Open the case.
Follow the reasoning.
My projects, independent analyses and other systems worth examining. Each case makes the context, contribution and evidence explicit.
New research blueprints are AI-assisted drafts with methods and limitations, not completed experimental findings. Browse by topic below.
Why compliance belongs in data
A technical decision from AidenHR: when rules change, which part of the system should change?
The multi-tenant decision
Why onboarding the next institute should not require a new application deployment.
Does GitOps Reduce Configuration Drift?
GitOps can reconcile declared and actual state, but reconciliation alone does not prove that the desired state is correct. A useful evaluation separates unintended drift, approved exceptions and a controller restoring an obsolete configuration.
Kubernetes Autoscaling Under Bursty AI Workloads
CPU utilisation is not automatically a good proxy for queued inference work. The research question is which scaling signal keeps a defined service responsive without paying for unnecessary capacity.
Database Migration Rollback: When the Previous Release Cannot Return
An application rollback is not a safe recovery plan when the previous release cannot read the new database state. Compatibility is a relationship between versions, not a property of one deployment script.
Platform Engineering: Faster Delivery or Another Bottleneck?
A golden path is useful when it removes recurring work without making unusual but legitimate needs impossible. Adoption counts alone cannot show whether a platform improves delivery.
Observability Cost Versus Diagnostic Value
More telemetry is not the same as more useful evidence. The practical question is which retained signals help explain a known failure, and what each signal costs to collect and query.
Linux Hardening Versus Operational Friction
A hardening control needs an operating context. Restricting a service may reduce an exposure while also disrupting maintenance, backups or debugging; those consequences should be measured rather than treated as surprises.
When Kubernetes Is the Wrong Architecture
The smallest workable architecture can be the better decision for a bounded product. Kubernetes should earn its operational cost through requirements such as repeatable scheduling, isolation or scaling, not through familiarity with a fashionable tool.
CI Pipeline Speed Versus Defect Detection
A fast pipeline is valuable only if it retains the checks needed for the release decision. Test selection should be evaluated against missed defects, not just minutes saved.
Chaos Engineering for Small Teams
A small team can learn from controlled failure without creating a large chaos programme. The useful starting point is one service assumption and a recovery procedure that can be exercised safely.
What DORA Metrics Miss About Delivery
Delivery speed and stability describe important parts of software work, but they do not establish that the team delivered a useful product. Pair delivery measures with outcomes rather than replacing one with the other.
Does an SBOM Make Remediation Faster?
An inventory can speed dependency identification, but it does not resolve exploitability or upgrade compatibility. Remediation research should separate finding an affected component from deciding what to do about it.
Signed Builds, Untrusted Inputs
An authentic artifact can still contain unwanted behaviour if the build consumed unsafe inputs. Provenance helps explain how an artifact was produced; that evidence must be checked against a policy.
Secret Scanning and Exposure Duration
A detection event is not the end of an exposure. The important chain runs from introduction to discovery, revocation and confirmation that the old credential no longer works.
Least Privilege for GitHub Actions Deployments
Deployment permissions should match the job's responsibilities. A working pipeline with broad privileges proves task completion, not that the permission boundary is appropriate.
SOC Alert Fatigue: Signal Quality Before Alert Volume
Alert fatigue is partly a decision-quality problem: responders need to know which signals justify investigation. An alert count does not tell you whether the queue is actionable.
When Security Gates Encourage Unsafe Workarounds
A control that repeatedly blocks legitimate work may encourage informal exceptions. The question is whether a gate improves the release decision or merely moves the risk into an undocumented path.
Multi-Tenant Data Isolation Beyond Login
Tenant isolation must follow data through APIs, caches, exports and background work. Authentication at the front door cannot establish that every later operation uses the right tenant context.
Identity Boundaries for AI Agents
An agent's useful autonomy depends on the privileges of its tools. A narrowly worded prompt cannot substitute for a technically enforced access boundary.
Threat Modelling a Django AI Application
A threat model should follow data and authority, including retrieval documents, model calls and tool actions. The model is one component of the application, not the entire security boundary.
Incident Readiness Versus Policy Readiness
A written procedure matters when people can use it under uncertainty. Tabletop exercises expose unclear ownership and decision dependencies without requiring a live incident.
AI Citation Accuracy: Confident Answers, Incorrect Evidence
A plausible answer and a supporting citation are separate claims. Evaluate whether the cited passage supports the exact statement, including its qualifiers and context.
RAG Versus Long Context: A Controlled Comparison
Retrieval and long-context input make different selection decisions. Compare them for a fixed document collection instead of assuming that either architecture always wins.
Why AI Agents Fail on Long Workflows
A multi-step task can fail after several locally correct actions. Reliability depends on preserving state, recognising mistakes and recovering, not simply producing a convincing final response.
Human Approval Policies for AI Agents
Human review helps only when the reviewer sees enough information to make the right decision. Too many low-value prompts can dilute attention at the consequential moment.
AI Agent Memory: Learning or Repeating Mistakes?
Persistent memory can retain useful context and obsolete assumptions. Evaluate correction and deletion behaviour as carefully as recall of successful facts.
LLM Drift Versus Changing Workloads
A changed output distribution may reflect new users or documents rather than a changed model. Monitoring needs to separate model version, data distribution and task mix.
Small Models, Large Models and Routing Policies
A routing system is valuable when its selection cost and occasional wrong choice are outweighed by savings on acceptable answers. Average token price alone does not describe that tradeoff.
Structured Output Does Not Prove Correctness
Matching a schema establishes format, not the truth of the values inside it. A valid date, amount or category can still be incorrect for the source document.
LLM Observability Without Sensitive Logging
Reducing sensitive content in logs changes the evidence available for debugging. The design task is to preserve diagnostic context while limiting unnecessary exposure.
The Total Cost of Successful AI Automation
Successful automation can still be expensive when review, retries and maintenance are ignored. The relevant denominator is a business task completed to an agreed standard.
Claude Versus GPT for Ambiguous Requirements
A useful requirements assistant should expose assumptions rather than silently resolving every ambiguity. Compare models on what they clarify, omit and invent, not on polished formatting.
Claude Versus GPT for Linux Troubleshooting
A plausible troubleshooting command is not a verified diagnosis. Separate evidence gathering, causal explanation and proposed remediation in the evaluation.
Context Engineering Versus Prompt Rewriting
An improved prompt cannot supply evidence that the system never receives. Compare changes to instruction wording with changes to document selection and tool context.
Can Claude and GPT Detect Unsafe Deployment Plans?
Deployment review requires noticing specific assumptions about data, permissions and recovery. A generic warning list is less useful than identifying the exact unsafe step.
When Coding Agents Pass Tests but Miss Requirements
Tests can encode the wrong acceptance target or omit important behaviour. Evaluate agent-written code against independently defined requirements rather than its own test suite alone.
Claude Versus GPT for Research Source Fidelity
A research answer must preserve what a source actually establishes. Compare evidence fidelity separately from breadth, fluency and apparent confidence.
Reasoning Budget and Cost-Adjusted Task Success
Additional reasoning effort may help some tasks and add cost without benefit on others. The result should be evaluated per task class, not as a universal setting.
Prompt Caching Under Changing Context
Caching benefits depend on repeated eligible input, not simply on repeating a user's question. Measure workload patterns and cache behaviour rather than assuming the advertised mechanism matches every workflow.
Single-Agent Versus Multi-Agent Workflows
Additional agents create coordination work as well as parallel capacity. Compare final evidence quality and failure recovery alongside completion speed.
Tool Descriptions and Agent Failure Rates
Tool descriptions influence which operation an agent selects and what parameters it supplies. Descriptions should explain preconditions and consequences, not just the operation name.
AI Coding Speed and the Delivery Bottleneck
Faster coding can move work into review, testing or release queues without improving end-to-end delivery. Analyse the whole value stream before declaring a productivity gain.
Sprint Forecasting Under Uncertain Requirements
A forecast should describe uncertainty rather than pretend scope and capacity are fixed. Evaluate whether its range is calibrated against actual delivery.
The Dependency Cost of a Small Feature
Feature size at the interface can conceal changes to access, data, testing and release. A dependency map helps explain why the visible request is not the full delivery scope.
Why Risk Registers Miss Incidents
A register is useful when risks change decisions and ownership. A long list of generic entries can coexist with unexamined assumptions that later drive an incident.
AI Build Versus Buy with Maintenance Included
The comparison should include integration, review, migration and maintenance, not just development effort versus subscription cost. Control and portability are also decision criteria.
Can AI Improve a Product Requirements Document?
A better-looking document may still contain unsupported features or unresolved conflicts. Evaluate requirements quality against the actual discovery evidence.
Decision Logs and Institutional Memory
A decision record should help a later teammate reconstruct the context, rejected options and consequences. Storage alone does not make the reasoning retrievable.
Remote Team Delivery Without Surveillance
Visibility should concern commitments, dependencies and completed outcomes, not the amount of visible activity. A coordination system can expose blocked work without measuring every person's screen time.
Why AI Pilots Fail to Reach Production
A convincing demo may omit data ownership, evaluation, operations and maintenance. A pilot becomes a product only when those responsibilities have a workable home.
Agile Transformation Without Assuming the Answer
Start with the diagnosed workflow problem. Adopting ceremonies can add work without fixing unclear priorities, external dependencies or unstable demand.
Accurate Dashboards and Misleading Decisions
Correct numbers can mislead when definitions, denominators or visual scales are unclear. The study should measure interpretation and decisions, not just chart correctness.
AI Market Research and Repeated Claims
Repeated claims can look like corroboration even when all sources depend on one original statement. Evaluate source independence alongside relevance.
Brand Voice Consistency in AI-Assisted Content
A consistent tone is only part of a brand. Content must also preserve positioning, promises and factual boundaries across channels.
Attention Versus Trust in Technical Content
A memorable visual can attract attention without improving understanding or credibility. Evaluate what readers learn and believe, not simply whether they click.
LinkedIn Format Versus Message: A Controlled Plan
Format comparisons become misleading when one post also has a better topic or audience context. A cautious experiment tries to separate presentation from message while acknowledging feed variability.
Answer-First Writing and Research Nuance
A short answer can aid orientation while hiding uncertainty if it overstates the evidence. Compare concise openings that preserve conditions with openings that omit them.
AI Search Citations That Misrepresent the Source
Being cited is not the same as being represented accurately. An answer may link to a relevant page while extending its conclusion beyond the evidence.
Search Demand Versus Market Demand
People searching for a term are not automatically potential buyers. Market research needs to connect query interest with needs, budgets and actual decision behaviour.
AI Benchmark Reproducibility
A benchmark result depends on versions, prompts, tools and grading. Reproducibility requires those conditions to be documented, not just a published score.
Publishing Negative Results in AI Research
A failed hypothesis can be useful if the design was capable of observing the proposed effect. Explain what the result rules out and what remains unresolved.