Built, operated, reconsidered.
UNDER THE
SURFACE.
A system diagram shows the connections.
These are the decisions underneath them.
Platform engineering / Architecture & implementation
Different clouds.
One way to ship.
The friction
More teams meant more deployment scripts, console changes, and coordination. The platform needed a delivery path that stayed understandable as it grew.
My contribution
I designed a multi-tenant GitOps platform across EKS and GKE, with tenant quotas, network policies, promotion pipelines, and operational readiness in the templates.
The decision that matters
Standardize the delivery contract. Keep the cloud-specific tradeoffs visible.
Inside the implementation
- Tenant-aware namespaces with resource quotas and network policies.
- Promotion pipelines that account for blast radius before production.
- Logging, metrics, and SLO definitions embedded in deployment templates.
The operational differences between clouds still matter. A consistent delivery path should make those differences explicit, rather than pretend they don’t exist.
Identity & tenancy / Architecture & migration
Own the boundary.
Not just the login.
The friction
B2B multi-tenancy, enterprise SSO, and fine-grained permissions were pushing beyond the existing managed identity setup.
My contribution
I led the architecture and migration from AWS Cognito to ORY, separating authentication, OAuth2 token flows, and relationship-based authorization.
The decision that matters
Make each boundary explicit, with clear ownership for the teams integrating with it.
Inside the implementation
- Modeled tenant boundaries and token flows across services.
- Built predictable self-service onboarding for application integrations.
- Used Keto for relationship-based access control.
Moving providers was one part of the work. Deciding where authentication ends, authorization begins, and product teams take responsibility was the more lasting part.
Reliability / Guardrails & operating practices
Make the safe path
the obvious one.
The friction
Manual review gates created delays, while operational expectations stayed disconnected from the way teams shipped.
My contribution
I embedded policy checks in CI, co-owned SLOs and incident runbooks with product teams, and recorded cost and reliability tradeoffs in ADRs.
The decision that matters
Put guardrails in the workflow. Put learning back into the next change.
Ongoing exploration / Not a production case study
What if the caller
isn’t a person?
I’m exploring how autonomous workflows should act on behalf of users, with scoped identity and isolated execution.
What has to be true before an agent is allowed to act?
An illustrated sequence / Simulation
From request to execution.
- 01RequestAgent asks to act
- 02AuthorizeCheck the relationship
- 03ExecuteIsolate the workload
- 04Clean upEnd the execution
Ready. Follow a scoped request through the boundary.
Illustrative only. No real tokens, infrastructure, or workloads are created.
Your system probably has
an interesting boundary, too.