Question 1

What does behavior-preserving modernization mean?

Accepted Answer

It means documenting the current system’s observable inputs, outputs, calculations, permissions, workflow states, and exceptions so intentional changes can be separated from accidental behavioral drift.

Question 2

Do you rewrite legacy systems from scratch?

Accepted Answer

Not by default. The preferred path is to map risk, introduce testable seams, and modernize in bounded stages when that reduces operational risk.

Question 3

What kinds of .NET systems are a fit?

Accepted Answer

Common fits include ASP.NET, ASP.NET Core, MVC, Web Forms, Classic ASP, VB.NET, C#, SQL Server, stored-procedure-heavy systems, reporting workflows, internal admin tools, and API modernization.

Question 4

What if our business logic is mostly in SQL Server?

Accepted Answer

SQL-side business rules are treated as part of the application behavior. The modernization work maps stored procedures, jobs, reports, transactions, owners, and representative parity scenarios before replacement.

Question 5

Can you help with AI without exposing private data?

Accepted Answer

Yes, when the engagement is designed around approved data boundaries, secure channels, least-authority access, and an appropriate local, private, hybrid, or managed model approach. Public forms must not receive secrets or regulated data.

Question 6

What is human-reviewed AI?

Accepted Answer

AI output remains proposed work until a named reviewer can inspect evidence, edit, approve, reject, block, or escalate it under explicit workflow rules.

Question 7

What is governed RAG?

Accepted Answer

Governed RAG adds source ownership, access control, provenance, content states, citation rules, refusal behavior, evaluation, and human escalation around retrieval.

Question 8

What happens after the first fit call?

Accepted Answer

If the problem fits, the next step is usually a scoped assessment or package proposal. Sensitive system details move to an approved private channel rather than the public form.

Question 9

Do you publish client metrics?

Accepted Answer

Only when the source material and exact wording are approved. Public-safe case pages distinguish methods, sample artifacts, measurement models, and approved outcomes so templates are not presented as client results.

Question 10

How do you handle confidential systems?

Accepted Answer

Public routes collect only high-level context. Private code, credentials, PHI, customer records, and confidential architecture require a separately approved secure handling path.

Standards Alignment

Recognized governance language, practical implementation controls

How do we map, measure, manage, and govern AI before scaling?

How do we manage AI roles, documentation, competence, monitoring, and improvement?

How do we reduce prompt injection, excessive agency, sensitive-data exposure, and unsafe output handling?

How do we prepare high-impact AI workflows for human oversight and traceable decisions?

Use the matrix to start risk conversations, not to replace review.

Start with a short fit call, then scope the assessment.