I built an AI system that gives every person ownership of how they work.

It knows who you are and what you’re cleared to see. It knows everyone on the floor at once — what one person does is already where the next person needs it. It knows what needs you before you ask. It knows whether the moment wants a sentence, a built view, or a drafted action waiting on your approval. And it knows the one thing most AI doesn’t — when it doesn’t know — and says so instead of guessing.

David Waters
David Waters
Senior Lead Product Designer
Executive Director, Wells Fargo

Two worlds. One system that doesn’t care which.

Horizon Ops — Overview with Pulse Signals, pending approvals, and the Vernon AI assistant panel showing a multi-turn conversation
Horizon OpsMaker, checker, CFO — one system, three different products. Role doesn’t filter what you see; it drives what gets generated. Each person builds their own views and their own reports, and nothing the engine composes can cross what they’re cleared to see.
Vernon Health — Patient Alerts queue
Vernon HealthThe same generative engine on a hospital floor. It builds to a charge nurse the way it builds to a CFO — different world, identical architecture. Every user gets a system shaped to them, and none of them gets a template.

It understands roles, and tailors the experience to each.

Same kitchen, three plates.

Horizon Ops — Alex's load screen, Maker view

Alex · Maker

Horizon Ops — Sarah's load screen, Checker view

Sarah · Checker

Horizon Ops — Morgan's load screen, CFO view

Morgan · CFO

The person doing the work gets the working line. The person signing off gets what needs signing. The executive gets the picture. Nobody gets a template, and nobody gets served something they weren’t cleared for.

It reaches every role before anyone has to go looking.

In a good restaurant the customer, the server, and the kitchen aren’t three systems. They’re one ticket. What you order reaches the line; what the line says reaches your table.

Horizon Ops — Alex (Maker): Customer Portal Redesign opportunity signal

Alex · Maker

Horizon Ops — Sarah (Checker): the same Customer Portal Redesign opportunity signal

Sarah · Checker

This works the same way. Nobody had to file this or flag it — the system detected the same condition once and put it in front of both Alex and Sarah the moment it was relevant, each seeing it exactly as their role needs to.

Proposes, never executes

It drafts the action and hands you the pen.

It writes the letter, addresses the envelope, lays it on your desk — and does not lick the stamp.

Horizon Ops — Mass Action Trust Contract: two drafted actions queued for review, with an explicit won't-touch boundary, before Apply

Here’s what I’ll do, here’s what I’ll never touch, nothing moves until you say so.

The signature discipline

And when it shouldn’t answer, it doesn’t.

Most systems guess. This one looked at the data, found it genuinely didn’t support a verdict, and said so — then handed the decision back to the person. What each person sees is shaped by who they are and what they’re accountable for — the same discipline that earns trust in one moment personalizes every other one.

Governance ThroughputConfidence read ✦

Is our money stuck in queue?

$229,800
pending right now · $133,500 (2)

As it runs in Horizon Ops

There’s a moment every great mountain guide knows: two hundred meters from the summit, the weather turning, and looking at someone who’s dreamed of this for years. The average guide reads that person’s face. The great one reads the mountain — and turns everyone around. Anyone can lead you up on a clear day. The guide you trust with your life is the one who proved they’ll say not today when everything in you is aching to hear we’re close.

That’s the system I design. It climbs with you — carries what you can’t, points out what you’d miss, lets you set the pace. And when the signal turns, it doesn’t perform confidence to protect the mood. It says not today, not on this data — and hands the decision back to you. That refusal isn’t the system failing you.

It’s the system earning next season.

Why hybrid AI doesn’t exist yet.

Not in any holistic form — not in a production, publicly-accessible product. What we have are chatbots bolted onto applications that were never designed for them. Ask the same question four different ways and you get four different answers — on four different screens — because the system has no real idea what it’s supposed to build. There’s no strategic layer. No trust signals. No way to know whether what you’re looking at has earned the right to be believed.

This is a reality I refuse to accept. So I built the version that achieves it.

What I wanted the experience to become was simple to say and hard to build.

Vernon chat — Sarah asks 'Show me my high-priority tasks'
The resulting view — high-priority tasks, filtered and built on request

The vision, running.

Nobody asked me to build it. I built it anyway — my architecture.

AI agents doing the construction under my direction, on my own time.

And I failed. A lot. Every guardrail in this system exists because I hit the thing it now prevents. The honesty isn’t something I planned in; I earned it by failing into it. I just didn’t quit — each failure taught me the next piece — until the thing I’d been picturing actually ran.

I inspired and conceived Vantage becoming a real product inside a top-five U.S. bank’s Commercial & Investment Banking division, releasing this fall.

Think about the best dinner you’ve ever had out — not the food, the experience. The water glass that never ran empty but you never saw filled. A kitchen you never laid eyes on, moving as one with the person at your table. That’s what I design: deep AI capability and human judgment, orchestrated so you’re met exactly where you are — never handed certainty it doesn’t have, never left stranded. You don’t see the system. You just trust it.

Systems, not screens.

Underneath all of it is one real design system, not a set of similar-looking screens stitched together after the fact. The same components, the same structured user flows, the same conditional layouts — built once, applied seamlessly across two full Aurora Glass themes.

Same system. Different light.

Working Canvas 2 in Aurora Glass's light theme — design system validation tool, COMPLETE phase

Light theme

The same Working Canvas 2 component in Aurora Glass's dark theme — identical data, same COMPLETE phase

Dark theme

Where this came from.

Eighteen years building for people who are accountable for what the screen says. Fourteen of them inside one of the largest banks in the country — money moving between corporations, lending decisions, capital markets instruments. Before that: wealth management, healthcare, telecom operations. I started as a design engineer. I shipped what I drew, and I still do.

I can’t show you those screens. I can show you what they taught me.

Six industries · eighteen years

The domain changes. The accountability doesn't.

A wealth manager, a nurse scheduler, a payments operator, a bond trader. None of them are browsing. Every one of them signs their name to what the screen told them. I've designed for all of them, and the job was always the same: make the screen worth signing for.

Design engineer · 2008

Design that can't be built is a drawing.

I started by writing the code for the screens I designed. Eighteen years later I directed AI agents to build Horizon Ops the same way — because a design you can't get to run is a picture of a product, not a product. Everything in the demo runs.

Payments · 2012–2020

Trust is designed, not declared.

A "verified" badge is a claim. A number set in the right weight, in the right place, with its source beside it, is evidence. In banking you learn fast which one people actually believe, and it's never the badge. That's why nothing in this system wears a checkmark.

Capital markets

The system reads numbers. It never writes them.

A large language model writes every sentence in the demo app — and it will happily invent a figure if you let it. This one doesn't get the chance: it goes and gets the number from computation it can point to, then explains what it found. Think of a good analyst: they don't guess the balance, they pull it, then tell you what it means. The model here is only ever allowed to do the second part.

Fraud management · 2020

"Not enough signal" outlasts a guess.

Every operator I've ever designed for has been burned by a confident screen that was wrong. They remember it for years. They forgive "I don't know yet" in a day. You watched the system say it above. That instinct came from a decade of watching what confidence costs when it isn't earned.

What this is, and where it goes.

What it proves is bigger than what it currently runs. The architecture isn’t bound to a vertical or to the product underneath it — the same system handles a bank’s operations floor and a hospital’s patient alerts, and it would handle the next one the same way. Governance is what stands between enterprise AI and real adoption. This is what that looks like solved.

The door

Trust drives AI adoption.
A governed system earns it.

Thirty minutes, live. I’ll drive — banking, a hospital floor, or operations, your call. You’ll watch it take one question and hand back the finished thing — a built view, a drafted report, an action ready for your approval — shaped to whoever’s asking, across everything they’re cleared to see. Then you’ll see the guardrail: when the data can’t carry a call, it won’t fake one.