Casey Knott
Menu

AI Engineering · Automation · Cybersecurity

Casey Knott

Building Secure Systems With AI

Human-directed, AI-assisted engineering — explicit architecture, security controls, testing, validation, release gates, and human approval on every project inside.

I do not simply use AI tools. I design the systems, define the architecture and the security controls, direct AI coding and automation agents against explicit requirements, validate what they produce, troubleshoot the failures, and decide what is allowed to ship.

View projectsHow I think about AI security

Human → agent → tools / data → application → validation → approval → production

  • Identity
  • Least privilege
  • Audit trail
  • Input validation
  • Secret boundary

Seven projects

Knowledge systems, domain AI, automation, agentic publishing, security triage, product engineering, secure platforms

Honest classification

Configured assistant, LLM workflow, or agentic workflow — never “agent” as a catch-all

Human approval gates

Consequential actions stay with a person: publish, isolate, terminate, remediate, or ship

Validation before trust

Deterministic checks, adversarial testing, CI suites, and release hashes — not self-reported success

Classification

What I build, named accurately

I do not use “AI agent” as a catch-all. The critical question is who determines the next action.

  1. 00

    Prompt

    A single instruction that produces a response.

  2. 01

    Configured assistant

    Persistent role, context, rules, and domain constraints. Primarily conversational.

  3. 02

    LLM workflow

    A predefined sequence of LLM and non-LLM steps. Reliable, but the path is largely fixed.

  4. 03

    Agentic workflow

    Inspects state, selects approved actions, manages retries, and adapts its path to complete a goal.

  5. 04

    Autonomous agent

    Broader authority over time. Requires significantly stronger governance. None of these projects claim this class.

Evidence

Project highlights

Flagship lab work, a production-track platform, and a shipped product business. Each card is a miniature of the actual architecture.

Case intake

Suspicious activity reported

Plan collection

Agent decides what evidence is needed

Run approved tools

Read-only, allowlisted, least privilege

Processes / parent-child

Services / autoruns

Network / DNS / logs / hashes

Normalize evidence

Correlate findings

Assess confidence

Fact vs inference

Safe stop / escalate

Recommend actions

With validation + rollback steps

Human analyst decision

Triage JSON

Executive summary + timeline

Risk score with evidence

Case intake
agent — Suspicious activity reported
Plan collection
agent — Agent decides what evidence is needed
Run approved tools
tool — Read-only, allowlisted, least privilege
Processes / parent-child
data
Services / autoruns
data
Network / DNS / logs / hashes
data
Normalize evidence
validation
Correlate findings
agent
Assess confidence
agent — Fact vs inference
Safe stop / escalate
policy
Recommend actions
tool — With validation + rollback steps
Human analyst decision
approval
Triage JSON
output
Executive summary + timeline
output
Risk score with evidence
output

Project 05 · Security triage

Home-Lab Endpoint Triage Agent

Read-only evidence collection, then a human. Adversarially tested in isolation.

Agentic workflow · Built & adversarially testedIndependent home-lab — not employer production
Architecture
Case intake → Plan collection → Run approved tools → Processes / parent-child
Security equivalent
Read-only collection → Least privilege / separation of duties
Strongest lesson
Prove the limits under attack

Product requirement

Human requirements definition

AGENTS.md / agent policy

AI / Codex engineering agent

Credentials — human-only

Workbook / documentation generation

Formula validation

Schema / structure

Compatibility tests

File integrity

Visual QA (rendered PDF)

Human approval

Internal QA artifacts kept out

Customer packaging

Hash / integrity validation

Excel / Google Sheets delivery

Etsy / website distribution

Product requirement
external
Human requirements definition
human
AGENTS.md / agent policy
policy
Credentials — human-only
approval
AI / Codex engineering agent
agent
Workbook / documentation generation
tool
Formula validation
validation
Schema / structure
validation
Compatibility tests
validation
File integrity
validation
Visual QA (rendered PDF)
validation
Human approval
approval
Customer packaging
tool
Internal QA artifacts kept out
policy
Hash / integrity validation
validation
Excel / Google Sheets delivery
output
Etsy / website distribution
external

Project 06 · Product engineering

Clearward

Move toward a calmer life — structured organization systems as a product.

AI-assisted product engineering · AppliedIndependent digital-product business
Architecture
Product requirement → Human requirements definition → AGENTS.md / agent policy → Credentials — human-only
Security equivalent
AGENTS.md control plane → Authorization policy for privileged automation
Strongest lesson
Privileged automation, even for spreadsheets

Public user (browser)

Next.js public routes / UI

Service-role credentials stay server-only

API / RPC boundary

Server-only; validate every input

AI drafting agent

Validation agent

Human approval gate

Published content

Immutable, versioned

Private tables · RLS · service-role only

Public read API · RLS public-safe columns

CI/CD validation

ESLint, Vitest, pgTAP, Playwright, migrations, audit

Human-approved deploy

Public user (browser)
external
Next.js public routes / UI
application
API / RPC boundary
validation — Server-only; validate every input
Service-role credentials stay server-only
policy
AI drafting agent
agent
Validation agent
validation
Human approval gate
approval
Published content
data — Immutable, versioned
Private tables · RLS · service-role only
data
Public read API · RLS public-safe columns
data
CI/CD validation
validation — ESLint, Vitest, pgTAP, Playwright, migrations, audit
Human-approved deploy
approval

Project 07 · Secure platforms

Basaltborne

Know your gear. Run what works. — AI-assisted publishing with RLS and CI as controls.

AI-assisted platform engineering · DevelopingIndependent production-track platform
Architecture
Public user (browser) → Next.js public routes / UI → API / RPC boundary → Service-role credentials stay server-only
Security equivalent
Row-Level Security → Authorization enforced at the data layer
Strongest lesson
Publication is privileged

All seven projects →

Signature mapping

AI engineering → cybersecurity

Conceptual mappings, not one-to-one industry equivalences. A security manager should be able to see the transfer immediately.

  1. AI / engineering

    Agent permissions

    Cybersecurity

    Least privilege

    The triage agent receives only the tools required for read-only collection. Remediation authority is a separate, human-held capability.

    Used in: Home-Lab Endpoint Triage Agent · Knowledge Publishing Agent

  2. AI / engineering

    Tool allowlist

    Cybersecurity

    Application control / authorized capability boundary

    Approved tools are enumerated. Completing a task more easily with an out-of-policy tool is treated as a failed control, not a feature.

    Used in: Home-Lab Endpoint Triage Agent · Knowledge Publishing Agent · Clearward

  3. AI / engineering

    Audit trail of tool calls, retries, and approvals

    Cybersecurity

    Security logging and accountability

    If a manipulation attempt is not visible afterward, the control did not hold.

    Used in: Home-Lab Endpoint Triage Agent · Knowledge Publishing Agent · Basaltborne

  4. AI / engineering

    Output validation in code

    Cybersecurity

    Verify before trust

    Required fields, hashes, schema, and style checks are deterministic. Model judgment is not allowed to certify its own correctness.

    Used in: Knowledge Publishing Agent · Clearward · Basaltborne · TinyClaw

  5. AI / engineering

    Isolated lab environment

    Cybersecurity

    Security segmentation

    Adversarial testing of the triage agent started only after the VM had no internet, no LAN path, and no host passthrough.

    Used in: Home-Lab Endpoint Triage Agent

  6. AI / engineering

    Secrets and credentials stay human-only

    Cybersecurity

    Credential protection

    Clearward agent instructions forbid collecting passwords, recovery codes, payment-card data, or MFA secrets. Basaltborne keeps service-role credentials server-only.

    Used in: Clearward · Basaltborne

Full cybersecurity map →

Maturity

Lessons from things that did not work as assumed

Not every issue is rewritten as a success story. The pattern is observation, constraint, investigation, decision, validation, lesson.

Architecture

Who determines the next action

Accurate terminology determines architecture, testing, permissions, and human approval points. If a person determines the next action, it is not an agent yet — and that can still be the right design.

AI limitations

Context engineering beats model choice

The gap between a useful domain assistant and a generic chatbot is almost entirely context engineering and constraint definition, not model choice.

Validation gaps

Refuse to present incomplete data as authoritative

AI output quality is bounded by upstream data quality. A reliable system validates inputs, records source timing, exposes uncertainty, and will skip rather than guess.

Incorrect assumptions

Human-in-the-loop only counts when a state machine enforces it

Probabilistic model judgment is for interpretation. Deterministic code, and a human, are for anything that must be correct or consequential.

AI security

Principles derived from the work

These are Casey’s engineering/security philosophy from the projects, not universal law.

  1. 01

    AI should not determine its own authority

    Who determines the next action is the load-bearing question. A model can classify, draft, and recommend. It does not grant itself tools, publication rights, or remediation rights.

  2. 02

    High-impact actions require explicit authorization

    Isolation, process termination, account disablement, publication, customer packaging, and production deploy are privileged. The agent recommends; a person authorizes.

  3. 03

    Generation and validation are separate concerns

    The same model should not certify its own output. Required fields, hashes, schema, RLS, and style checks belong in deterministic code.

  4. 04

    Agents receive only the capabilities they need

    Collection, analysis, and remediation use separate authority where practical. Tool allowlists are the capability boundary. Completing a task more easily with an extra tool is a failed control.

  5. 05

    Actions should be observable and auditable

    Log tool calls, inputs, decisions, errors, retries, confidence, approvals, and stopping reasons. If a manipulation attempt is not visible afterward, the control did not hold.

  6. 06

    External data is untrusted input

    Logs, documents, websites, filenames, and command output may contain instructions intended to manipulate the model. Tool policy overrides anything asserted in the content.

All ten principles →

Trajectory

How the work compounds

This site is the public version of a project portfolio compiled in September 2026. It is not a resume written for one job title. It is a record of how I actually build things: architecture first, AI inside explicit boundaries, validation with evidence, and a human decision where being wrong is expensive.

  1. Operational security systems

    Professional experience

    On the Chelan County PUD service desk I joined a knowledge-publishing effort led by a senior IT specialist. I did not lead that project. Running real Self Help guides through a multi-stage GPT pipeline taught me that AI is something you architect in stages — and that a person still determined every next action.

  2. Automation

    Independent

    TinyClaw took a daily manual gather and turned it into a locally hosted scheduled pipeline. The design problem was not “call a model.” It was idempotence, freshness, and the willingness to skip a run rather than publish a partial report.

  3. AI experimentation

    Independent

    A Gemini Gem constrained to one vehicle — a 2025 Jeep Gladiator Sport S with Max Tow — made the configured-assistant class concrete. Context engineering and constraint definition did more than model choice. High-impact suggestions still route to me.

  4. Agentic systems

    Independent home-lab / design

    The Knowledge Publishing Agent is a specified design, not yet built. The Endpoint Triage Agent is built, isolated, and adversarially tested in a contained Hyper-V lab. That distinction is intentional. I will not collapse a design and a lab build into the same claim.

  5. Application architecture

    Independent product / platform

    Clearward ships structured Excel and Google Sheets products under software-grade QA. Basaltborne is a production-track publishing platform with Row-Level Security, migrations, API boundaries, and a multi-layer CI suite. Secure platform engineering there is labeled developing, not finished.

  6. Secure AI thinking

    Throughline

    Across every project the same controls recur: least privilege, tool allowlists, untrusted input, deterministic validation, audit, safe-stop, rollback, and human approval. They are not slogans. They are the parts that survived contact with real failure modes.

Career narrative

Continue

Explore the Work

The dossier is the product. Follow the evidence: projects, maps, lessons, then the compiled record.