In early May, Andrew and Julie showed me RITA, a transcript evaluation tool for college admissions readers. The demo was genuinely good. It parsed real high school transcripts, normalized them against school context, and produced rigor ratings that Julie, a career admissions expert, stood behind.
Then Andrew said the sentence that defined the next two months: they were afraid to use transcripts they hadn’t manually scrubbed.
That sentence is the whole job. The AI worked. But a tool that processes minors’ education records and can’t demonstrate FERPA-grade handling of them isn’t a product. It’s a liability with a demo. The hard AI problem was mostly solved. What was missing was the body the brain could safely live in.
I joined as technical cofounder to build that body. What follows is what that turned out to mean, because “taking over a project” is a phrase people use loosely, and I want to show its actual anatomy. Five altitudes. One story from each.
Compliance, as architecture
The first move was a single evening: audit the generated codebase, move it into a repo I controlled, and cut the AI-gateway middleman out of the call path. A compliance decision as much as a technical one, because every intermediary touching student data is another vendor in the FERPA subprocessor chain. By the end of that night, local dev ran on one command, CI was green, hosting was live, and a fully synthetic test student existed so no real record ever needed to enter a dev environment.
Then I built compliance as a system instead of surviving it as a checklist: a four-table tracker (requirements, evidence, notes, subprocessors) seeded with 61 FERPA requirements across nine categories, and an audit of the actual code against them, with one explicit rule: don’t trust the project’s own documentation, which I already knew had drifted.
The audit found the thing that justifies the whole approach. The storage policies on the transcript file bucket were applied to the public role, with no tenant scoping. Anyone holding the app’s publishable key, which every browser session holds, could in principle read any transcript, at any institution. Invisible in normal use. Catastrophic in an incident.
Scoring the requirements by lane made the company’s real position legible for the first time: engineering at 69%, legal at 5%, operational at 0%. That one chart moved the founders’ conversation from “are we compliant?”, which is unanswerable, to “three lanes, three owners, here’s each gap.” I shipped the engineering fixes in a focused pass and closed the hole.
The principle became company law: FERPA is the first lens on any new vendor, data flow, or integration. Not a checkbox at the end. And it turned generative: the compliance review produced an actual product feature, a read-only Partner Security role that lets a university’s own IT staff audit everything and change nothing.
Ontology, or: what is this thing, actually
Preparing to walk the founders through the system, I hit a question the codebase had never answered. Two tables both claimed to encode “what we know about this applicant.” The review interface read from one and wrote to the other. The obvious framing: redundant tables, merge them.
The better framing: these were two different kinds of thing wearing confusing names. One was a unit of work: evaluate this student, in this batch, right now. The other was the applicant’s evaluation history over time. So instead of bringing the team “should we merge these tables,” I brought: before we redesign anything, we need to agree on what an applicant record is.
The diagram for that conversation carried one pointed addition: a box labeled “FERPA inquiry,” with arrows into both tables. When a university asks “show me everything you have on applicant X,” the honest answer currently required querying both. Architecture problem and legal exposure, in one picture.
The renaming became a formal program: every noun, role, and verb on the platform, twenty-six signed-off decisions in the first round, executed as real database migrations. A single overloaded verb un-collapsed into three: Flag (ask your own team), Raise Ticket (tell us), Get Help (self-serve). Sitting with the word revealed three different relationships with three different audiences.
The most valuable design work on RITA happened away from the screens: diagnosing what the system believed about the world, finding where those beliefs were wrong or unnamed, and renaming reality until the software could be honest about it.
Architecture, as values
With the objects named, I rebuilt the data core: running beside v1, sharing nothing mutable with it, gated behind its own routes. The constraint was absolute: v1 keeps running untouched until v2 is provably better. Partly engineering prudence, partly leadership. Julie’s reading judgment is encoded in v1, and v2 was framed to her from the start as additive to her work, never a replacement of it.
The new model’s heart is a flat table where each row is one course detection, split explicitly into what the parser read (immutable), what it thought (correctable), and what the reviewer decided (an override layer that never mutates the detection underneath). When a reviewer catches that “Adv Topics in Calc” at this particular school means their AP, and overrides it, the system remembers both what the machine believed and why the human disagreed. Provenance at the atomic level: the audit trail a university will eventually demand, and the raw material for the product ever getting smarter.
One threshold in this system is an ethical position. Matching applicants across sources, a false merge silently corrupts two students’ records; a false split creates a visible duplicate a reader resolves in one click. So the match thresholds are conservative by law: in admissions, false merge is worse than false split, and that asymmetry is written into a number.
The same instinct runs through the rest: computed values derived at read time, never baked; reparses that supersede old data rather than delete it, because history is evidence; and a Common App export parsed client-side, in the browser, as a FERPA redaction step: rows full of data about students who aren’t even applicants never reach our servers at all.
Surface
The visual redesign began with subtraction. Strip the theme to nothing; every override must earn its place against a real rendered surface. That pass turned “the app feels off” into a structural fact: the codebase was hand-correcting the component library’s density on nearly every node.
Then the language itself. RITA’s competitors, and RITA’s own v1, look like SaaS dashboards: cards, pills, badges, cool grays, the visual vocabulary of metrics. But a reader isn’t monitoring metrics. She’s reading a document about a person. So the design moved from dashboard to dossier: a serif for identity and the numerals, warm paper that’s never pure white, hairline rules instead of cards, ledger rows instead of list items.
- .hero__confetti { … }one line; the whole philosophy.
The system has laws, not vibes. Ochre is identity; indigo is interaction; never the reverse, so the eye always knows “notable” from “clickable.” Zeros render as faint middots so attention lands only on real signal. No emoji, no gamification, no confetti. Literally: I found and deleted a CSS class named hero__confetti. One line of code that is also the entire brand philosophy. The users are professionals doing consequential work at 11pm, and the product’s job is to be calm.
And the part that argues design is not decoration: the redesign found data bugs. Making the scoring legible surfaced mapping ambiguities that had been invisible in the old UI. When information is honestly presented, dishonest data has nowhere to hide.
Method
All of it was built one way: design first, code last. Verbal sketches, persona narratives, live mocks critiqued against real data, and only then build instructions, executed through AI coding agents under discipline I’d defend as the actual craft. Every prompt carries an out-of-scope list, stop conditions, and a done checklist. Architectural and security-critical work routes to a stronger model; mechanical spec-execution to a faster one. Code is the source of truth and documents drift. I eventually deleted the project’s own internal bible rather than let it keep misleading humans and agents alike. Agents’ self-reports on destructive operations get independently verified, always. No agent touches the repo directly; every change runs through me.
Even the design system was written for two audiences: future human contributors, and the AI agents who will otherwise reproduce the old aesthetic forever, because “match existing patterns” points straight at it. A design system in 2026 has two readers, and only one of them is human.
The result, honestly measured: one person operating as CTO, sole engineer, security auditor, compliance drafter, design-system author, brand designer, and product lead, at a pace that would traditionally take a small team, without the wheels coming off. The discipline is why the wheels stayed on.
What shipped, honestly
Shipped: the migration, the security remediation, the v2 detection pipeline, the dossier across nine surfaces, the brand mark, staging and CI/CD with migration gates, the marketing site, the vocabulary decisions, a 58-rule inventory of the scoring rubric. Designed but not yet built: the multi-transcript diffing system, the rubric re-authoring, the export layer. In flight: the pilot contract, at the first university’s general counsel, with positive reception.
RITA goes live with real applicant volume this fall.
The claim this piece is making is small and specific: the same values (calm, honest, legible, deferential to professional judgment) run from the database column names to the favicon, because the same person held every altitude. That coherence is what I mean by taking over a project.