: mxbai-embed-large-v1
• Generation Model: phi-3-medium-128k-instruct

Both the project design and the proposed solution are appropriately crafted to respect Williams College’s Guidance for Working with Generative AI Tools.

Case 2: 🎞️ Audio Transcription with OpenVINO

In this scenario, they needed to create accurate SRT files with no cloud tools, ensuring copyright compliance and data control. The source of the content was films in the Italian language.

“The OpenVINO toolkit expands the familiar open-source audio editing application Audacity with 100% local (not cloud-based) AI capacities.”

More technical details:

• Tech Stack: Audacity with OpenVINO plugins

Case 3: 🤖 EphBot – The Pocket-Sized GenAI Lab

In the last case, they wanted to allow students to explore LLM behavior offline. They designed and implemented a solution that was easily portable and not resource intensive.

Part of the features allowed people to measure electricity usage to teach sustainability and AI ethics.

One of the neat features was that you could specify the configuration you wanted to use with the LLM (e.g. temperature) and you could set it to a value that could make it produce more or less hallucinations.

“You can check out EphBot from the Equipment Loan Center in Sawyer Library. Plug it in, connect your phone to the “ephbot” Wi-Fi hotspot it creates, point your browser at ephbot.local:8080, and you’re ready to chat. EphBot’s interface is similar to other AI chatbots, but it gives you more controls to tinker under the hood: settings, prompts, and more.”

More technical details:

• Tech Stack: Raspberry Pi 5
• LLM: llamafile + OLMo LLM

Hardware and Software Requirements:

• 128GB Samsung EVO Plus micro-SD card (flashed with Raspberry Pi OS)
• CanaKit MicroSD reader/USB-A adapter
• Laptop (with Raspberry Pi Imager application)
• Ethernet connection (for initial setup and llamafile download)
• Standard Pi peripherals (power cord, micro-HDMI cable, keyboard, mouse)

Final Thoughts

This presentation was thought-provoking and enlightening. It shows that there are many freely available tools and models that can be used to host AI-powered solutions in your own infrastructure with basic knowledge of AI and ML.

Attendees learned that you don’t need to use third party services like Chat GPT to develop powerful AI solutions. This is crucial when working with copyrighted content that needs to be protected from improper use by third parties.

A very popular pattern for building AI Agents is the ReAct pattern, meaning Reasoning and Acting. The idea is to get large language models (LLMs) to reason about a problem in a manner analogous to how humans do, by breaking down the problem into smaller steps, reasoning about each step, using tools, and then acting on the results.

Let’s walk through the ReAct pattern and how we can use it to build a simple AI Agent that writes blog posts in Ruby.

The ReAct Pattern Explained

The ReAct pattern was first introduced by Yao et al. in their paper “ReAct: Synergizing Reasoning and Acting in Language Models”. The key idea is to combine reasoning (thinking) and acting (doing) in a way that allows LLMs to solve complex tasks more effectively.

In a standard, one step answer generation, the user submits a query, the LLM is prompted to generate an answer, and the answer is returned directly to the user.

This approach works well for simple questions, but struggles as the tasks become more complex, or when external resources are needed to further inform an answer.

Techniques to tackle reasoning and acting separately exist - chain-of-thought prompting and function calling, for example - but the combination of both steps into a single loop is what makes ReAct powerful.

ReAct combines both reasoning and acting, allowing the model to reason about the results of its actions and use that reasoning to inform its next steps. This is done by breaking down the task into smaller steps, reasoning about each step, using tools to interact with external systems and perform actions, and then reasoning about the results of those actions.

In essence, the agent operates in a loop of:

THOUGHT: Reason about the task and decide on the next action
ACTION: Call a tool or perform an action based on the reasoning
OBSERVATION: Receive the result of the action

Combining reasoning and acting allows for more complex tasks to be solved effectively.

Implementing ReAct in Ruby

To implement this, we’ll use the Anthropic Ruby SDK, Tavily for web search and Serper.dev for image search. You’ll need to set up API keys for all three of them. While Anthropic requires a 5 dollar purchase to get started, Tavily and Serper.dev have free tiers.

Setting Up

Make sure you have the required gems in your Gemfile:

source "https://rubygems.org"

gem "anthropic", "~> 1.1.1"
gem "dotenv"
gem "faraday"

You will also need all three API keys in your .env file:

ANTHROPIC_API_KEY=your_anthropic_api_key
SERPER_API_KEY=your_serper_api_key
TAVILY_API_KEY=your_tavily_api_key

Preparing the Tools

Our agent will use three tools: web search, image search, and saving content to a file. Let’s define the web search tool:

# tools.rb
require "faraday"

class Tools
  def web_search(query)
    response = tavily_client.post("/search") do |req|
      req.body = {
        query: query,
        search_depth: "advanced"
      }
    end
    parsed = JSON.parse(response.body)
    parsed["results"] || "No relevant results found."
  rescue Faraday::Error => e
    "Search failed: #{e.message}"
  end

  private

  def tavily_client
    @tavily_client ||= Faraday.new(url: "https://api.tavily.com") do |conn|
      conn.request :json
      conn.headers["Authorization"] = "Bearer #{ENV.fetch("TAVILY_API_KEY")}"
      conn.headers["Content-Type"] = "application/json"
    end
  end
end

This function uses the Tavily API to perform a web search based on the query provided, returning the results or an error message if the search fails. Next, let’s define the image search tool using Serper.dev:

# tools.rb
require "faraday"

class Tools
  def image_search(query)
    response = serper_client.post("/images") do |req|
      req.body = { q: query }
    end
    parsed = JSON.parse(response.body)
    first_image = parsed["images"][0]
    {
      title: first_image["title"],
      url: first_image["imageUrl"]
    }
  rescue Faraday::Error => e
    "Image search failed: #{e.message}"
  end

  def web_search(query)
    response = tavily_client.post("/search") do |req|
      req.body = {
        query: query,
        search_depth: "advanced"
      }
    end
    parsed = JSON.parse(response.body)
    parsed["results"] || "No relevant results found."
  rescue Faraday::Error => e
    "Search failed: #{e.message}"
  end

  private

  def serper_client
    @serper_client ||= Faraday.new(url: "https://google.serper.dev") do |conn|
      conn.request :json
      conn.headers["X-API-KEY"] = ENV.fetch("SERPER_API_KEY")
      conn.headers["Content-Type"] = "application/json"
    end
  end

  def tavily_client
    @tavily_client ||= Faraday.new(url: "https://api.tavily.com") do |conn|
      conn.request :json
      conn.headers["Authorization"] = "Bearer #{ENV.fetch("TAVILY_API_KEY")}"
      conn.headers["Content-Type"] = "application/json"
    end
  end
end

Now we have a way to search for images based on a provided query.

Finally, let’s define the tool to save content to a file:

# tools.rb
require "faraday"

class Tools
  def save_to_file(content, filename)
    if content.nil? || content.strip.length < 20
      return "Save failed: content is too short or empty."
    end

    File.open(filename, "w") do |file|
      file.write(content)
    end
    "Content saved to #{filename}"
  rescue => e
    "Failed to save content: #{e.message}"
  end

  def image_search(query)
    response = serper_client.post("/images") do |req|
      req.body = { q: query }
    end
    parsed = JSON.parse(response.body)
    first_image = parsed["images"][0]
    { title: first_image["title"], url: first_image["imageUrl"] }
  rescue Faraday::Error => e
    "Image search failed: #{e.message}"
  end

  def web_search(query)
    response = tavily_client.post("/search") do |req|
      req.body = {
        query: query,
        search_depth: "advanced"
      }
    end
    parsed = JSON.parse(response.body)
    parsed["results"] || "No relevant results found."
  rescue Faraday::Error => e
    "Search failed: #{e.message}"
  end

  private

  def serper_client
    @serper_client ||= Faraday.new(url: "https://google.serper.dev") do |conn|
      conn.request :json
      conn.headers["X-API-KEY"] = ENV.fetch("SERPER_API_KEY")
      conn.headers["Content-Type"] = "application/json"
    end
  end

  def tavily_client
    @tavily_client ||= Faraday.new(url: "https://api.tavily.com") do |conn|
      conn.request :json
      conn.headers["Authorization"] = "Bearer #{ENV.fetch("TAVILY_API_KEY")}"
      conn.headers["Content-Type"] = "application/json"
    end
  end
end

And now we have all of our tools defined. The last step in setting up our tools for the agent to use is to create function definitions for them. In order to decide which tool to use, we’ll leverage function calling, which allows the LLM to interact with tools. You can read more about it in the Anthropic Tool use with Claude documentation.

Anthropic expects the function definitions to be in a specific JSON format, so Claude can understand which tools are available and what each tools does:

{
  "name": "",
  "description": "",
  "input_schema": {
    "type": "object",
    "properties": {},
    "required": []
  }
}

Here’s how we can define our tools:

FUNCTION_DEFINITIONS = [
  {
    name: "web_search",
    description: "Search the web for a topic",
    input_schema: {
      type: "object",
      properties: {
        query: { type: "string", description: "The topic to search for" }
      },
      required: ["query"]
    }
  },
  {
    name: "image_search",
    description: "Find an image related to the topic",
    input_schema: {
      type: "object",
      properties: {
        query: { type: "string", description: "The image search term" }
      },
      required: ["query"]
    }
  },
  {
    name: "save_to_file",
    description: "Save the markdown blog post to a file",
    input_schema: {
      type: "object",
      properties: {
        content: { type: "string", description: "Markdown content of the blog post" },
        filename: { type: "string", description: "Markdown file name to save as (e.g., 'my-post.md')" }
      },
      required: %w[content filename]
    }
  }
]

Now our tool set up is ready. We can use these definitions to call the tools from our agent.

Building the Agent

Now that we have our tools defined, we can build the agent that will use them to write a blog post.

The agent will be triggered by an incoming query, which will be the topic of the blog post. We want to define a system prompt to guide the agent’s behavior. The system prompt will instruct the agent to reason about the topic, search for relevant information, find an image, and then write a markdown blog post.

SYSTEM_PROMPT = <<~PROMPT
  You are an agent that thinks step by step and uses tools to complete your task.

  Your task is to write a blog post on the given topic.

  The blog post must:
  - Start with a markdown H1 title (e.g. `# Hammer Head Sharks`)
  - Include a markdown image below the title (`![alt](url)`)
  - Include a few paragraphs of well-formatted markdown content

  Available tools:
  - web_search: to look up information on the topic and gather relevant content
  - image_search: to find an image related to the topic
  - save_to_file: to save the final blog post to a file

  You should:
  1. Use `web_search` to gather information about the topic (iterate until you have enough content)
  2. Use `image_search` to find a relevant image
  3. Format the content into a markdown blog post, with:
    - An H1 title
    - An image below the title, added as an HTML <img> tag with the height set to no more than 300
    - A few paragraphs of content
  4. Save the final post using `save_to_file`

  IMPORTANT: ️Do not call `save_to_file` until:
  - You have included both an image and a title
  - The content is complete
  - You are fully ready to save

  After saving, you may return a final message to the user confirming the post was saved.
PROMPT

Our prompt is structured to provide the agent with information on the task to accomplish, the requirements for the result, the available tools, and what it should do.

Now let’s build our ReAct agent. First, we’ll create a class to encapsulate the agent and initialize the Anthropic client:

# agent.rb
require "dotenv/load"
require "anthropic"

require_relative "tools"  # Assuming the Tools class is defined in tools.rb

class ReActAgent
  def initialize
    @tools = Tools.new
    @messages = []
  end

  private

  def complete
    client.messages.create(
      model: "claude-sonnet-4-20250514",
      max_tokens: 1024,
      temperature: 0.0,
      system: SYSTEM_PROMPT,
      messages: @messages,
      tools: FUNCTION_DEFINITIONS
    )
  end

  def client
    @client ||= Anthropic::Client.new(api_key: ENV.fetch("ANTHROPIC_API_KEY"))
  end
end

The @messages array will hold the conversation history, which we will use to keep track of the agent’s reasoning and actions. In the complete, we also specify which model to use, temperature, the system prompt and the tools available to the agent. In this example, the temperature is set to 0 so the model will be as deterministic as possible, meaning it will try to always return the same output for the same input. This keeps our test runs consistent. A higher temperature would encourage the model to be more “creative”, so you might want to experiment with that and see what works best for your use case.

Let’s also define a method to call the right tool when the agent decides to use one:

def tool_call(tool_name, params)
  case tool_name
  when "web_search"
    @tools.web_search(params[:query])
  when "image_search"
    @tools.image_search(params[:query])
  when "save_to_file"
    @tools.save_to_file(params[:content], params[:filename] || filename)
  else
    "Unknown tool"
  end
end

Now let’s define our run method, which will be responsible for processing the user’s query and generating the blog post.

First, we need to add the user’s query to the conversation history:

def run(query)
  @messages << {
    role: "user",
    content: [
      { type: "text", text: "Write a markdown blog post on: #{query}" }
    ]
  }
end

Then we’ll start the agent loop. A ReAct agent will:

• Generate a response from the LLM
• Check if the response contains a tool call
• If it does, call the tool and add the result to the conversation history
• Repeat until the agent has completed the task

Anthropic returns responses as an array of messages. Once we get a response that contains only text and no tool calls, we’ll break the loop.

def run(query)
  @messages << {
    role: "user",
    content: [
      { type: "text", text: "Write a markdown blog post on: #{query}" }
    ]
  }

  loop do
    # Prompt the model to generate a response based on the conversation history
    response = complete

    # Check if the response contains only text blocks. If so, we can assume the agent has finished its task.
    if response.content.all? { |block| block[:type] == :text }
      puts "\n✅ Claude has finished. Exiting."
      break
    end

    # The "thought" in the reason step is the text block in the response. We'll add it to the conversation history.
    puts "\n💬 Thought: #{response.content[0][:text]}"

    @messages << {
      role: "assistant",
      content: response.content
    }

    response.content.each do |block|
      # Process tool calls in the response block
      next unless block[:type] == :tool_use

      tool_name = block[:name]
      params = block[:input]

      # The "action" in the act step is the tool call with the necessary parameters.
      # Claude provides values for the parameters, so we can call the tool directly.
      puts "🔧 Action: #{tool_name}(#{params})"

      result = tool_call(tool_name, params)

      # The result of the tool call is the observation that the agent can use to reason about the next steps.
      # We'll add the result to the conversation history.
      puts "📝 Observation: #{result.to_s[0..120]}..."

      @messages << {
        role: "user",
        content: [
          {
            type: "tool_result",
            tool_use_id: block[:id],
            content: result.to_s
          }
        ]
      }
    end
  end
end

Putting it all together, our ReActAgent class looks like this:

# agent.rb
require "dotenv/load"
require "anthropic"

require_relative "tools"

class ReActAgent
  def initialize
    @tools = Tools.new
    @messages = []
  end

  def run(query)
    @messages << {
      role: "user",
      content: [
        { type: "text", text: "Write a markdown blog post on: #{query}" }
      ]
    }

    loop do
      response = complete

      if response.content.all? { |block| block[:type] == :text }
        puts "\n✅ Claude has finished. Exiting."
        break
      end

      puts "\n💬 Thought: #{response.content[0][:text]}"

      @messages << {
        role: "assistant",
        content: response.content
      }

      response.content.each do |block|
        next unless block[:type] == :tool_use

        tool_name = block[:name]
        params = block[:input]

        puts "🔧 Action: #{tool_name}(#{params})"

        result = tool_call(tool_name, params)

        puts "📝 Observation: #{result.to_s[0..120]}..."

        @messages << {
          role: "user",
          content: [
            {
              type: "tool_result",
              tool_use_id: block[:id],
              content: result.to_s
            }
          ]
        }
      end
    end
  end

  private

  def tool_call(tool_name, params)
    case tool_name
    when "web_search"
      @tools.web_search(params[:query])
    when "image_search"
      @tools.image_search(params[:query])
    when "save_to_file"
      @tools.save_to_file(params[:content], params[:filename] || filename)
    else
      "Unknown tool"
    end
  end

  def complete
    client.messages.create(
      model: "claude-sonnet-4-20250514",
      max_tokens: 1024,
      temperature: 0.0,
      system: SYSTEM_PROMPT,
      messages: @messages,
      tools: FUNCTION_DEFINITIONS
    )
  end

  def client
    @client ||= Anthropic::Client.new(api_key: ENV.fetch("ANTHROPIC_API_KEY"))
  end
end

Testing the Agent

To test our agent, we can create a simple script that initializes the agent and runs it with a query:

# blog_writer.rb
require_relative "agent"  # Assuming the ReActAgent class is defined in agent.rb

if __FILE__ == $0
  query = ARGV[0]
  agent = ReActAgent.new
  agent.run(query)
end

Let’s see what it has to say about hammerhead sharks:

ruby blog_writer.rb "Hammer head sharks"

As the agent works through the task, we can see it’s reasoning step by step:

💬 Thought: I'll help you write a blog post about hammerhead sharks. Let me start by gathering information about them and finding a relevant image.
🔧 Action: web_search({query: "hammerhead sharks facts characteristics behavior habitat"})
📝 Observation: [{"url" => "https://whi.swimtopia.com/fun-facts-about-hammerhead-sharks", "title" => "Fun Facts About Hammerhead Sharks!"...

💬 Thought: Now let me search for more specific information about hammerhead sharks to get a comprehensive understanding.
🔧 Action: web_search({query: "hammerhead shark species types great scalloped smooth bonnethead"})
📝 Observation: [{"url" => "https://en.wikipedia.org/wiki/Hammerhead_shark", "title" => "Hammerhead shark - Wikipedia", "content" => "| S...

💬 Thought: Now let me find a relevant image for the blog post.
🔧 Action: image_search({query: "hammerhead shark underwater swimming"})
📝 Observation: {title: "Do sharks hold their breath underwater? This species might ...", url: "https://i.natgeofe.com/n/22b41661-0a35-49...

💬 Thought: Perfect! Now I have enough information to write a comprehensive blog post about hammerhead sharks. Let me create the markdown content and save it to a file.
🔧 Action: save_to_file({filename: "hammerhead-sharks.md"})
📝 Observation: Save failed: content is too short or empty....

💬 Thought: Let me create the complete blog post content first:
🔧 Action: save_to_file({filename: "hammerhead-sharks.md", content: "# Hammerhead Sharks\n\n<img src=\"https://i.natgeofe.com/n/22b41661-0a35-4933-8e8f-d53552a68705/National..."})
📝 Observation: Content saved to hammerhead-sharks.md...

✅ Claude has finished. Exiting.

You can see the agent reasoning about the task, searching for information, and acting on the result. You can also see, at the last step, the agent attempting to use a tool and failing (it did not provide the content of the blog post to save the file), and because it processes the result of a tool call, it understands it failed and tries again, then obtaining a successful result.

The generated post was saved in a file called hammerhead-sharks.md in the root directory, and you can see what the resulting blog post looks like below:

Conclusion

AI Agents are powerful tools, and the ReAct pattern allows us to build agents that can reason about complex tasks and interact with external tools to accomplish them. By combining reasoning and acting, we can create agents that can solve tasks in a way that is similar to how humans do, breaking down problems into smaller steps and using tools to interact with the world.

Want to know how we can help you leverage AI for your business? Talk to us today!.