[security]

2026-09-08[writing]

I tried to file one agent tool call as an order record under the EU trading rules. Of the eighteen fields that apply, six map to something standard and four have no source at all. Those rules have been binding since 2018, and in February the regulator pointed them at GenAI.

2026-08-27[writing]

I tried to write down the formula for revocation latency and it kept being wrong in instructive ways. The corrections come from validator source code: a five-minute grace on expired tokens in .NET, streams that outlive their token by design, and a 12-hour JWKS refresh on the one lever that actually works. With runnable experiments.

2026-08-19[writing]

Only two fields are Required on the OpenTelemetry span that records an agent taking an action. Not who authorized it, not what it was allowed to do, not what it sent. Here's the gap, field by field, and what to do about it.

2015-06-29[writing]

A 2015 walkthrough of Java secure coding standards and the static-analysis toolchain for enforcing them.