Notes from the work
Writing
Practical notes on cloud platforms, security boundaries, AI agents in production, and the decisions behind reliable systems.
Subscribe via RSS2026
- Agentic engineering in production starts with boundaries
A practical way to decide where an agent belongs, which tools it can use, what needs approval, and how to evaluate the whole workflow.
- Migrating forty apps from AWS EKS to OCI OKE without downtime
How we moved about forty applications and twenty databases from AWS EKS to OCI OKE across ten teams, and what the migration actually cost in planning.
- What fractional CTO work actually looks like: four companies, four very different problems
Four fractional CTO engagements: healthcare SOC 2 readiness, a travel-sector AI assistant, manufacturing GDPR remediation, and media operations on AWS EKS.
What I’m writing about next
Drawn from recent work. Subscribe via RSS to get them as they land.
Platforms
- Ten minutes to fifty seconds: what shared control planes changed
- Cross-cloud Flannel over WireGuard: self-healing instead of debugging by hand
- One Helm chart for ten apps, and when it stops working
Boundaries
- Your RAG filter is an authorization layer
- Fail-closed middleware for delegated admin
- Prove cross-tenant denial in CI, not just login
Agents in practice
- Running a fleet of coding agents without a merge war
- Security-reviewing every AI-written change
- Rules first, model second: a local judge for Kubernetes incidents
CTO judgment
- Pay only after it can be made: gating expensive AI generation
- Characterization tests before you move the numbers
- Cutting over a live SaaS without sending every email twice