Platform Engineering
Internal Developer Platforms, golden paths, and supply-chain security.
Articles
Identity is the New Perimeter: Cognito for Private AI Workloads
Network boundaries don't scope LLM access. Use AWS Cognito groups and strict IAM with session tags so only the right employee can invoke the right model.
AI Code Review Is Not Enough: Why Delivery Guardrails Matter
AI code review helps find issues, but delivery guardrails such as CI gates, tests, scanning, policy checks, and rollout controls are still required.
Supply Chain Security in GitHub Actions: Stopping the Next SolarWinds
Use SBOMs, pinned actions, and signed commits in GitHub Actions to guarantee code provenance from commit to container — the cheap version of supply-chain security.
SBOM-Based Security for GitHub Repositories
Use Syft, Grype, SBOM generation, vulnerability scanning, and remediation reports to make GitHub repository security measurable and repeatable.
Your IDP is Actually a Compliance Engine
Don't sell Internal Developer Platforms as 'making devs happy'. Sell them as 'making auditors happy' by forcing standardised golden paths.