Secure architecture for autonomous systems, artificial intelligence, and agentic design
Agents that actRails that hold
I'm Drew, a cyber architect. I build autonomous systems that take real actions in production and the guardrails that make that a safe bet.
- 60+
- agents on one substrate
- continuous
- autonomous cycle
- local-first
- default model tier
- 6+ yrs
- security engineering
Founder, DCYFR LabsHead of AI, GameShark LabsPrincipal Security Engineer, Monks
GDSA (Defensible Security Architecture, GIAC)GSTRT (Strategic Planning, Policy & Leadership, GIAC)GCIH (Certified Incident Handler, GIAC)SecurityX (Advanced Security Practitioner, CASP+, CompTIA)25 verified on Credly
01Work
Projects and initiatives
@dcyfr/ai
The portable TypeScript runtime the fleet thinks in: model routing across local and frontier tiers, tool-use, and MCP wiring you drop into an existing project.
The agentic fleet
Sixty-odd daemons on a shared substrate, spanning research, code review, monitoring, and self-healing. They run autonomously on a local-first model stack under a hard budget.
SharkVault
Proof the fleet ships product and not just diffs: a backer-funded consumer app taken end to end, from auth to payments to content pipeline, largely by agents.
02The loop
The fleet doesn't wait to be asked
It wakes on a schedule, reads its own state, picks work off the queue, and writes down what it learned. Then it starts over. Five states, each with something that can stop it.
Observeno model
Reads the workspace as it actually is: services, queues, git state, what the last cycle left behind.
Restricted paths never enter context: message stores, journals, backups.
Triagetier-0 · local
Sorts signal from noise on a local model. Most cycles end here, and that is the point.
Local-first routing. Frontier tiers cost money, so they have to be earned.
Thinktier-3 · frontier
Only what survived triage gets a frontier model. It plans, decomposes, and commits to an action.
A metacognition breaker halts any agent spinning past six unproductive cycles.
Actsandboxed
Takes the action for real. Opens the PR, restores the service, publishes the brief.
Allowlisted binaries only. No metacharacters, no pipe to rm, no private-IP fetches.
Recordappend-only
Writes the outcome to a ledger it will read next cycle. The log is the memory.
Writes confined to two directories. Everything else is read-only to the daemon.
and on the next cycle, 01 again
03Guardrails
Anything that can act can be stopped
Autonomy is a claim about what happens when nobody is watching. These are the controls that make the claim checkable.
- Spend ceilingenforced
- A hard monthly ceiling on model spend, sized to the deployment. Trip it and the kill switch fires. The fleet stops rather than degrading quietly.
- Sender kill switch< 1 s
- Every outbound path (mail, chat, webhooks) honours one pause flag. No sends within a second of it being set.
- Credential isolationper-process
- Secrets resolve at exec time from the OS keychain. Nothing lands in an environment dump, a plist, or a prompt.
- Tool sandboxallowlist
- The shell an agent gets is not your shell: fixed binaries, no metacharacters, no SSRF to localhost or private ranges.
- Metacognition breaker6 cycles
- An agent that keeps picking the same task without shipping is quarantined. Persistence is a failure mode too.
- Self-heal watchdog3 / hr
- Downed services restart on graduated trust. Dry-run first, and never more than three times an hour before escalation.
05Contact
Ship autonomy you can defend
I work with teams putting agents into production. That usually looks like one of three things.
- 01
Your first secure agent
You have a use case and nothing in production yet. We scope the smallest agent that earns its keep and ship it with the controls already in place.
A running agent, and the envelope it runs inside
- 02
A governed fleet
Agents already run. The open question is what stops them: spend, sends, credentials, the blast radius of a bad tool call.
Kill switches, ceilings, and an audit trail that holds up
- 03
A hard look at what you run
An audit of the system you already have: where an agent can act, what it can reach, and what happens when one of them goes wrong.
Ranked findings, and the order to fix them in