I work in GRC — governance, risk & compliance (I'm a CISA)
I'm especially interested in where AI meets compliance: using AI fluently as a builder, while staying clear-eyed about where it belongs in a regulated system — and where it absolutely doesn't.
🛡️ Aegis — deterministic compliance-evidence platform
FedRAMP High + SOC 2 evidence automation for GCP. Continuously collects immutable (WORM) control evidence and proves its own completeness — so an auditor can sample instead of re-verifying the collector. Verdicts are pure functions; zero LLM in the runtime, on purpose.
GRC that runs as code — the control is demonstrated, not asserted.
Python · GCP · BigQuery · OSCAL · SOC 2 · FedRAMP
🤖 Aegis Sentinel — agentic GRC engineering
The agentic complement to Aegis: control checks run by agents, but every check emits a deterministic, auditable verdict record — and test agents exercise and validate the compliance agents themselves. Built on the Janus scaffold, so the repo learns from its own sessions.
Agents do the legwork; pure-function verdicts keep the decision provable.
Python · Claude Code · Agentic AI · GRC engineering
✍️ Intent IDE — human-in-the-loop AI document review
Scoped AI agents make targeted, auditable, human-approved edits instead of regenerating whole documents. A multi-agent debate system counters LLM sycophancy, and every AI action writes an append-only audit record aligned with EU AI Act Articles 12 & 14.
AI governance in practice — auditability and human control designed in.
TypeScript · Next.js · LLMs · AI governance
🔁 Janus — self-improving project scaffold
A Claude Code starter template that learns from its own sessions and passes
lessons to the projects it spawns.
Shell · Developer tooling
How I think: determinism over vibes · auditability by default · humans in control of AI · tests that prove the thing.
📫 Let's talk — LinkedIn 🎧 Off the clock, I make music as Drifthaven (Spotify · SoundCloud)