Problem
Transaction-risk tools and account-security tools often inspect separate streams. A suspicious transfer can therefore miss the login context that makes an account-takeover pattern visible.
Back to selected work
Polyglot AI and security operations system
VaultWatch
Polyglot backend engineering, applied AI orchestration, security controls, event-driven integration and honest deployment boundaries.
Actual productVaultWatch
ArchitectureFour bounded services
ModesShowcase and full stack
DeliveryCross-language CI
BoundarySynthetic data only
01
Context and ownership
The problem, the decisions I owned and the boundary of my contribution.
My role
I designed and built the four-service architecture, shared event contracts, public showcase, deterministic replay path, integration workflow and cross-language CI around a synthetic-data-only boundary.
02
System and engineering decisions
A recruiter-readable map of the product path, followed by the implementation choices behind it.
01Rust risk engine and audit chain
02Go authentication and anomaly gateway
03Python agent orchestration and event fusion
04Next.js operations dashboard
Key product decisions
- Deterministic transaction rules and a statistical pre-filter before any model stage
- Tiered triage, tool-using investigation and synthetic compliance drafting
- Account-security event fusion for impossible-travel and brute-force signals
- Argon2id authentication with rotating refresh tokens and reuse detection
- Hash-chained audit records and a live reasoning trace
- Rust and Axum
- Go
- Python and FastAPI
- scikit-learn
- Anthropic SDK
- Next.js and TypeScript
- PostgreSQL
- Redis
- Docker Compose
- GitHub Actions
03
Verification and release boundary
How the build is checked, delivered and kept honest about what is production-ready.
Automated verification
- CI runs Rust formatting, Clippy and tests; Go build, vet and tests; Python Ruff and Pytest; and Next.js lint and build
- The public showcase falls back to deterministic replay when no Anthropic key is present
- A complete Docker Compose run verifies real HTTP calls across the service boundary
- Integration verification exposed and fixed a Postgres JSON-serialization defect and stale WebSocket cleanup
Deployment
The live Vercel showcase is a self-contained TypeScript port that uses the same event shapes and can run without secrets. The full Rust, Go, Python, Postgres, Redis and Next.js system runs through Docker Compose for review.
Security
Every account, identity, transaction and entity graph is synthetic. The system includes adaptive password hashing, rotating JWT refresh tokens, rate limits, anomaly detection and a tamper-evident audit mechanism.
04
Tradeoffs and next work
What remains incomplete is shown deliberately, because engineering judgment includes knowing what not to claim.
Current tradeoffs
Showcase-mode audit history is held in serverless-instance memory and demonstrates the mechanism rather than durable storage. Durable Postgres case history and the file-backed Rust audit chain belong to the full Docker Compose mode.
Next improvements
- Add a hosted full-stack environment with durable managed data stores
- Expand cross-service contract and failure-injection coverage
- Add traces and operational dashboards before any production-style rollout
What this proves