I design systems from first principles and direct AI to build them. I took PANTHEON — a governed, multi-tenant AI-agent platform — from idea to production, solo: the substrate, a no-code product on top, and the adversarial audit that hardened it. I don't hand-write code. What I bring is the systems thinking (multi-tenant isolation, a governed agent loop, atomic metering, failure-mode design) and the discipline to make AI-built systems actually hold. Built alongside full-time work outside software. Looking for a founding-builder, 0-to-1, or AI-native role where output and systems judgment beat pedigree.
How I build
What I doDesign systems from first principles → decompose into buildable pieces → direct AI to implement → adversarially verify → ship and run in production
Concepts I commandMulti-tenant isolation & trust boundaries, governance tiers & human-in-the-loop, atomic metering & rate control, agent loops / tools / guardrails, prompt-injection defence, failure-mode & blast-radius thinking
Systems I've shippedPostgres with row-level security, FastAPI services, a governed agent loop, MCP (both directions), React frontends, Docker / nginx deploys — directed the build, understand each end-to-end, don't hand-write the syntax
Keeping AI honestCI purity boundaries, golden-file snapshot tests, 1,455 tests green, repeated adversarial audits where every finding is refuted before it counts
PANTHEON — creator, solo
Governed multi-tenant AI-agent platform · designed the system, directed the build
Dec 2025 – present
Live in production · pantheonlabs.info & pantheonlabs.co.uk
- Isolation that survives composition — I designed strict multi-tenant isolation on Postgres row-level security (two-role,
FORCE + NOBYPASSRLS): a shared tool called by tenant B runs under B's scope, never the owner's. Repeated adversarial audits couldn't cross it.
- A governed agent loop, not prompt-glue — my design: perceive → knowledge → tools → judge → meter, with guardrails, a crisis protocol, overdraft-proof atomic metering, and human-approval gates for consequential (tier-3) actions.
- A no-code Studio product — turns a sentence into a themed, customisable website with bespoke generative art and a governed assistant live on web and Telegram — WhatsApp built, pending Meta approval. Idea to production, solo.
- Adversarial quality discipline — repeated self-run adversarial audits — a 50-agent audit and a 14-lens re-audit, latest — where every finding was refuted before it counted, then fixed; 1,455 tests; a golden-file snapshot harness; an undoable edit ledger.
Selected problems I solved
- Diagnosed and killed a quadratic JSON-LD import DoS — a crafted 2 MB page froze the gateway for 70s; redesigned to a bounded linear scan, 70s → 4ms.
- Designed overdraft-proof metering via atomic check-and-decrement (
UPDATE … SET credits = credits - n WHERE credits >= n); a turn deflected to a crisis resource is refunded.
- Made safety beat the metric — a person in crisis reaches help even at zero credits, because the crisis check runs before billing on every surface.
Open source
Self-contained, Apache-2.0 primitives extracted from PANTHEON — each one a single verifiable guarantee, not application-level hope:
- pantheon-credit-ledger — overdraft-proof metering over Postgres (~150 lines): 100 parallel charges against a balance of 50 → exactly 50 succeed; exactly-once billing under Stripe-webhook replays; tenant isolation via row-level security.
- pantheon-ssrf-guard — a two-layer SSRF egress guard that survives DNS rebinding: it re-checks the IP the socket actually reached at connect time, so a host that resolves public then rebinds to an internal address (cloud metadata, loopback) is refused.
- pantheon-tool-sanitizer — strips tool-protocol markup and Unicode smuggling (invisible / bidi / Tags-block characters, fake tool-call markup, multi-line smuggling) from untrusted MCP tool text before it reaches an agent's system prompt — a covert-channel control, honestly scoped: it doesn't claim to stop plain-prose injection, which is an architecture problem, not a string one.
- pantheon-rls — tenant isolation as a Postgres guarantee: force-RLS + least-privilege grants so the database itself refuses cross-tenant reads/writes, fail-closed (no tenant context → zero rows, never all rows).
- pantheon-ical — round-trip iCal (RFC 5545) read and write for booking calendars in under 200 lines, with RRULE recurrence anchored to the live window so an established rule can't silently leave future dates un-blocked.
Background
I studied Financial Mathematics at the University of Greenwich, London, until the pandemic cut it short — that's where I learned to reason about systems from first principles. No CS degree; I'm self-taught as a builder, and the live, attackable system is the qualification. I spent the two years before PANTHEON deep in distributed, trustless systems (the Ethereum ecosystem, from 2019) — that's where "don't trust, verify" became the principle behind everything I build. I've self-hosted on Linux since 2020 (a Raspberry Pi homelab) — that's why I can deploy and run PANTHEON in production solo. I designed and built PANTHEON alongside full-time work outside software (most recently as a care worker). Available on request: a live walkthrough of the running system, a code review under NDA, and references.