Papers
Papers
Longer-form technical papers — the full arguments, with citations, before they get broken up into dispatches.
Bounded by Design
The Architecture of Agentic Security and What the Terminology Obscures
Abstract
The cybersecurity industry is presently rebranding established security analytics and workflow automation architectures as "agentic AI," "autonomous SOC," and "self-directed security operations." This paper examines that claim from a systems engineering perspective. The foundational architecture underneath most production systems marketed as agentic security platforms is not new: it is distributed event processing, stateful correlation, graph analytics, deterministic orchestration, bounded tool execution, and probabilistic enrichment. Large Language Models and embedding systems have introduced real operational improvements — reducing analyst burden, compressing investigation time, and improving interface quality — but in most production environments these AI components are inserted into pre-existing distributed security analytics architectures rather than replacing them. The distinction matters because architecture determines failure behavior. A deterministic workflow engine with a probabilistic enrichment layer has different safety, auditability, scaling, and failure characteristics from a truly autonomous cognitive system. This paper decomposes modern agentic security claims into their actual execution primitives, identifies the economic and organizational incentives that sustain the terminology, describes the specific conditions under which the agentic framing would become architecturally accurate, and defines the requirements for safe AI-augmented security operations.
Build the Assembly Line, Not the Car
Zero Touch Provisioning as a Foundational Capability for Repeatable Physical Network Deployment
Abstract
Network automation programs often begin with configuration management or infrastructure-as-code tools aimed at devices that are already reachable, identified, and represented in an authoritative data model. Those tools deliver real value, but they do not by themselves solve the day-0 problem of bringing factory-default physical equipment into a known, authenticated, and governed state. This paper argues that Zero Touch Provisioning (ZTP) should be treated as a foundational bootstrap and lifecycle capability for repeatable physical network deployment—not as the sole foundation of network automation. ZTP must operate with, and remain distinct from, a source of truth, configuration management, orchestration, identity services, assurance, telemetry, compliance, and day-2 lifecycle management. The paper preserves a discovery-first path for brownfield environments, defines a gated management-underlay-overlay deployment sequence, and turns the assembly-line metaphor into an actionable operating model. It also establishes implementation stages, decision rights, failure recovery, and an operational scorecard. The objective is not "zero humans." It is a controlled production system in which human judgment is captured in approved intent, templates, policy, and exception handling rather than repeatedly improvised at each device.
From Order-Taker to Capability Provider
The Case for Service-Driven Infrastructure Delivery
Abstract
Enterprise infrastructure organizations often treat the individual request as the unit of work and the resulting feature, configuration change, or technical function as the unit of value. That bespoke model is indispensable for novel, exploratory, low-volume, emergency, and genuinely exceptional work. It becomes costly, however, when recurring and standardizable demand is repeatedly fulfilled as a one-off. Ownership fragments, consumption paths diverge, lifecycle obligations remain implicit, and value is difficult to observe. This paper makes a qualified case for service-driven delivery as the default where demand is recurring, standardizable, and economically reusable. It defines a four-level hierarchy — service area, service, service function, and service operation — then connects that hierarchy to intake, concept definition, delivery, consumption, lifecycle governance, and cross-team planning. It also presents Seven Perspectives for Capability Definition, explicit decision rights, a governed exception lane, an operational scorecard, and a twelve-week pilot mandate. The objective is not to eliminate bespoke engineering. It is to route each class of work into the delivery model that produces the best combination of speed, control, reuse, and business value.
Identity Scope and Continuous Authorization in Brokered Third-Party Access
A Design Boundary for Backend Identity; a Revocable Decision for Continued Access
Abstract
Backend identity non-propagation and continuous access evaluation address different architectural questions. The first defines where the original subject's identity is consumed; the second determines whether an already-authorized session may continue as identity, device, business, and resource conditions change. This note preserves the brokered boundary for unmodified SSH, SFTP, and HTTPS backends while extending the control model from connection-time validation to continuously reevaluated authorization. Products such as SGNL are considered as context, decision, and response-orchestration components, not as substitutes for endpoint telemetry or protocol enforcement. Behavioral modeling of the mediated traffic is treated as a distinct, probabilistic signal class whose attribution depends on the broker's session correlation, and known behavior patterns are governed as versioned, tested signatures. The proposed architecture keeps authenticated subject context in the control plane, binds it to tenant and session state, and requires the broker to implement and verify revocation. The claim is intentionally scoped: a legacy backend can remain identity-opaque, but the access path must not remain policy-static.
History Restarts
MAGA, Recognition, and the Failure of the End of History
Abstract
Read through the line that runs from Hegel through Alexandre Kojève to Francis Fukuyama, and set against Fritjof Capra's systems thinking, MAGA can be understood as something more basic than the usual political explanations allow: the reappearance of historical negation inside a political order that once appeared to have transcended it. The End of History didn't fail because history's contradictions were never resolved. It failed because resolving one contradiction created the conditions for the next — a lesson any network architect already knows, applied somewhere less comfortable than a routing table.
The Big Internet Lunchroom
A Kid's Guide to How the Web, Apps, and Games Actually Talk to Each Other
About the Book
A picture book about how the internet actually works, told through a school lunchroom where a friendly "Server" delivers notes between kids — dressed up as a children's book, but really written for the adults who've spent their careers explaining "the cloud" to people who nod and still don't get it. If you can't explain packet delivery to a room of second graders, you probably don't understand it as well as you think you do.