Question 1

What does behavior-preserving modernization mean?

Accepted Answer

It means documenting the current system’s observable inputs, outputs, calculations, permissions, workflow states, and exceptions so intentional changes can be separated from accidental behavioral drift.

Question 2

Do you rewrite legacy systems from scratch?

Accepted Answer

Not by default. The preferred path is to map risk, introduce testable seams, and modernize in bounded stages when that reduces operational risk.

Question 3

What kinds of .NET systems are a fit?

Accepted Answer

Common fits include ASP.NET, ASP.NET Core, MVC, Web Forms, Classic ASP, VB.NET, C#, SQL Server, stored-procedure-heavy systems, reporting workflows, internal admin tools, and API modernization.

Question 4

What if our business logic is mostly in SQL Server?

Accepted Answer

SQL-side business rules are treated as part of the application behavior. The modernization work maps stored procedures, jobs, reports, transactions, owners, and representative parity scenarios before replacement.

Question 5

Can you help with AI without exposing private data?

Accepted Answer

Yes, when the engagement is designed around approved data boundaries, secure channels, least-authority access, and an appropriate local, private, hybrid, or managed model approach. Public forms must not receive secrets or regulated data.

Question 6

What is human-reviewed AI?

Accepted Answer

AI output remains proposed work until a named reviewer can inspect evidence, edit, approve, reject, block, or escalate it under explicit workflow rules.

Question 7

What is governed RAG?

Accepted Answer

Governed RAG adds source ownership, access control, provenance, content states, citation rules, refusal behavior, evaluation, and human escalation around retrieval.

Question 8

What happens after the first fit call?

Accepted Answer

If the problem fits, the next step is usually a scoped assessment or package proposal. Sensitive system details move to an approved private channel rather than the public form.

Question 9

Do you publish client metrics?

Accepted Answer

Only when the source material and exact wording are approved. Public-safe case pages distinguish methods, sample artifacts, measurement models, and approved outcomes so templates are not presented as client results.

Question 10

How do you handle confidential systems?

Accepted Answer

Public routes collect only high-level context. Private code, credentials, PHI, customer records, and confidential architecture require a separately approved secure handling path.

Governance and Trust

Recognized frameworks translated into implementation controls

NIST AI RMF alignment

ISO/IEC 42001-aware operating model

OWASP GenAI risk controls

Bounded claims

Start with a short fit call, then scope the assessment.