Andrew Bolaji

Not the model. The guardrails. It cannot book a slot it has not verified, and it cannot quote a price it was not given. When it is unsure it escalates to a human with a summary, because an agent that confidently invents an appointment is worse than no agent at all.

The gate holds after the model is compromised. In red-team testing a poisoned document convinced the assistant to send an email, and it genuinely tried. The email never went, because tools with real-world effects cannot execute themselves — they return a single-use token that only a human confirmation redeems. Detection eventually fails against an attacker with unlimited attempts. That is the argument for putting the control underneath it rather than in front of it.

Bad data fails the build, not the dashboard. Data-quality and freshness tests run inline with the transformation, so a failing test stops downstream models from materialising. Stale numbers never reach a screen someone is about to make a decision from. The copilot follows the same rule from the other direction: it refuses to answer on stale data rather than guessing, and its limits live in a read-only database role instead of in the prompt — so even a fully manipulated model cannot reach a raw record.

Stripe Connect defaults to automatic daily payouts. Build escrow on top without changing that and Stripe quietly pays out on its own schedule, bypassing your hold entirely. Setting the connected account to manual payouts is the single load-bearing config in the whole system. Miss it and the escrow is theater.

Hard DELETE is blocked at the database level. Not discouraged, blocked. A compliance record you can destroy is not a compliance record. Public form IPs are SHA-256 hashed, check-in photos are EXIF-stripped in the browser so GPS never reaches the server, and every anonymous endpoint runs through a function that whitelists the exact fields it can return.

The paywall is enforced on the server, not in the UI. A Cloud Function strips premium fields out of the response for non-members, so a modified client cannot unlock paid content. One vote per user is enforced at the database layer for the same reason. Anything you can bypass in DevTools was never really enforced.

Cloud Functions fire at least once, not exactly once, so I never increment the vote counters. They are recomputed from ground truth and set to an absolute value, which makes every write idempotent under duplicate triggers and out-of-order events. A privilege escalation hole in the security rules was also caught and closed in review.