Vibe coding for CHROs in professional services.
A law, accounting or consulting firm CHRO runs an up-or-out talent model where staffing happens by engagement and the review cycle feeds the partnership vote. The tension is that every people record here is also a client record: an associate's hours are a performance signal and a client bill, and the matters they worked on are confidential to clients who may be on opposite sides of an ethical wall.
What is true about software in professional services before you write a prompt.
Agencies, consultancies, law firms and accounting practices sell time and expertise, and most of their software is a compromise: the practice management system, the time tracker, the client portal that nobody likes. Executives at these firms are building their own: a client dashboard, a proposal generator, an intake workflow, a utilisation report. Every one holds client confidential information.
Client confidentiality is the business
A tool that lets one client see another's project, or exposes a document to the wrong staff member, ends a relationship and possibly a licence. Access control per client is the first thing to build and the first thing to check.
The engagement letter has terms about data
Clients often specify where their data may be stored and who may process it. A tool on a personal hosting account in the wrong region breaches contracts the firm signed.
Billing must reconcile
Time, rates, expenses and invoices have to agree with the accounting system. A utilisation tool or a billing dashboard that drifts from the books causes arguments with clients and auditors.
Professional rules apply to software
Legal privilege, accounting standards and industry codes constrain how records are kept and who may access them. The tool has to fit those rules, not the other way round.
What a CHRO in professional services builds first.
01The staffing and availability board
Who is on which engagement until when, their skills, bar admissions or CPA licence and their roll-off date from the practice management system, so the staffing partner stops asking the whole floor by email.
02The partner track review packet
Utilisation, realisation and engagement feedback pulled per associate for each review cycle, calibrated by practice group, with the partnership materials held so tightly that even the associate's own practice head cannot open a rival group's packet.
03The CLE and CPE compliance tracker
Continuing education hours by jurisdiction, reporting deadlines and licence renewals per professional, because a lawyer or accountant who misses a reporting period cannot sign work, and the firm finds out from the client.
CHROs in every industry tend to build the same four things. The CHRO page has that list.
Client matters leak through the people record
The staffing board and the review packets list the matters and clients each associate worked on, and the AI stores them as plain text in the HR database with firm-wide read access. An associate screened off a matter under an ethical wall can now see it and who is working on it. That is a conflicts breach, and the remedy the other side asks for is disqualifying the firm from the matter.
The pattern underneath is the one every CHRO hits: the dashboard has no login, or a login with no permissions, and the pay equity view is one URL away from the whole company. This is the most common failure in HR tools built fast.
What a safe build in professional services usually runs on.
Builds run on a standard web stack with Postgres, private document storage, single sign-on for staff and a scoped client login, and integrations with the practice management, time and accounting systems through read-only keys where possible. Client-facing pages are separated from internal ones from the start.
What changes for a CHRO in professional services.
A CTO in your corner treats people data as what it is: the most sensitive data in the building. Every tool gets a real login with roles, so managers see their team and nobody sees pay they should not. Sensitive records go where the rules say, with a way to delete them. Access granted is access revoked. You still build the tools your team needs. Nobody's salary ends up in a screenshot.
What CHROs in professional services ask.
A CTO who has read professional services apps before yours.
Thirty minutes, free, no card. What you built, what is going on with it, whether we can help.
In your corner.