How I build and secure AI

Security first.

Most teams can demo AI. Almost nobody can put an agent in production they can actually trust. That gap is what I close. I sandbox what an agent can run, control what it can reach, and write every action to a tamper-evident record — so what your agents do stays contained, attributable, and provable after the fact. No business should have to choose between using AI and protecting what it holds.

Sandboxed execution

Agents run with bounded, deny-by-default permissions. Dangerous operations route through a single supervised boundary that fails closed: what an agent wasn't cleared to do, it can't do.

Controlled egress

An agent cannot reach anything you have not explicitly allowed. Data does not quietly leave.

Signed audit

Every action lands in a tamper-evident audit trail. If anyone alters the record, verification fails. You can prove what your AI did, after the fact, to anyone.

The substrate

The Polis Stack.

I don't sit on top of someone else's AI infrastructure. I built my own, end to end: a verified language, a supervised runtime, and a reasoning engine that shows its work.

Verifies.

Logos

A security-typed programming language, designed so entire categories of security bugs cannot exist by construction: a compiler that rejects insecure code outright instead of letting it fail in production.

What this means for you: it's the foundation I'm building the runtime toward, so security guarantees can be structural rather than bolted on afterward.

Supervises.

Diogenes

The runtime that wraps every AI agent I ship — the watchman that catches an agent the moment it tries to do something it shouldn't, before anything reaches your systems.

What this means for you: when an agent tries to write a file it doesn't own, call a tool it isn't cleared for, or gets tricked by user input, the operation fails closed. No quiet drift.

Reasons.

Heraclitus

A reasoning engine for tax and accounting work, grounded in the Internal Revenue Code and the CFR so answers come from the source text rather than a model's memory, with a deterministic verifier designed to re-derive claims instead of trusting them.

What this means for you: the goal isn't just an answer, it's an answer you can defend — every figure traceable to the rule behind it.
Why I built it

Off-the-shelf agent frameworks fail in predictable ways. Prompt injection slips through, audit logs get edited, agents call tools they shouldn't. The Polis Stack is my answer: own the substrate, verify the language, supervise the runtime, make claims re-derivable.

Regulated environments

The version your compliance team can say yes to.

AI inside a bank has to clear a higher bar: regulators, model risk teams, and auditors all need to know what it did and why. That's the bar I build to by default. If your team wants AI and your compliance department keeps saying no, this is the version they can say yes to.

I work with public-sector and financial teams on cybersecurity and AI assurance, from full builds to focused engagements. Repositories and published research available on request. Security contact: security.txt