Identity as operating structure
Access is not just a ticket queue. Roles, secrets, reviews, federation, and exceptions decide how work moves. Worth naming before it becomes folklore.
Systems engineer · Builder · Operator
I make messy systems easier to understand, operate, and trust.
I'm an infrastructure and security engineer working across identity, cloud, and the operational side of AI. By night I run a Kubernetes homelab like production and write about the decisions behind it.
the background is live. move your cursor, click near a node the background is live. tap near a node
clusternominal
agents12+ running
gitops300+ PRs merged
ports forwardedzero
last incidentdocumented
- Boring wins
- The best incident is the one nobody has to retell at 9 AM.
- Access is policy
- Who can do what is not admin trivia. It is the real org chart.
- Automation needs brakes
- A script is not done until the failure path is obvious.
- The lab keeps me honest
- Ideas sound better before they meet logs, disks, and time.
Signal
The work is systems engineering. The medium changes.
Some days the system is an identity tenant. Some days it is a network closet. Some days it is an AI workflow that got ambitious overnight. The pattern is the same: reduce ambiguity, make ownership visible, and leave a map. There is a longer version of this philosophy on my blog; I call it the Architect vs. the Slumlord.
AI, pilot to platform
I have been the enterprise-AI integration seat at a global financial firm since 2024: the first Copilot proof of concept, then enablement, then agent governance, cost controls, and the data connectors that make it useful.
Automation the next person can run
Automation should save attention, not create work nobody can explain. The test is simple: can the next person operate it without a walkthrough from me?
The numbers
0years enterprise infra
0availability operated
0endpoints managed
0countries
0continents supported
0lab PRs merged
The lab
The lab is where my claims have to run.
These are working systems, not props: GitOps, encrypted secrets, backups, runbooks, and a written postmortem when something breaks in an interesting way. I keep the repositories private by design. If you want receipts, ask, and I will walk you through them.
Home infrastructure
Talos Kubernetes Homelab
Immutable Talos Linux with no SSH surface, every change through Git (300+ merged pull requests), secrets encrypted in the repo, monitoring, backups, and public ingress with zero forwarded ports.
300+ PRs of auditable change history · zero forwarded ports · restore drill passed
Read the Talos buildOpenClaw
More than a dozen agents on the open-source platform run as real infrastructure on my cluster: persistent workspaces, an execution policy with WIP caps, and Mission Control, the task-state dashboard I built as a sidecar. The demo is easy. The operating model is the product.
a dozen-plus agents in daily operation · audited across six failure modes with cost + latency telemetry
Read the OpenClaw build
Personal intelligence
Life Hub
A personal operating picture run like a service: twenty-odd collectors on a cadence, personal baselines instead of hardcoded thresholds, and triggers that open action items. Nine AI advisors interpret the results, and their disagreements are usually the most useful signal.
in daily use · advisor consensus auto-escalates to action items
Read the Life Hub build
Memory layer
Life Hub Brain
Durable context, semantic search, and AI-accessible memory on pgvector. It feeds a wider practice: 4,000+ interlinked notes operated by more than eighty custom Claude Code skills. Not a demo; it runs my week.
4,000+ interlinked notes retrievable by agents over MCP · survived one full rebuild
Read the Life Hub Brain buildFailure modes
Problems I keep collecting.
I don't list employer names or confidential details here. What I can share is the shape of the work: the kinds of knots I keep getting asked to untie.
The access maze
People need in, controls need to hold, and nobody wants the exception path to become the real policy. I have run this maze for an enterprise tenant of nearly two thousand people.
The migration with receipts
Moving the workload is the visible part. The real work is naming dependencies, costs, owners, rollback paths, with the FinOps wiring to prove what it cost afterward.
Where software meets walls
The digital plan still has to survive the physical building. The record so far: offices on three continents, and about a hundred conference rooms.
The fleet without a hero
3,000+ endpoints across 19 countries, paid for itself in documented automation savings, twice. Glamour is expensive when something breaks.
The agent that meets the regulator
Data boundaries, third-party review, loss-prevention coverage, hard spend controls. Anyone can build a bot. Building one that survives a regulator is the job.
The incident afterlife
The fix is not the finish line. Decided is not installed. Ambiguous ownership is deferred work dressed up as consensus.
Footprint
The work ships to real buildings.
The digital plan still has to survive the physical building. Here is where mine has survived, in broad strokes.
offices on three continents · about a hundred conference rooms · one operating model
Field notes
Notes from the parts I had to learn by running them.
I write about the systems I actually run. The long tail after launch is where a system either earns trust or loses it, and it's where most of my learning has come from.
AI systemsI Built 9 AI Advisors That Argue About My Life DataWhat happens when a dashboard stops reporting and starts arguing.
PredictionTeaching My Dashboard to Predict, Not Just ReportMaking the dashboard earn its screen time.
ArchitectureTeaching My Dashboard to Think Across ModulesThe pattern is context sharing. The trap is pretending modules talk when they do not.
DeliveryFrom 10-Minute CI to Instant DeploysLess waiting, tighter feedback, fewer excuses.
AgentsBuilding a 9-Agent AI Team on KubernetesAgent demos are cheap. Agent operations are where the work starts.
ArchiveRead more at NaviauxLabThe field notes live there.
Contact
Let's build something that holds.
Hiring, a project, or just a hard problem to compare notes on: if it touches AI deployment in a regulated environment, identity plumbing, or platform operations that have to hold, I want to hear about it. Rough edges and half-formed questions welcome. And if you think I got something wrong on this site, tell me that too.