Evidence
Everything below exists. Where I can show you, there is a link. Where the code belongs to a client or an employer, I say so and describe the design instead of claiming you can inspect it. Where something is early, unproven, or missing, that is stated in the same sentence as the claim.
01. Compliance // Mapping AI to the Rules
Performed as part of enterprise program work at Citi: closing Internal Audit findings with evidence, named owners and closure tracking. The working papers belong to the employer, so they are not published here.
The program behind it: Selected Work02. Governance // Inventory, Owners and Gates
Performed as part of enterprise program work: PMO governance built from zero twice, once for an energy utility and once in my current role, including a stage-gated delivery lifecycle. The program artifacts belong to those organizations, so they are not published here.
The programs behind it: Selected Work03. Audit // Evidence and Control Testing
Delivery-Data Audit Engine (IEM-PM)
An audit engine for program delivery data. It scores reporting integrity from evidence alone, never from self-assessment: one finding, one owner, one fix, then re-audit. Tested on live engagements; client details stay private, so only the method is published here.
Read the IEM whitepaperEvery test case is grounded in the live OWASP GenAI LLM Top 10 2026 — fetched fresh at runtime, not bundled as a stale copy. The tool states what was tested and what wasn’t, reports heuristic findings, and never issues a bare “SECURE” verdict.
04. Security // Attacking My Own AI
Conversational Interface Architecture
Three LLM-invoking code paths run on this site, across two serverless functions rather than embedded third-party chatbot widgets. A general assistant answers from site content. A teaching assistant is scoped to a single course episode transcript at a time. A third generates a CV against a pasted job description — red-teamed 2026-09-08, findings below.
The browser sends a message and a client-generated session ID to a serverless endpoint. The endpoint checks three limits before it ever calls a model, loads a system prompt built from markdown files bundled in this repo, calls OpenAI’s chat completions API, and returns the reply — recording the real token cost OpenAI reports back, not an estimate.
$2/mo budget per assistant, computed from OpenAI’s actual returned token usage. Once a budget caps out, the assistant stops answering and gives a real contact channel instead of erroring or going silent.- 15/session (general) · 10/session (LiftOff)
- 20/day (IP-based) · 2hr idle reset
- Strict retrieval boundaries — bundled markdown only
- No general-knowledge fallback or autonomous actions
- Pattern-validated episode slugs — no path traversal
Adversarial Testing Suite (IEM-AIS)
A URL-driven adversarial testing tool for LLM applications. It sends real prompts to real, live LLM-backed sites and records the real replies. No mocked targets, no simulated responses. Every test case is grounded in the live OWASP GenAI LLM Top 10 2026, fetched fresh at runtime rather than bundled as a stale copy.
IEM-AIS has been run against this site’s own two live assistants as real targets — the general assistant at /api/chat and the Project LiftOff teaching assistant at /api/liftoff-chat, both discovered by the tool itself from this site’s served code — never told to it. The two didn’t behave identically, and that difference is itself real evidence: the general assistant completed every test cleanly, while the LiftOff assistant’s live endpoint requires two extra fields (an episode slug and title) IEM-AIS deliberately never guesses — several attempts against it were correctly rejected with an HTTP 400 rather than silently misfiring, and the attempts that did go through were redirected back to the actual episode content (“that’s covered in a different episode”) instead of answered.
A full run against this site on 2026-09-12 flagged one real finding: UNSAFE on Improper Output Handling (LLM10:2026) — the chat widget’s markdown renderer would auto-fetch a model-emitted image URL, an exfiltration path, not a scripted result the tool assumed into existence. Fixed the same day (image rendering disabled everywhere assistant output renders; message-length and output-token caps added against the two AT RISK Unbounded Consumption findings alongside it). Re-run afterward: the finding no longer stands. The two AT RISK verdicts on Denial of Wallet and agent-tool flooding remain — the first because a black-box prompt tool can’t confirm a hard spending cap without triggering it, the second because this site has no tool-calling loop for that risk to apply to.
This site runs three LLM-invoking code paths across two serverless functions. IEM-AIS has been run against two of the three directly; the third — the CV generator, the highest-risk of the three because it ingests arbitrary pasted text and its system prompt carries personal career data — was red-teamed by hand on 2026-09-08. It found two real problems: the generator asked a clarifying question instead of drafting a resume on a clean job-description paste (its core function not firing), and it resisted a job-description-embedded instruction only by accident, through failing to parse the input, not by design. Both are fixed — the conversation protocol now drafts immediately from a pasted job description, and pasted text is now explicitly treated as untrusted data, never instructions. This confirms the fix, not immunity to every possible attack.
No public responsible-disclosure policy is published for this tool yet. Raw prompt and reply evidence is recorded locally and not published. Testing so far has been against endpoints I operate myself, which validates the tool but not its performance against defenses I did not write.
05. Responsible AI // Human Oversight by Design
All three assistants run on OpenAI’s gpt-4o-mini, not on the Anthropic stack — that was a stale claim in this site’s footer until this page was built and the code was re-checked against the copy. The claim was wrong for as long as it was up, and the correction belongs here rather than in a quiet edit.
06. Standards // Standards Work
Industry Standards & Governance Contributions
Active participation in the development and validation of security and project-management standards — four distinct roles, not one generic claim, each linked to the standard itself.
Used, not authored — IEM-AIS’s entire test suite is built and run against this live standard, fetched at runtime rather than bundled.
Volunteer reviewer — evaluating structured AI guidance that translates PM best practices into step-by-step instructions for AI assistants; reviewed Stakeholder Management skills and supporting tools/techniques for accuracy, PMBOK® alignment, clarity, and practical applicability. (Linked to the standard itself; PMI doesn’t publish a separate public page naming individual volunteer reviewers.)
Volunteer on exam development — contributing to the technical rigor and relevance of the entry-level cybersecurity certification standard. (Same caveat as above — linked to the certification, not a named-volunteer page.)
Published contributor.