Writing
Field notes
On production reliability, audits, and operating AI-built systems.
Featured
What I look for first when I open a production system
Five days inside a system I have never seen. The checks are familiar. The judgment is what to inspect first, what to leave unread, and why.
Read →-
From LinkedIn · · 1 min
The release button lives somewhere else
Some teams keep prompts in a separate service, and the application loads whichever version is marked production. Marking another version as production changes the assistant without a code deploy.
-
From LinkedIn · · 1 min
The assignment is signed
A company has a development-agency agreement and a signed IP assignment. In the repository, a contributor identity appears on work the supplied records do not connect to that agency. The review ends with one specific open item.
-
From LinkedIn · · 1 min
The assumptions the code was built on
A passing test establishes that the code did what the test expected. Whether the test expected the right thing is a separate question, and a review works in that gap until each assumption is supported, contradicted, or unresolved.
-
From LinkedIn · · illustrated · 1 min
Who wrote the record
Separate columns for who acted and whose account they acted on do not say who fills them. If the application can change the identity before writing the event, a mistake in that code can reach the audit log too.
-
From LinkedIn · · 1 min
Whose identity survives into the audit log
A support agent opens a record inside somebody else's account. Two identities are in play, the event row has one column for it, and whichever one the application holds at that moment is what gets written.
-
From LinkedIn · · illustrated · 1 min
The boundary is what all of them say at once
Nobody opens a pull request called Widen tenant access. They open three reasonable ones instead, each gets its own policy, and PostgreSQL combines permissive policies with OR.
-
From LinkedIn · · 1 min
Two files are not two sources of evidence
AI can write the code and the tests from the same prompt. That produces two files. Independence comes from a source that can disagree with the implementation.
-
From LinkedIn · · 1 min
Human in the loop is a box on a diagram
The log shows an approval. It doesn't prove a decision was made. A real control leaves evidence of disagreement, and most of them never have.
-
From LinkedIn · · 1 min
Permissions look like settings
Permissions don't look like decisions when you make them. They look like settings. What the next owner inherits is every grant, and almost none of the reasons behind it.
-
From LinkedIn · · 1 min
The sixth category
Five categories had nowhere to file the same recurring risk. The sixth asks a different question: can the company transfer what it says it owns, and what makes it worth owning once it does?
-
From LinkedIn · · 1 min
What buyers see that founders don't
The code transfers at a sale. The reasons don't. What a founder experiences as knowing their system, a buyer prices as risk.
-
From LinkedIn · · 8 slides · 2 min
5 signs your production system needs an audit
An audit is not for a system that is broken. It is for a system that still works, for reasons nobody can fully state. Five signs you have crossed that line.
-
From LinkedIn · · 1 min
An audit is not a bug hunt
Most serious production risk is not a broken thing. It is a permission someone granted years ago and nobody revisited. An audit maps trust, not bugs.
-
From LinkedIn · · 1 min
Later is me
What 'we'll add tests later' actually means once 'later' arrives. Tests are not a code-quality bonus. They are the only honest proof that a system behaves the way the team thinks it behaves.
-
From LinkedIn · · illustrated · 2 min
Anatomy of a P0
Most production outages are boring. They hide in the part of the system nobody looks at because it has always just worked. The anatomy of one.
-
Field note · · 1 min
The backup you have never restored is not a backup
A backup nobody has restored is a hypothesis. Until the restore runs against a clock, you do not have a recovery plan. You have a setting.
-
Field note · · 1 min
Temporary admin credentials are permanent
The access that was widened once for a deploy and never narrowed is the access an attacker eventually finds. Temporary is the most expensive word in an auth model.
-
Field note · · 1 min
Most SaaS auth fails after login, not at it
Teams pour effort into proving who you are. The breach is almost always in what you are allowed to do once you are in. Authentication is the door. Authorization is the building.
-
From LinkedIn · · 1 min
3 patterns I find in 80% of early-stage backends
Most early-stage backends break in the same three places, and they stay invisible until something goes wrong: credentials in git, auth by accident, and backups nobody has restored.
-
From LinkedIn · · 1 min
What does 'something you can rely on' actually mean?
'We have something we can rely on' sounds clean. It is also vague. The five things that have to be true before a system earns the word reliable.
-
From LinkedIn · · 10 slides · 1 min
From audit to pause: when stopping is the right call
I was brought in to audit a system that had been 'in development' for nine months. In five days we mapped it, found the risks, and the right call was to stop.