Architecture decisions and honest trade-offs from building capability-bound infrastructure for regulated organizations. No marketing claims without evidence.
9 August 2026
Hand-testing our own step-up flow: cancel Touch ID, cancel the authenticator app, take the emailed code — and the sensitive action goes through. Assurance levels didn't catch it, because all three factors carry the same label on paper. Where the fix actually lives, and the three costs of closing it.
26 July 2026
Of compromised machines, 59% are CI/CD runners — not laptops. Secrets that leak routinely stay usable for years. Guarding standing credentials harder doesn't move the target off the hottest machine. The structural fix is nothing stealable left on the runner between runs.
19 July 2026
You can lock every network path down to the mesh — SSH, RDP, every static port closed. But if that's the only door and it dies, you're locked out. "Break-glass" means two opposite things: a provider-side way back in is a backdoor wearing a friendly label; the honest one lives on an out-of-band plane you own. Why the escape hatch has to be yours — and the cost of doing it right.
12 July 2026
Ankayma is on the App Store. An iPhone can now join the mesh as a first-class node: resolve private domains, open internal services with real TLS and no public port, and SSH into production from an in-app terminal — with no key file anywhere in the chain. Why a Secure Enclave key beats the file in ~/.ssh, and the honest list of what doesn't work yet.
4 July 2026
Almost every pipeline eventually accumulates a long-lived deploy secret — and long-lived secrets leak at industrial scale. The structural fix isn't guarding the secret harder; it's per-run ephemeral identity with an immutable access log. And when an AI agent runs the deploy, the honest question isn't "will it get fooled" but "what can a fooled run reach, and can I prove what it did."
27 June 2026
Holding your own key closes one door — the provider reading your data at rest. It leaves a second open: who controls the next signed client update. Why "we can't read your data" is the middle of the security conversation, not the end — and the diagnostic question that tells you which.
19 June 2026
You cannot have both "the provider can never read my data" and a recovery button only they can press — one of those is false. Why a provider-side recovery path is a backdoor wearing a friendly label, and what honest, customer-controlled recovery actually costs.
17 June 2026
Does your obligation constrain where the data sits, or who is technically able to read it? Most fintech systems are built on the weaker reading while the contract promises the stronger one — and the gap stays invisible until an auditor asks you to prove which one you have.