Two kinds of writing from the work itself. Teardowns take a real misconfiguration apart: how attackers find it, what they reach, how to fix it. Blueprints explain how modern defenses are actually built, in plain English.
What becomes possible when the boundary comes first: a person asks for work in plain words, an agent does it in a machine that exists only for that session, everything it touches belongs to somebody, and the record shows what happened. The five planes, two worked flows, and where to start.
Read the blueprint
Every containment control is a fence built around a runtime that defaults to yes. WebAssembly inverts that, but it does not remove the problem so much as force it into writing, and the places it leaks are worth knowing before you bet an architecture on it.
Read the blueprint
Everyone is putting agents in sandboxes. Most of the machinery being written about today will be obsolete in two years. Here are the properties that will not be, and a public harness that tells you whether your sandbox enforces them.
Read the blueprint
Bind a powerful role to the anonymous identity and any request with no credentials can read every secret and run any workload. Here is the attack, the fix, and the one command that tells you where your own cluster stands.
Read the teardown
An AI agent has no boundary between the instructions you gave it and the text it reads. Anything it reads can try to become an instruction. Here is the model in plain English, why filtering does not fix it, and the gates that actually hold.
Read the blueprint
S3 buckets are private by default, so a public one is a wrong setting left on by accident. Here is how anyone downloads the data, how to find every public bucket you own, and the one setting that stops it.
Read the teardown
Deleting a leaked AWS key from your code does not remove it. Here is how attackers find keys in git history, what one key exposes, and the three fixes that actually work.
Read the teardown
Zero trust is not a product you buy. It is one idea: stop trusting the network, and check every request instead. Here is the whole model in one diagram, in plain English, and where to actually start.
Read the blueprint