Skills
AI & agents:
Claude, GPT, Gemini and Grok APIs (structured outputs, prompt
caching, PDF and document understanding), Claude Code (custom skills,
subagents, Remote Control, review loops), Model Context Protocol
(Figma, GitHub, Azure DevOps, Todoist), model-proposed plans with
tested verification, Deepgram speech-to-text, cost governance and
evaluation
Azure & AWS cloud:
App Service, Front Door + WAF, Cosmos DB, Service Bus, Key Vault,
Static Web Apps, Entra ID, Communication Services; AWS
IaC & CI/CD:
Terraform, Ansible, Docker & Docker Compose, Kubernetes, Azure
Pipelines, GitHub Actions, OIDC and managed identities, PM2, Caddy,
Linux, mobile release automation (TestFlight, Google Play)
Product & data:
TypeScript, Python, Dart; Next.js, NestJS, Hono, Flutter, Expo /
React Native, Electron; PostgreSQL (Drizzle, Prisma), MongoDB /
Cosmos DB, MSSQL; Prefect, dbt, Power BI
Security & compliance:
OAuth2 / OIDC, MFA, RBAC, immutable audit trails, envelope
encryption, ISO 27001 practices, Law 25 / PIPEDA, Anti-Racism Act,
2017 (identity-based data collection), WCAG 2.1 AA
How I govern AI in production
Contracts, not text:
structured outputs validated against a schema on every call; the
model fills a locator, the rendering layer owns the document.
Cost and model policy:
prompt caching, token and cost accounting per file, a model chosen
per task, and a tested verifier between the model and the human.
Privacy by construction:
de-identification at the source, no identifiers in prompts, an
immutable audit log on every access to sensitive data.
Humans where it counts:
mandatory review before anything leaves the organisation, and two
things I refuse to automate: promotion to production and validation
of the business act (pharmacist, proposal reviewer).
Regulated ground:
AI and data platforms under Law 25 / PIPEDA and provincial standards
for Ontario education (13 school boards under the Anti-Racism Act,
2017), Quebec community pharmacy,
non-profits and international funders: RBAC, envelope encryption,
WCAG 2.1 AA, ISO 27001 practices.
A harness, not trust:
development agents work in an isolated worktree, never see secrets
or production data, can only merge to the dev branch, stop on
command, and every change is a reviewed pull request in the client's
own git history.
Read the guarantees →
