Writing
Write-ups of systems I actually built and that are actually running — the architecture, the decisions, and the parts that were wrong. Nothing here is a tutorial for something I haven't shipped. Where a claim rests on vendor behaviour, the vendor's own documentation is quoted and linked, so you can check it in two minutes rather than take my word for it.
Two pieces so far, written as a pair. They cover the two halves of one governed AI gateway: issuing per-consumer credentials safely, and attributing what those consumers cost.
-
writing/key-provisioning
Your key-provisioning service should not be able to read the keys it issues
Almost every provisioning system holds a read-secrets permission "for recovery," and then protects the keys with encryption at rest. That's a control, and controls get stepped around. Removing the permission changes the capability instead — and forces staged envelopes, a pinned write ordering, and a failure path that means two opposite things depending on the status code.
-
writing/cost-attribution
Cloud billing resolves to a resource. Your consumers don't.
Your cloud bill has no dimension for a team. Your gateway telemetry has no dollars. Building the join is one equality on a subscription id, and everything around it is where the mistakes are — including four I made in my own cost math, one of which is still open.