Isaac Teague Frayling

AI-native builder · systems design + AI orchestration

Cardiff, UK · UK citizen, open to relocate worldwide · isaac@pantheonlabs.co.uk · pantheonlabs.co.uk · github.com/Igfray · pantheonlabs.co.uk/evidence.html

I design systems from first principles and direct AI to build them. I took PANTHEON: a governed, multi-tenant AI-agent platform, from idea to production, solo: the substrate, a no-code product on top, and the adversarial audit that hardened it. I don't hand-write code. What I bring is the systems thinking (multi-tenant isolation, a governed agent loop, atomic metering, failure-mode design) and the discipline to make AI-built systems actually hold. Built alongside full-time work outside software. Looking for a founding-builder, 0-to-1, or AI-native role where output and systems judgment beat pedigree.

How I build

What I doDesign systems from first principles → decompose into buildable pieces → direct AI to implement → adversarially verify → ship and run in production Concepts I commandMulti-tenant isolation & trust boundaries, governance tiers & human-in-the-loop, atomic metering & rate control, agent loops / tools / guardrails, prompt-injection defence, failure-mode & blast-radius thinking Systems I've shippedPostgres with row-level security, FastAPI services, a governed agent loop, MCP (both directions), React frontends, Docker / nginx deploys, directed the build, understand each end-to-end, don't hand-write the syntax Keeping AI honestCI purity boundaries, golden-file snapshot tests, 3,389 tests passing (CI, 2026-10-01), repeated adversarial audits where every finding is refuted before it counts

PANTHEON, creator, solo

Governed multi-tenant AI-agent platform · designed the system, directed the build

Dec 2025 – present

Live in production · pantheonlabs.info & pantheonlabs.co.uk

Isolation that survives composition
- Strict multi-tenant isolation on Postgres row-level security, two roles (FORCE + NOBYPASSRLS).
- A shared tool called by tenant B runs under B's scope, never the owner's.
- No audit has got through the database policy; one leak outside it (chat history) was found and fixed.
A governed agent loop, not prompt-glue
- My design: perceive → knowledge → tools → judge → meter.
- Guardrails, a crisis protocol and overdraft-proof atomic metering.
- Human-approval gates for consequential (tier-3) actions.
A no-code Studio product
- Turns a sentence into a themed, customisable website with bespoke generative art and a governed assistant.
- Live on web and Telegram; WhatsApp built, pending Meta approval. Idea to production, solo.
Adversarial quality discipline
- Repeated self-run adversarial audits (a 50-agent audit, then a 14-lens re-audit): every finding refuted before it counted, then fixed.
- 3,389 tests (CI, 2026-10-01), a golden-file snapshot harness, an undoable edit ledger.

Selected problems I solved

Diagnosed and killed a quadratic JSON-LD import DoS: a crafted 2 MB page froze the gateway for 70s; redesigned to a bounded linear scan, 70s → 4ms.
Designed overdraft-proof metering via atomic check-and-decrement (UPDATE … SET credits = credits - n WHERE credits >= n); a turn deflected to a crisis resource is refunded.
Made safety beat the metric: a person in crisis reaches help even at zero credits, because the crisis check runs before billing on every surface.

Open source

Six self-contained, Apache-2.0 primitives extracted from PANTHEON and published, each a single verifiable guarantee (overdraft-proof metering, an SSRF guard that survives DNS rebinding, tool-text sanitising, guardrails, Postgres tenant isolation, iCal round-trip): github.com/Igfray.

Security research

Credited reporter (one of seven) on CVE-2026-104850 (GHSA-6qxp-vccf-f47h), a high-severity advisory (CVSS 7.5) in the MCP TypeScript SDK: its OAuth client could send stored credentials to an authorization server chosen by the MCP server. Fixed in 1.31.0 and 2.2.0.

Background

Financial Mathematics, University of Greenwich, London, until the pandemic cut it short: where I learned to reason about systems from first principles. No CS degree; I'm self-taught as a builder, and the live, attackable system is the qualification.
Distributed, trustless systems (the Ethereum ecosystem, from 2019): where "don't trust, verify" became the principle behind everything I build.
Self-hosted on Linux since 2020 (a Raspberry Pi homelab): why I can deploy and run PANTHEON in production solo.
Care work: I designed and built PANTHEON alongside full-time work outside software, most recently as a care worker.

Available on request: a live walkthrough of the running system, a code review under NDA, and references.