The business problem

Enterprise leaders were receiving 8 week old risk audits that failed to provide operational context, leaving them paralyzed on multimillion dollar capital moves.

The system solution

A command center that processes unstructured intelligence, grounds it with verifiable citations, and links a proprietary severity score directly to mandated actions.

My role and stack

Product Owner. Prototyped in Figma, Linear, and Claude Code.

Four jobs

Assessment, diligence, tabletop, simulation, named as jobs

Entry point

One analyst asking a question, not a wall of charts

Inbound

The day's threats arrive already scored and already priced

Outcome

A 100 page consultant deck warning of a "78% probability of failure" is chaos masked as data. It does not tell a Chief Risk Officer whether to kill an M&A deal or sign a contract.

During our initial user research across pilots like Volvo and Andersen Global, we uncovered three staggering statistics that defined the problem.

External telemetry is useless until it is constrained by internal corporate strategy. That rule set the shape of the pipeline.

Scroll to see the full pipeline

I owned the domain scope, the tolerance rules and the move taxonomy. Engineering and data science owned the ingestion architecture, the matching models and the actuarial math underneath the score.

GRC dashboards, point tools and consultants each do one job. The product had to sit above all three, which meant positioning it on two axes at once.

Scroll to see the full matrix

Dashboards report what already happened inside one domain. Point tools go deep on one domain and stop. Consulting correlates across domains but arrives weeks late and never in dollars. The open quadrant was predictive and correlated, and it was empty.

The core architectural constraint: an AI score without a mandated action is just an opinion.

To make this actionable, we translated the proprietary AIQ severity score into four explicit capital states to force a decision.

Scroll to see all four bands

The move is hard coded to the score. Drag the AIQ below and three of the four buttons go dead.

The third question needed a shape, not a sentence. Three postures off one score, each re running the real math.

We completely replaced the 6 to 8 week static consultant audit with a live, verifiable command center.

Executives now log in to a morning Command Center that instantly surfaces their top 3 customized threats mapped to exact mitigation paths. By translating abstract statistical uncertainty into cited, human in the loop decision scoring, we scaled executive actionability from a 34% historical baseline up to 86%.

The job was translation. Data scientists need mathematical exhaustiveness. Executives need absolute simplicity.

A forced decision taxonomy on one side and verifiable citations on the other is what let both be true at once.

Over $1.3M in monthly multi currency payroll and offshore vessel logistics was exposed because workflows were fragmented across spreadsheets, email and unstructured messaging.

I designed and prototyped Xastra Command from 0 to 1, an internal operations platform that introduces the intuitive design of readiness. It translates disjointed departmental data into a single, dynamically evaluated state machine that systematically governs multi currency payroll. It eliminated multi day manual reconciliation cycles and secured the pipeline by programmatically enforcing sequence compliance.

Answering "is this crew ready for payroll?" took days of manual cross referencing across three teams that could not see each other.

A logistics coordinator confirmed a vessel transfer in an email, an HR manager tracked passport expirations in a local spreadsheet, and finance executed a USD transfer off a chat thread. There was no single source of truth, so one miscommunication could pay a consultant who was never deployed, or send someone offshore with expired safety credentials.

The core architectural constraint: the intuitive design of readiness.

Rather than relying on operators to double check each other, the system dynamically calculates a unified readiness state. A payment or deployment cannot be authorized unless the logistics schedule, timesheet and HR compliance nodes synthesize into a verified ready state. Each role writes only to its own node and reads only what it is accountable for.

Scroll to see the full model

Graceful degradation over a brittle live dependency.

Finance requested a live API integration that locked the daily USD to naira rate at the exact moment of execution. I pushed back. Nigerian banking APIs time out under load, and an unintelligent fetch would freeze the entire run if the connection dropped. The system attempts the live rate, and if latency exceeds five seconds the UI transitions into an elevated manual input state with a two factor confirmation, so the pipeline never stalls on an external outage.

Readiness is not one number. Each team is measured on what it actually owns, and Finance is measured on everyone else.

HR is credentials and contracts. Operations is hours and deployment. Logistics is drivers, accommodation and travel. Switch the role and the definition of ready changes with it. A team can clear only its own gaps, everything else routes to the team that owns it and waits.

The failure moment moved. Gaps that used to surface at the gate now surface with days of runway, inside a normal working week.

Every point where a person touches a compliance record is a point where the record can be disputed. The old path had four of them. The new path has none.

Under the legacy model an instructor asserted attendance on paper, an administrator transcribed it, a coordinator compiled it, and someone assembled the export. Four human assertions, each one a place an auditor can ask how do you know, and each one a place the answer is because somebody wrote it down.

Scroll to see the full chain

Field operators demanded a manual override. If a scanner lost power, they wanted to check trainees in by hand so a class would not be delayed.

It is a reasonable request and the operational logic is sound. I rejected it. Giving a human the ability to override the hardware destroys the cryptographic trust of the final government audit, because a record that can be entered by hand is a record that can be disputed by hand. One override button makes every record in the system a claim rather than a fact. We traded physical operational convenience for absolute digital integrity.

An immutable chain of custody, enforced by systemic constraint rather than by policy or training.

The constraint is the product. A rule that says do not enter attendance by hand is a policy and gets broken under pressure. A system with no field to enter it in is an architecture, and it holds on the worst day of the programme, which is the only day that matters to an auditor.

The defining challenge was enforcing digital rigidity in a chaotic physical environment, and holding it when the people closest to the chaos asked me not to.

The override would have made the product easier to use and impossible to defend. Refusing it meant accepting that on some days the system would be inconvenient, and that inconvenience is the visible cost of a record nobody can argue with.