Notes on security compliance, AI systems, storage and the craft of leading engineering work.
The bookmarks I actually reuse — prompt patterns, repositories, MCP servers and a model shortlist. A snapshot, not a ranking.
If shipping is stressful every time, the problem is structural.
A scanner that reports everything reports nothing. Triage design matters more than coverage.
Everyone talks about remediating findings. Almost nobody talks about the work of deciding what counts as a finding in the first place.
Most zero-trust programmes stall in the same place, and it is not the technology.
A deployment failure sat open for over two weeks. What actually broke it loose says something specific about where agents are useful.
Encoding a control is an act of interpretation. Pretending otherwise is how audits go badly.
The industry treats storage as infrastructure plumbing. The actual constraints are as sharp as anything in distributed systems.
The 'digital coworker' framing predicts the wrong failures.
Steady state hides everything. A cutover hides nothing.
The fastest way to help is often the least useful.
When a RAG system disappoints, the model is rarely the reason.
Redundancy is not free, and the bill arrives at the worst time.
The technical judgement did not stop mattering. It changed what it was for.
I love to make complex looking systems easy to understand — whether it is life or software!