Skip to main content

Compliance-grade AI architecture · RAG · agents · MCP

AI stacks fail their first audit at three seams: prompt provenance, retrieval lineage, output attestation.

I build RAG and agent systems for regulated work: banking, tax, legal. The audit trail is the deliverable there. A number without a source span is a compliance failure, so the architecture never trusts the model to remember where it read something. Built to LGPD, BCB 4.893, and the EU AI Act Art. 12 logging mandate.

0
public repos
SLSA L2 · Sigstore-signed · one command to verify
0
live demo apps
AI extraction · market dashboard · job pipeline, source open
0
NixOS modules
one flake, multi-host fleet · 153 merged PRs
0
hallucinated figures by construction
forced citation + span re-validation: no path to an unsourced number
fig. 01selected work

Selected work

Constraint, decision, measured outcome. The result alone teaches nothing.

fig. 02open-source & demos

Open-source & demos

fig. 05how an engagement scales

Start with a verdict. Scale when the proof holds.

Each offer ships a defined deliverable, scoped and fixed at signature. The usual path: a diagnostic first, then a build once the architecture proves out on your own data.

Patternprove it

Regulated-AI Architecture Review

A fixed-week diagnostic of your existing LLM stack: three-plane topology memo, severity-ranked findings, an annotated reference repo.

Outcome: A go/no-go verdict and a scoped remediation map before you commit engineering quarters.

MCP Tool-Boundary Security Audit

STRIDE threat model of every exposed tool, LLM-vs-operator input-boundary review, deny-by-default permission matrix, signed-release hardening (Sigstore + SLSA L2 + dual SBOM).

Outcome: A severity-ranked report with concrete patches, and a pipeline where every binary verifies with one command.

Pipelinemake it real

RAG Audit-Chain Readiness Sprint

A production retrieval pipeline: pgvector + hybrid retrieval + rerank, forced-citation answers, recall measured on your own holdout set, a decision-trace ledger keyed to (prompt, docs, model, output).

Outcome: Grounded answers, accuracy measured on your own holdout, behaviour auditable from day one.

Event-Driven Backend Build & Rescue

An authenticated, production-shape backend: typed schema, audit ledger, outbox + idempotency, fitness-function tests, CI gate, observability. Serverless variant ships at $0 idle.

Outcome: A backend that survives load and costs nothing idle. Provisions and tears down reproducibly, in your repo.

Platformkeep custody

Embedded AI-Platform Custody

Fractional architecture custody: weekly fitness-function review, monthly audit-chain integrity probe, compliance-plane ownership, participation in the AI hiring loop.

Outcome: An audit-grade AI capability your whole org reuses, with the audit chain kept green between releases.

Every engagement opens with a short discovery call and a written diagnostic. Scope is fixed at signature. Send a brief →

Technical Skills

Grouped by the problem each stack solves, so you can scan for the one that matches yours.

Regulated AI & compliance

RAG with retrieval lineage, append-only audit ledgers, decision provenance. Mapped to LGPD, BCB 4.893, and the EU AI Act Art. 12 logging mandate.

LGPDBCB 4.893EU AI Act Art. 12Audit-trail designDecision provenanceRAG evaluationPII controls

AI agents & RAG

Production RAG pipelines, typed-tool agent loops with bounded turns, MCP integrations. Grounded retrieval, gated by frozen-eval regression checks.

Claude CodeAnthropic SDKAzure OpenAIAWS BedrockRAGMCPpgvectorLangGraph

Backend

Go daemons, TypeScript APIs, Python pipelines, Rust binaries. Event-driven where it matters: outbox + idempotency.

GoTypeScriptNode.jsPythonFastAPIRustPostgreSQLKafka

Cloud

AWS, Azure, and GCP: serverless and container workloads sized to a cost ceiling that holds.

AWS LambdaAWS BedrockAzure App ServiceAzure AKSAzure OpenAIGCP Cloud RunGCP Cloud SQL

Infra-as-Code

Declarative infrastructure across cloud and bare-metal fleets. Reproducible, with a teardown that leaves zero orphans.

TerraformHelmKubernetesNixOSDockerDocker Compose

Release engineering

Supply-chain hardening shipped as its own deliverable: reproducible builds, signed provenance, dual-format SBOMs.

GitHub ActionsSigstoreSLSA L2gitleaksOSV-ScannerDependabotSyft

Experience

Shipped systems and the outcomes they moved.

Compliance-Grade AI Architect / Cloud Architect

Jul 2025 — Present

Tier-1 IT services group · LATAM

  • Contributed to a compliance-grade RAG on Azure OpenAI: decision provenance, audit-trail logging, frozen-eval regression checks for regulated workloads
  • Built the backend and data layer of a multilingual education assistant: bilingual PT/EN, over 699K enrollment records
  • Stood up multi-cloud Terraform (Azure + GCP). Environment provisioning dropped below 10 minutes
  • Cut cloud spend 30% via Lambda right-sizing and reserved-capacity planning

Systems Software Engineer

Oct 2024 — Sep 2025

Telecom carrier · LATAM

  • Designed serverless ETL on AWS Lambda + Step Functions for tier-1 telecom billing data
  • Published Terraform modules provisioning multi-region infrastructure in under 10 minutes
  • Rolled out a CloudWatch observability stack: dashboards, alarms, automated incident response
  • Hardened the release pipeline with Sigstore + SLSA provenance for a regulated supply chain

Senior Software Engineer

Jul 2021 — Oct 2024

Product engineering studio · e-commerce / fintech / logistics

  • Delivered 12+ production systems across e-commerce, fintech, and logistics
  • Worked on an event-driven BFF + Broker + Dispatcher retail commerce backend: outbox pattern, idempotency keys
  • Introduced GitHub Actions matrix CI with gitleaks + OSV-Scanner for supply-chain hygiene
  • Set the architecture and release-gate standards adopted across multiple squads
fig. 06claim → evidence

Every claim here is auditable

Six public repositories under yolo-labz, each one SLSA L2, Sigstore-signed, gated on live SonarQube checks. Read the source, not a screenshot. Client work stays anonymized: writeups, never names.

Contact

I build for the engineer who gets paged at 02:00 BRT and needs the audit chain to hold. Send a brief: architecture, RAG, compliance, supply-chain. If it's not a fit I'll say so.