Andrew Bolaji

The gate holds after the model is compromised. In red-team testing a poisoned document convinced the assistant to send an email, and it genuinely tried. The email never went, because tools with real-world effects cannot execute themselves — they return a single-use token that only a human confirmation redeems. Detection eventually fails against an attacker with unlimited attempts. That is the argument for putting the control underneath it rather than in front of it.

Bad data fails the build, not the dashboard. Data-quality and freshness tests run inline with the transformation, so a failing test stops downstream models from materializing. Stale numbers never reach a screen someone is about to make a decision from. The copilot follows the same rule from the other direction: it refuses to answer on stale data rather than guessing, and its limits live in a read-only database role instead of in the prompt — so even a fully manipulated model cannot reach a raw record.

The first run failed, and the eval was wrong, not the agent. Back when the suite was 43 scenarios it scored 34, and three of the failures turned out to be false positives in my own scorer, including a regex that flagged “we don’t do landscaping” as an invented service. Trusting the scorecard would have meant fixing a prompt that was not broken. A harness you have not audited is just confidence with extra steps.

Stripe Connect defaults to automatic daily payouts. Build escrow on top without changing that and Stripe quietly pays out on its own schedule, bypassing your hold entirely. Setting the connected account to manual payouts is the single load-bearing config in the whole system. Miss it and the escrow is theater.

Hard DELETE is blocked at the database level. Not discouraged, blocked. A compliance record you can destroy is not a compliance record. Public form IPs are SHA-256 hashed, check-in photos are EXIF-stripped in the browser so GPS never reaches the server, and every anonymous endpoint runs through a function that whitelists the exact fields it can return.

The paywall is enforced on the server, not in the UI. A Cloud Function strips premium fields out of the response for non-members, so a modified client cannot unlock paid content. One vote per user is enforced at the database layer for the same reason. Anything you can bypass in DevTools was never really enforced.

Cloud Functions fire at least once, not exactly once, so I never increment the vote counters. They are recomputed from ground truth and set to an absolute value, which makes every write idempotent under duplicate triggers and out-of-order events. A privilege escalation hole in the security rules was also caught and closed in review.