Practice 02 · Governance & compliance engineering
Guardrails belong in the architecture, not in a binder.
Compliance is cheap to satisfy while a system is being designed and punishing to retrofit afterwards. The difference between those two costs is most of what this practice is for.
-
12
bounded services deciding what is allowed, why, and who approved it
-
94%
coverage on 1,849 tests, live-verified weekly against production tenants
-
SOC 2
controls that emit their own evidence, so the audit is a query rather than an event
What I do here
This is the unglamorous layer.
Who may do what, on what basis, with what evidence. Done properly it is invisible until an auditor, a regulator or an incident asks a question — and then it answers in minutes instead of weeks.
-
Policy as code
OPA and Rego, with authorization decided at field and object level rather than at the endpoint. The point is not that policy lives in a repository — it is that a rule change is reviewable, testable and attributable, which a spreadsheet of permissions never is.
-
Consent and jurisdiction
Consent ledgering, jurisdictional rule layering, and auditable conflict resolution when two jurisdictions disagree. Legal-grade receipts carry the policy version that produced them, so a decision made last March can still be explained next March.
-
Tamper-evident audit
Hash-chained, immutable decision ledgers. If you cannot prove what a record said last Tuesday, you do not have an audit trail — you have a log that someone could have edited, which is a different thing with the same name.
The obligations this work answers to — privacy, fair housing, data integrity, cybersecurity, SOC 2, ISO 27001 and 42001 — are set out on the methodology page, along with why each is an architecture decision rather than a policy sentence.
“Orchestrating complex SaaS deliverables across a large development organization, he kept foundational choices such as test-driven design and system resilience tightly aligned with strict compliance requirements.”
On the record
Recent work in this practice, newest first.
-
2025 – 2026
A compliance authority layer for regulated software
Twelve bounded services deciding what is allowed, why, and who approved it — field- and object-level authorization, consent ledgering, jurisdictional rule layering with auditable conflict resolution, legal-grade receipts with policy-version metadata, and immutable decision ledgers. The same policy boundary governs humans and AI agents, which is the property that makes autonomous action safe to permit at all.
-
2025 – 2026
Identity lifecycle and SOC 2 automation
Provisioning, entitlement and deprovisioning treated as a system rather than a ticket queue, with the control evidence generated as a by-product of the system running. An auditor tests whether controls operated over a period, not whether they exist today — so the useful design goal is a control that cannot operate without leaving a record.
One of four practices
The boundary that governs people is what makes agents safe to run.
Autonomous agents are only safe to run at all because the same policy boundary governs them — which is where the delivery practice starts.