Oren Labs · engineering studio

Your AI prototype works. Production is a different system.

We are an architecture-first engineering studio. We take AI systems from demo to production on AWS — designed for cost, secured by default, specified before it is written.

Let’s Productionize Together 30 minutes · direct with a senior engineer
Reference topologyprod / eu-west-1

Reference production topology, six layers: edge (CloudFront and WAF); compute (ECS Fargate and Lambda); inference, highlighted (Bedrock and self-hosted vLLM on GPU); state (Aurora with pgvector); guardrail (eval gate and cost budget); and observability (OpenTelemetry traces and token spend).

EDGE
CloudFront
WAF
COMPUTE
ECS Fargate
Lambda
INFERENCE
Bedrock
vLLM · GPU
STATE
Aurora
pgvector
GUARDRAIL
Eval gate
Cost budget
OBSERVE
OTel traces
Token spend
Every engagement starts with a drawing like this one.
01 · The gap

A demo proves the idea. It doesn’t survive Monday.

The notebook that impressed the board has no identity model, no cost ceiling, no rollback, no evals, and one engineer who understands it. None of that is a coding problem. It’s an architecture problem, and it compounds every week it stays unsolved.

Closing that gap is the only thing we do.

Comparison. A prototype is one laptop, keys in a dotenv file, unknown cost, no rollback, evals by vibes, and one owner. Production is multi-AZ and defined in infrastructure as code, scoped and rotated IAM credentials, a budget with a per-call ceiling, blue/green deploys with revert, an eval gate in CI, and a runbook with on-call.

Prototype
one laptop
keys in .env
cost: unknown
rollback: none
evals: vibes
owner: one person
Production
multi-AZ, IaC
scoped IAM, rotated
budget + per-call ceiling
blue/green + revert
eval gate in CI
runbook + on-call
02 · How we work

Four commitments you can hold us to.

Not values. Constraints we accept before writing a line.

01

Architecture first

We draw the system, name the failure modes, and agree the boundaries before anyone opens an editor. Diagrams are cheap; rewrites are not.

day one → a topology drawing you can argue with
02

Spec-driven

Every non-obvious decision is written down with the alternatives we rejected. Your team inherits the reasoning, not just the repository.

day one → an ADR for every fork in the road
03

Cost-aware

Inference and infrastructure cost are design inputs, not a surprise on the invoice. Budgets and per-call ceilings ship with the feature.

day one → a cost model at 1×, 10×, and 100×
04

Secure by default

Least-privilege IAM, rotated secrets, and explicit data boundaries are the starting position — never a hardening phase scheduled for later.

day one → scoped roles and a data-boundary map
03 · Engagement

Four stages. Named deliverables at every one.

You can stop after any stage and keep everything produced in it. Consulting, audits, and platform work are all entry points into the same sequence.

Audit01 / 04

Where does this break at 100×?

We read the code, the infrastructure, and the bill. You get a written picture of what will fail first, what it will cost, and how large the blast radius is when it does.

You receive
Risk register, ordered by likelihood × damage
Cost model: today, at 10×, at 100×
Blast-radius map of every destructive path
A go / no-go recommendation in plain English
04 · Selected work

Systems in production.

Client names withheld under NDA. Architecture described in full on request.

Open source: Blueprint Validator and internal platform tooling are public on GitHub.

05 · Who you work with

Founder-led. Senior only. No bench.

The people who scope the work are the people who write it. There is no layer between you and the engineer holding the pager.

What teams engage us for
Custom AI developmentbuild
AI & cloud consultingadvise
AI auditsaudit
AWS & platform engineeringmodernize
06 · We ship our own software

Oren Agent — guardrails for coding agents.

A GitHub App and editor plugin that catch cloud cost, token cost, and destructive actions before they land. Built because we needed it on our own engagements.

See Oren Agent
oren-agentpre-execution
⊘ blocked terraform apply
  destroys 34 resources incl. aurora-prod
  no snapshot in last 7d
✓ allowed terraform plan -out=tfplan

Tell us what has to reach production.

Thirty minutes on your system, your timeline, and what is currently blocking you.

Let’s Productionize Together

A senior engineer takes the call — the same one who would do the work.
Prefer email? hi@jawadzaidi.com