Skills
AI & agents:
Claude, GPT, Gemini and Grok APIs (structured outputs, prompt
caching, PDF and document understanding), Claude Code (custom skills,
subagents, Remote Control, review loops), Model Context Protocol
(Figma, GitHub, Azure DevOps, Todoist), hybrid rule-engine + LLM
design, Deepgram speech-to-text, cost governance and evaluation
Azure & AWS cloud:
App Service, Front Door + WAF, Cosmos DB, Service Bus, Key Vault,
Static Web Apps, Entra ID, Communication Services; AWS
IaC & CI/CD:
Terraform, Ansible, Docker & Docker Compose, Kubernetes, Azure
Pipelines, GitHub Actions, OIDC and managed identities, PM2, Caddy,
Linux, mobile release automation (TestFlight, Google Play)
Product & data:
TypeScript, Python, Dart; Next.js, NestJS, Hono, Flutter, Expo /
React Native, Electron; PostgreSQL (Drizzle, Prisma), MongoDB /
Cosmos DB, MSSQL; Prefect, dbt, Power BI
Security & compliance:
OAuth2 / OIDC, MFA, RBAC, immutable audit trails, envelope
encryption, ISO 27001 practices, Law 25 / PIPEDA, Anti-Racism Act,
2017 (identity-based data collection), WCAG 2.1 AA
How I govern AI in production
Contracts, not text:
structured outputs validated against a schema on every call; the
model fills a locator, the rendering layer owns the document.
Cost and model policy:
prompt caching, token and cost accounting per file, a model chosen
per task (Opus for document extraction, Haiku for explanations).
Privacy by construction:
de-identification at the source, no identifiers in prompts, an
immutable audit log on every access to sensitive data.
Humans where it counts:
mandatory review before anything leaves the organisation, and two
things I refuse to automate: promotion to production and validation
of the business act (pharmacist, proposal reviewer).
Regulated ground:
AI and data platforms under Law 25 / PIPEDA and provincial standards
for Ontario education (13 school boards under the Anti-Racism Act,
2017), Quebec community pharmacy,
non-profits and international funders: RBAC, envelope encryption,
WCAG 2.1 AA, ISO 27001 practices.
A harness, not trust:
development agents work in an isolated worktree, never see secrets
or production data, can only merge to the dev branch, stop on
command, and every change is a reviewed pull request in the client's
own git history.
Read the guarantees →
