Identity & Access Management · AI Agent Security · Security Operations
I secure AI agents, and I use AI agents to secure identity.
- I'm a security practitioner focused on identity: who and what gets access, to what, for how long, and how you prove it to an auditor.
- My focus is non-human identity: giving AI agents and service accounts their own identity, a human owner, least privilege, approval for risky actions, and a full audit trail.
- I build controls, then attack them. Every bypass I find goes into a journal along with how I fixed it.
- I'm starting an MS in Cybersecurity at Georgia Tech in January 2027.
| Principle | Where it shows up in my work |
|---|---|
| Least privilege | The agent's AWS IAM policy can invoke one model and nothing else |
| Separation of duties | The AI agent proposes a purchase; a separate policy engine decides |
| Zero trust for inputs | LLM output and tool results are treated as untrusted, even from internal feeds |
| Defense in depth | Three independent layers: the agent, a Decider 2B guardrail, deterministic rules |
| Fail closed | Deny by default: unknown vendors, unknown categories and malformed amounts are blocked |
| Threat modeling | Prompt injection and excessive agency (OWASP LLM Top 10), business email compromise |
| Detection & response | Every guardrail verdict is recorded with a reason and confidence scores, so it can be sent to a SIEM |
| Adversarial testing | Found and fixed bypasses: NaN, true, and fraction-of-a-cent amounts |
AI Agent Spend Gate: your AI agent has a company card. Here's what keeps it honest.
flowchart LR
A["🤖 Agent<br/>Amazon Bedrock<br/><i>proposes</i>"] --> B["🧠 Decider 2B<br/>guardrail<br/><i>is it honest?</i>"]
B --> C["🛂 Spend Gate<br/>Python rules<br/><i>is it allowed?</i>"]
C --> D["💳 Order"]
B -. "unsure" .-> H["🙋 Human"]
C -. "over limit" .-> H
- Three layers of control. The LLM proposes, Strands Decider 2B checks honesty (grounded, injected, mislabeled), and a deny-by-default rules engine decides permission.
- Models can add friction, never approve. Only the deterministic rules, or a human, can say yes to spending money.
- Built for prompt injection. A poisoned note in a tool result tells the agent to buy $450 of gift cards and file them as office supplies. The rules alone would approve that lie. The guardrail catches it and denies it before the tool runs.
- Calibrated confidence. Uncertain calls go to a human, not to a guess.
- Reusable
#guardrailspattern that works with any Strands agent. - I break my own controls. The build journal records every bypass I found, like a
nanamount that slipped past every rule, and how I fixed it.
Working with
Learning now
-6E7781?style=flat-square){kind=icon}
-6E7781?style=flat-square){kind=icon}
Least privilege for people, machines, and agents. 🔐