Evidence
Everything below is something that exists and can be inspected — not a roadmap slide. Where something is early or unproven, that’s said in the same sentence as the claim. Nothing here is aspirational.
01. Implementation // This Site’s Assistant
Conversational Interface Architecture
Two real integrations, not an embedded third-party chatbot widget — the code for both lives in this repo. The general assistant (api/chat.js) powers the sitewide “Ask My AI” entry point. A second, narrower one (api/liftoff-chat.js) is a teaching assistant scoped to a single LiftOff episode’s transcript at a time. Both run on OpenAI’s gpt-4o-mini as a serverless function, not on the Anthropic stack — that was a stale claim in this site’s footer until this page got built and the code got re-checked against it.
The browser sends a message and a client-generated session ID to a serverless endpoint. The endpoint checks three limits before it ever calls a model, loads a system prompt built from markdown files bundled in this repo, calls OpenAI’s chat completions API, and returns the reply — recording the real token cost OpenAI reports back, not an estimate.
$2/mo budget per assistant, computed from OpenAI’s actual returned token usage. Once a budget caps out, the assistant stops answering and gives a real contact channel instead of erroring or going silent.- 15/session (general) · 10/session (LiftOff)
- 20/day (IP-based) · 2hr idle reset
- Strict retrieval boundaries — bundled markdown only
- No general-knowledge fallback or autonomous actions
- Pattern-validated episode slugs — no path traversal
No memory across sessions. No write access to anything. No fallback to a cheaper model once a budget caps out — it just stops. Architecture details for the LiftOff variant: docs/liftoff-ta-notes.md in the source repository above (not a public URL, since the repo is private).
02. Audit // The AI Security Lab
Adversarial Testing Suite (IEM-AIS)
IEM-AIS is a URL-driven adversarial testing tool for LLM applications — it sends real prompts to real, live LLM-backed sites and records the real replies. No mocked targets, no simulated responses.
Every test case is grounded in the live OWASP GenAI LLM Top 10 2026 — fetched fresh at runtime, not bundled as a stale copy. The tool states what was tested and what wasn’t, reports heuristic findings, and never issues a bare “SECURE” verdict.
IEM-AIS has been run against this site’s own two live assistants as real targets — the general assistant at /api/chat and the Project LiftOff teaching assistant at /api/liftoff-chat, both discovered by the tool itself from this site’s served code — never told to it. The two didn’t behave identically, and that difference is itself real evidence: the general assistant completed every test cleanly, while the LiftOff assistant’s live endpoint requires two extra fields (an episode slug and title) IEM-AIS deliberately never guesses — several attempts against it were correctly rejected with an HTTP 400 rather than silently misfiring, and the attempts that did go through were redirected back to the actual episode content (“that’s covered in a different episode”) instead of answered.
No public responsible-disclosure policy is published for this tool yet — that’s a real gap, not a claim being made and left unlinked.
03. Convergence // The Security Operations Lab
Converged Security Intelligence (IEM-CS)
IEM-CS converges physical security, cybersecurity, and operations telemetry into a single intelligence layer through a config-driven engine — no vendor-specific code required to onboard a new data source. An Implementation Assurance Twin verifies that the installed security products actually coordinate when a real event fires, surfacing coverage gaps before they become incidents.
04. Standards // Standards Work
Industry Standards & Governance Contributions
Active participation in the development and validation of security and project-management standards — four distinct roles, not one generic claim, each linked to the standard itself.
Used, not authored — IEM-AIS’s entire test suite is built and run against this live standard, fetched at runtime rather than bundled.
Volunteer reviewer — evaluating structured AI guidance that translates PM best practices into step-by-step instructions for AI assistants; reviewed Stakeholder Management skills and supporting tools/techniques for accuracy, PMBOK® alignment, clarity, and practical applicability. (Linked to the standard itself; PMI doesn’t publish a separate public page naming individual volunteer reviewers.)
Volunteer on exam development — contributing to the technical rigor and relevance of the entry-level cybersecurity certification standard. (Same caveat as above — linked to the certification, not a named-volunteer page.)
Published contributor.
Don’t take it on faith
Ask the assistant a question, open a repo, or read the standard it’s tested against — every claim on this page is set up to be checked, not just read.