Draft engineering note · New copy for this website rebuild
Start with the whole response path
A finding only becomes useful when someone or something can act on it. A practical security architecture connects the event, the decision, the action, and the evidence. Treating these as one flow makes it easier to see where responsibility changes hands and where a response could fail.
Design the failure path first
Ask what happens when an event arrives twice, a permission is missing, or a downstream service is unavailable. Bounded retries and dead-letter queues give failures a destination. Alerts need enough context for an operator to decide whether to retry, investigate, or stop the workflow.
Keep controls reviewable
Infrastructure as code makes the intended system inspectable. Logs and traces show what actually happened. The two should work together: configuration explains the design, while operational evidence explains each execution. Project Sentinel is a concrete reference for this connected approach.
This note presents general engineering guidance. The linked source provides context on Malik’s public work.