Practice area

Guardrails belong in the architecture, not in a binder.

Compliance is cheap to satisfy while a system is being designed and punishing to retrofit afterwards. The difference between those two costs is most of what this practice is for.

This is the unglamorous layer: who may do what, on what basis, with what evidence. Done properly it is invisible until an auditor, a regulator or an incident asks a question — and then it answers in minutes instead of weeks.

  • 12

    bounded services deciding what is allowed, why, and who approved it

  • 94%

    coverage on 1,849 tests, live-verified weekly against production tenants

  • SOC 2

    controls that emit their own evidence, so the audit is a query rather than an event

What I do here

A decision that emits its own evidence A request reaches a policy decision point, which returns allow or deny and, on the same path, appends a tamper-evident record of who asked, what was decided, on what authority and when. Because every decision writes its own record, an audit becomes a query against that chain rather than an evidence-gathering exercise. Request Policy decision policy-as-code Allow / deny emitted on the same path Append-only evidence chain who asked · what was decided · on what authority · when hash-linked
Nobody assembles this afterwards. The record is a by-product of the decision, which is what turns an audit from an event into a query.

Policy as code

OPA and Rego, with authorization decided at field and object level rather than at the endpoint. The point is not that policy lives in a repository — it is that a rule change is reviewable, testable and attributable, which a spreadsheet of permissions never is.

Consent and jurisdiction

Consent ledgering, jurisdictional rule layering, and auditable conflict resolution when two jurisdictions disagree. Legal-grade receipts carry the policy version that produced them, so a decision made last March can still be explained next March.

Tamper-evident audit

Hash-chained, immutable decision ledgers. If you cannot prove what a record said last Tuesday, you do not have an audit trail — you have a log that someone could have edited, which is a different thing with the same name.

The obligations this work answers to — privacy, fair housing, data integrity, cybersecurity, SOC 2, ISO 27001 and 42001 — are set out on the methodology page, along with why each is an architecture decision rather than a policy sentence.

On the record

2025 – 2026

A compliance authority layer for regulated software

Twelve bounded services deciding what is allowed, why, and who approved it — field- and object-level authorization, consent ledgering, jurisdictional rule layering with auditable conflict resolution, legal-grade receipts with policy-version metadata, and immutable decision ledgers. The same policy boundary governs humans and AI agents, which is the property that makes autonomous action safe to permit at all.

2025 – 2026

Identity lifecycle and SOC 2 automation

Provisioning, entitlement and deprovisioning treated as a system rather than a ticket queue, with the control evidence generated as a by-product of the system running. An auditor tests whether controls operated over a period, not whether they exist today — so the useful design goal is a control that cannot operate without leaving a record.

“Orchestrating complex SaaS deliverables across a large development organization, he kept foundational choices such as test-driven design and system resilience tightly aligned with strict compliance requirements.”
Andrew W. Spangler · President & Chief Legal Officer — formerly General Counsel, Quext

This is one of four practices.

The same policy boundary that governs people is what makes autonomous agents safe to run at all — which is where the delivery practice starts.

Start a conversation See the whole practice How I work