International Oil and Gas Service Provider

The client's pipeline integrity audits sit underneath capital decisions, insurance positions, and regulatory submissions for some of the largest operators in the world. The methodology is proprietary, refined over decades of field work. The judgement-heavy step in the middle of every audit (a senior consultant cross-referencing the framework against several thousand pages of evidence) lived in the heads of people approaching retirement.

The brief had a succession edge to it. The sponsor wanted an honest answer on whether AI could carry some of that load, written down well enough to defend the answer either way. Off-the-shelf hosted assistants were out: audit content cannot leave the client environment. That is a contractual line, not a preference, and it rules out every cloud LLM on the market before the design conversation starts.

• Audit content stays inside the client environment, end to end.
• Assist, do not replace. Marks stay with the consultant, every time.
• Every draft finding has to cite the source pages it came from.
• The proprietary methodology never reaches a hosted model.
• The recommendation has to be defensible to procurement, engineering, and the regulator.

Two routes were on the table: a single-shot end-to-end consultant assistant, or a two-stage pilot with a conditional gate between the stages. We recommended the staged route, and the strategy review endorsed it without amendment.

Stage one is a knowledge base engine: document processing, retrieval on both meaning and exact wording, a simple query interface. It earns its keep on day one because junior staff stop spending days assembling evidence, and it puts the on-premise GPU and Kubernetes stack through real workloads before anything riskier gets layered on.

Stage two is the gap-analysis engine. It breaks the framework into testable criteria, drafts a finding for each one against the evidence index, and routes those drafts into a consultant review interface before anything reaches a customer-facing report. The position is "assist, not replace", and the architecture is what enforces it. The gate between the stages is binary: if stage one cannot hit the agreed retrieval accuracy and stability targets on five historical audits, stage two does not start.

The five interviews shaped every design call. The retired-knowledge problem became the case for capturing institutional memory as a machine-readable index. The earlier in-house benchmarking work, stalled at proof-of-concept for lack of GPU capacity, became the case for using the now-available on-premise hardware as the primary path. The data-sovereignty constraint became the design boundary, not a wish.

• Document ingestion that normalises across PDFs, Word, and scans into one searchable index.
• Retrieval on meaning and exact wording at the same time, catching both concept and clause references.
• Gap-analysis engine that drafts findings against framework criteria with source-page citations.
• Consultant review interface: accept, edit, reject, with immutable audit trail.
• Sovereign data path: primary on the client's GPU and Kubernetes stack, with hybrid overflow inheriting the same posture.
• Pilot success metrics: top-three retrieval, sub-3s response, precision above 85%, recall above 90%.