Architecture, security and reliability for tool-using AI agents in regulated businesses: banks, payments, insurers and anyone whose agents touch production.
Least-privilege tool access. Agents bound to enterprise identity rather than shared keys. Audit trails a risk team can read. Threat models for prompt injection, tool poisoning and the agent supply chain, done before the agent meets a real system.
Durable execution for long-running agents: retries, idempotency, human approval steps and waits that survive a crash. Evals, tracing and token budgets so the system stays measurable and affordable.
MCP servers and gateways, agent orchestration, cloud, CI/CD and observability, built by someone who has kept backend and payments systems running in production for twenty years.
Senior eyes on an agent design before it reaches production: boundaries, identity, failure modes and blast radius.
Rolling out coding agents across an engineering team with the guardrails that make them safe to use: scoped access, review gates, and evidence of what they changed.
No hand-offs. The person who designs your agent's boundary is the person who has run systems like it before, and who answers for it afterwards.
Idempotency, reconciliation, audit, least privilege. The disciplines of regulated money, applied to systems where an agent can act on its own.
Evals, traces and audit logs ship with the design, so your risk team can see what the agent did and why, rather than take anyone's word for it.
Reference implementations and write-ups are published as they are ready, so you can read the code before you hire the author.
An issue-to-PR coding agent driven by durable workflows, calling tools through an MCP gateway under enterprise-issued identity, with evals and traces as the evidence.
Security reviews of widely used open-source MCP servers, with responsible disclosure and published findings.
Short, specific notes on agent authorisation, durable execution and evals, written from the reference work rather than from the marketing.
Code and notes land at github.com/stacktician.
What the agent can touch, who it acts as, and what the worst case looks like. Written down before anything is built.
Identity, least-privilege tools, approval points and audit. The unglamorous decisions that decide everything later.
Durable workflows, evals in CI and traces from the first commit, so every claim about the agent has a number behind it.
Red-team the agent before production does: injected instructions, poisoned tools, runaway loops. Fix what breaks, then re-run.
Docs, runbooks and the measurements your risk and audit teams will ask for, in the shape they will ask for them.
A short note is enough. Replies within one business day, usually with questions worth answering.
UK-based, working remotely and on site. Code at github.com/stacktician.