Architecture
How is the system structured, and how do information, authority and responsibility move through it?
About Boris Abuzov
I am an independent AI Risk & Governance Consultant focused on GenAI, RAG and agentic systems.
I conduct evidence-based risk and readiness reviews that connect system architecture, operating conditions, technical evidence and human judgment. The purpose is to clarify what is supported, what remains unverified and what should be addressed before deployment, scaling, client handoff or increased autonomy.
Why This Practice Exists
My work in AI risk grew out of years of making and supporting consequential decisions around complex technical products, international manufacturers and real operating environments.
Earlier in my career, I held product, sales and commercial leadership roles in international projects involving medical technology, packaging and production equipment, and material-handling systems. I later founded and led, for nearly eight years, a specialized B2B company supplying industrial equipment to clients across multiple sectors.
This experience taught me to examine technical claims together with available evidence, operating conditions, customer requirements, contractual obligations, financial consequences and responsibility for the result. My education in law and financial management, together with structured study of information security—including application-security fundamentals and the OWASP Top 10—reinforced this decision-oriented perspective.
When I began exploring and applying AI within my own business, I encountered the same decision problem in a new form. AI systems could produce persuasive results while leaving important questions about evidence, authority, control and responsibility unresolved.
AI systems are a newer technological domain in my work, but the underlying discipline is familiar: examining whether stated capability, available evidence, operational controls and responsibility align before a consequential decision.
That experience led me to develop a dedicated risk and readiness review practice focused on GenAI, RAG and agentic systems.
Current Practice
My practical work has included a bounded review of an early-stage agentic AI system. Documentary analysis was extended with stakeholder explanations, demo-based observations, and a remediation and validation plan.
The practice is supported by the AI Systems Risk & Evidence Lab, which develops synthetic cases, controlled experiments and reusable evidence workflows.
The Lab includes a RAG Risk & Evidence Harness for controlled examination of retrieval behavior, source boundaries, context construction and traceability.
How I Approach AI Risk
I review AI as part of a wider operating system of models, data, retrieved information, permissions, tools, human decisions and business processes.
The overall review perspective follows five connected questions:
Risk
Which technical or operational mechanisms could produce incorrect, unreliable or insufficiently controlled behavior?
Consequences
How could that behavior affect users, operations, data, contractual commitments or business decisions?
Controllability
Can incorrect actions be prevented, unexpected behavior detected, the system interrupted when necessary and operations restored after failure?
Decision Conditions
What should be corrected, tested, observed or documented before the proposed next step has sufficient support?
At the level of an individual finding, these questions are developed through a more detailed structure connecting the mechanism, supporting material, consequences, existing strengths, control gaps, remediation and acceptance evidence.
Evidence Before Confidence
I distinguish the source and conditions of information from how it was reviewed and what it can support.
A documented control does not prove implementation. A demonstration may show behavior in one scenario without establishing representative operational performance. A controlled experiment may demonstrate a mechanism without proving production readiness.
The level of confidence should not exceed the information available.
Technical tools can produce traces, observations and test results. They do not make the final judgment. I conduct the review directly and remain responsible for connecting the evidence to consequences, controllability and decision conditions.
Who I Work With
I work with AI product companies, software teams, integrators and professional-service firms that need an independent view before deployment, client handoff, scaling or increased autonomy.
A review may address the wider system or a specific workflow, component, control question or proposed change.
Independence and Professional Boundaries
I do not sell an AI platform, implementation package or automatic risk score.
The review is structured around the decision being considered, the available evidence and the conditions requiring clarification. Its purpose is not to justify a predetermined outcome.
An Independent AI Risk Review is not a formal audit, certification, legal opinion, compliance approval, penetration test or red-team exercise.
Conclusions remain limited to the reviewed system, workflow, environment, information and decision context. Responsibility for the final decision remains with the relevant system owner.
More detailed limitations are available on the Professional Boundaries page.
Discuss Your AI System
Begin with a short overview of:
- what the system or workflow does;
- its current stage;
- the decision, change or next step being considered;
- the main uncertainty you would like to clarify.
You do not need to choose the final review route before making contact.
Detailed technical materials are not required for the first message.
Please do not submit passwords, credentials, API keys, sensitive personal data, confidential documents, unredacted logs, production traces, source files or archives in your initial email.