$ ls -la ./work

Projects & production systems

Saviynt systems are internal. Shown here through numbers and write-ups. Personal work links out to code. Full technical write-ups under /blog.
$ ./audit_desk — you are the auditor

Load a case, or build a suspect by hand. Then run the check. The same logic scans 100,000+ accounts in production in about two seconds.

01 · load a case file
02 · or assemble a suspect. Subject: EMP-1147, finance
engine output
awaiting run — load a case, assemble a suspect, then hit run.
huge enterprise production run: compute ~2s on 100K+ accounts, same violations as legacy · end-to-end minutes with writes · published with director approval
$ ls ./production

Production systems

01 · LICENSE INTELLIGENCErecommendation engine

License waste, found and priced

Companies pay SAP per user, priced by access level. Most quietly overpay for dormant accounts and over-privileged users. I built the recommendation engine that finds this waste: findings computed live from the search index at request time, priced in dollars, acted on through one action call that fans out into removal tasks with de-duplication. Action records live on the identity document and survive the nightly data replacement through merge/strip/prune. Validated 51/51 against live APIs in test, through two rounds of senior review; a test tenant showed seven findings worth about $11,000 a year. Test result, not a production savings claim — the dollar math scales with estate size.

JavaSpring BootKafka AvroOpenSearch
02 · COMPLIANCE ENGINE~20h → mins

A day-long audit check, rebuilt to minutes

Large companies must continuously prove that no employee holds conflicting permissions. For example, the ability to both create and approve the same payment. For one large enterprise production workload, this check took about 20 hours at 65 GB because the old system re-examined the organization hierarchy separately for every rule. I rebuilt the engine to resolve the hierarchy once and compare permissions with bit-level operations. The redesigned path runs in a few minutes under about 1 GB, with matching violations across the rollout comparisons. Worst-case production scope, not a lab benchmark.

JavaRaw JDBCBitSetOpenSearch
03 · DATA EXPORT5 MiB buffer · v2.0.0

Excel exports that stream to S3

Audit and compliance teams periodically need complete data exports as formatted Excel workbooks in S3. The previous exporter assembled entire workbooks in memory and crashed on large reports. I built s3-outputstream, an Apache-2.0 Java OutputStream over S3 multipart with one reusable 5 MiB part buffer: an upload publishes only when the producer declares success, otherwise it is discarded. v2.0.0 is on Maven Central with a real-S3 conformance receipt. Bounded application buffering, not bounded total process memory — producer, SDK and per-part overhead are separate budgets.

JavaPOI SXSSFS3 multipartZIP streaming
04 · DATA INGESTIONordered · replayable

Audit records you can count on

Every privileged action on the platform becomes an audit record. Who accessed what, and when. These records feed fraud review and regulatory audits, so the ingestion path uses ordered, replayable streams with duplicate-proof storage: publish first, mark after, merge rather than replace on refresh. Throughput and tenant counts stay out of this description until measured on a defined workload and cleared for disclosure.

KafkaAvroMySQLRedis
05 · AI SAFETY5 patterns · deterministic

The same fraud check, for AI agents

Companies now build AI assistants that hold tools, data access, and login credentials. These assistants can call other assistants or share credentials with them. The dangerous permission combinations we police in humans quietly reappear, with no person in the loop. I formulated effective access for agents across five patterns — a single over-privileged agent, conflicts spanning agent and owner, delegation chains, credential-sharing groups, actions on a user's behalf — and built a deterministic evaluation engine where every finding cites its evidence and is tracked to resolution. Latency and deployment scope stay out until measured and cleared.

JavaSpring BootGraph analysisRaw JDBC
06 · AI MONITORING110 tests · 46/46 synthetic

AI investigators with mandatory evidence

The most sensitive accounts in a company are emergency 'break-glass' administrator accounts, and their activity logs are where insider fraud appears. I built bounded investigator agents that pursue one fraud hypothesis with strict budgets, with every cited event re-checked against source data and uncertain findings routed to humans. The public research harness holds 110 tests and matched all 46 held-out synthetic variants with no unsupported claims — control-flow evidence, not real-world accuracy. No customer or deployment language by policy.

PythonReActElasticsearchYAML policies
07 · SECURITYcoverage 30% → 80%

Company-wide security initiatives

Twice in my first year I was asked to join temporary, company-wide security teams addressing systemic issues. Categories of injection and access-control flaws found across services, encrypted internal communication between data systems, and test coverage on critical components, which rose from 30% to 80%. The work was unglamorous and cross-team by design. It prevents incidents rather than responding to them.

AppSecmTLSSAST/DASTTesting
$ ls ./ai-systems

AI systems

AI INFRASTRUCTURE

Send each request where its past already lives

less recomputation

When you continue a conversation with a large language model, the serving computers keep a cache of what came before, so follow-up questions avoid redoing work. But in a fleet of machines, a standard load balancer sends your follow-up to a random server, which recomputes everything. Nostos, a router I built, instead sends each request to the server whose cache already holds that conversation. It weighs cache overlap against queue length and memory load. It remembers fingerprints of past text, never the text itself, and passes responses through without buffering. A public demo lets you race routing strategies against each other.

GoRadix treesvLLM / TGIReact
LEARNING IN PUBLIC

A language model built by hand

no model libraries

To understand language models from the inside, I implemented a small one in PyTorch while deliberately refusing the framework's ready-made model components. Embeddings, attention, and decoder blocks all written out explicitly, each stage tested before the next. The model is tiny on purpose, so that internal quantities like the attention matrix stay small enough to read directly. Since ported to dependency-free C++17 as gpt2-cpp, with a five-test correctness harness. And since trained for real as lm-train: 0.818M params on Shakespeare, val loss 1.75.

PythonPyTorchTransformerspytest
LEARNING IN PUBLIC

The same model, one level deeper

in progress

Now the same transformer implemented directly in the graphics processor's own programming language, with every computation kernel written by hand. It starts from matrix multiplication checked against an ordinary CPU reference, moves through attention and normalization, and heads toward a full training run and an optimized attention variant benchmarked against PyTorch. The goal is a working understanding of how GPUs actually execute programs. Memory movement, parallel scheduling, occupancy. Not familiarity with an API, but with the machine. In progress; each phase must pass its tests before the next begins.

CUDAC++CPU referenceColab T4
$ ls ./open-source

Open source

$ beyond my own repos
❯s3-outputstream — the S3 streaming primitive the AWS toolkit never shippedshipped❯kirodotdev/KiroCrew● merged❯EleutherAI/lm-evaluation-harnesscontribution❯sgl-project/sglangcontribution❯opensearch-project/OpenSearch● merged❯opensearch-project/opensearch-gocontribution
$ ls ./college

College builds

Coursework-era builds, kept as-is. The habit predates the job titles. Rebuild it to learn it.

plus the full training archive behind the ratings. 400+ files, searchable: ~/dsa →