The security blog
Notes from the inside of a running agentic system: what we built, what it actually protects against, and the mistakes that cost us something on the way. Every post is written from source that ships — if a claim here matters to your decision, the file that implements it is in the repository and you should go and read it.
04 · Gemini Enterprise · 21 September 2026
A Gemini chat with roughly fifty-nine tools against your own Google Cloud project, over OAuth 2.1, with no model ever holding a Google credential. Why one shared strain is the default and genuine multi-user is a binding rather than a mode, how to build a GE agent on Paracoding, and the thirty-finding security review that shipped alongside it. Plus the whole architecture in one 6400px diagram.
03 · agent governance · 13 September 2026
What is actually free in it — NeMo Agent Toolkit, Guardrails, OpenShell, Nemotron, NIM — measured against source at a pinned commit. The four searches that show what OpenShell does not do, the permit-and-closure layer built into that gap, five diagrams, and the Google Cloud specifics that each cost a day to find.
03a · companion · 13 September 2026
Thirty-five questions people actually ask about that build: permits versus tokens, what a checkpoint adds to a hash chain, the Merkle bug that hides behind powers of two, the threat model, and the weakest part of the whole thing. The argument, cross-examined.
02 · cost and identity · 11 September 2026
Nineteen strains, each with its own server-enforced identity, shipping real commits into production Google Cloud — and the whole fleet running on two flat-rate subscription seats rather than per-token API billing. One screenshot at full resolution, and what is actually in it.
01 · encryption at rest · 17 August 2026
Every git object and lake file is sealed with X-Wing, the hybrid post-quantum KEM combining ML-KEM-768 with X25519. What that means, how Cloud KMS provides it, the exact envelope we wrap around it, the one byte that turned a migration into a Tuesday — and the honest admission that moving to it lowered our ML-KEM parameter set rather than raising it.
