How I work
Four positions I actually hold, each with the work that taught me it and a link to the write-up.
I’m an AI systems engineer in Australia. I work on the backend of AI systems that touch real company data, in Go, Python, Kubernetes and AWS. The part I’m usually handed is the part that has to be trusted: delegated access to someone’s mail and documents, retrieval over a corpus nobody has audited, or the measurement that decides whether an optimisation is worth shipping at all.
Four positions I hold about doing that, each with the specific thing that taught me it. Three of them come from the same build, which is its own point: a long project teaches you more than four short ones.
Remove the mechanism rather than tighten the heuristic
When a system had a pattern-matcher deciding which tool parameter should receive an OAuth token, its failure mode was writing a credential somewhere the model could read it. The available fix was a better pattern list. The right fix was noticing the token was already travelling as an HTTP header, and deleting the parameter path entirely.
A guessing mechanism whose worst case is credential misplacement shouldn’t be made more accurate.
Written up in: Giving an AI assistant real access to a company's data
Verify a migration by using the feature, not by checking the count
Encrypting 437 existing records is easy to declare finished: the count flips, the inverse query returns zero. Neither proves the data is still usable. The check that mattered was sending a follow-up message in a migrated conversation and confirming the assistant still remembered what had happened in it.
The same write-up: the migration section
Say what a control does and doesn’t do
Prompt injection is not solved at the model layer, by anyone. A confirmation gate is a blast-radius control. Injected content can still get an assistant to propose an action; it just can’t click the button. Describing that as a solution would have been the beginning of an incident.
The same goes for what a feature surfaces. An assistant that can’t exceed anyone’s permissions still makes an over-shared document trivially findable. That’s worth naming at handover rather than in a postmortem.
The gate itself is running on the front page, where it declines on its own if you leave it alone. Silence is a no.
The same write-up: the confirmation gate
Measure, then delete what never fires
I built an intent-detection layer to force certain tools into a model’s context. Instrumented in real use, its threshold never fired once. The similarity ranking underneath was already doing the job. So I removed my own component and reduced the tool count further.
The design I could defend was smaller than the one I’d built.
Written up in: The thirty-thousand-token tax on asking what time it is
What’s on this site, and what isn’t
The case studies are written from real professional engineering, which means they are all generalised. Withheld throughout: client names, product and system names, identifiers, endpoints, configuration, and anything that would let you work out whose data any of it touched.
Not withheld: the engineering. The failure modes, the reasoning, the measurements, and the designs I deleted on their own evidence. Every figure on this site is one I measured. Where I couldn’t measure something, the page says so rather than rounding it into a claim. Anything drawn as a bar, a track or a grid of cells is drawn to scale from those counts, which is also why most of the cards carry a number and no drawing: a figure with no denominator has nothing to draw.
Getting in touch
Currently: backend and platform engineering on AI systems that handle real company data. Go, Python, Vue, MongoDB, Kubernetes, AWS. Open to contract and advisory work.