Featured project · Engineering case study
Vautyn
Connecting AI agent actions to evidence.
An agent’s account of what it did is only one part of an investigation. I’m building Vautyn to bring that account together with independent AWS activity and make the attribution inspectable.
Explore the interactive demoThe public demo is a browser simulation with illustrative records.
- My role
- Software Engineer
- Focus
- Backend, cloud infrastructure & investigation UI
- Stage
- Early product / Alpha development
The engineering problem
A tool call can describe an intended action while CloudTrail records the API activity AWS observed. Events may arrive late, multiple calls may look similar, and some identifying evidence may be absent. A useful system needs to preserve those differences rather than force a confident answer.
The initial scope focuses on AWS IAM activity, including attaching policies to roles. Vautyn records supported matches, competing candidates, and cases where the available evidence cannot establish attribution.
What I built
From tool call to investigation
01
Capture and validate
A Python SDK captures tool calls. A FastAPI collector validates and normalizes the incoming records before storing evidence.
Python · FastAPI · SDK transport
02
Preserve the source
S3 holds immutable evidence, while DynamoDB stores the queryable projection and a reference to the exact S3 object version.
S3 Object Lock · DynamoDB
03
Correlate the activity
An EventBridge, SQS, and Lambda pipeline processes CloudTrail activity. It uses session context and checks action, resource identity, and timing.
CloudTrail · EventBridge · SQS · Lambda
04
Explain the result
A React investigator timeline presents agent activity, AWS observations, attribution outcomes, policy findings, and evidence references.
React · Investigator API
Decisions that shaped the system
Write evidence before its database projection
If the database write fails, the source record remains available. An identical retry can finish ingestion without creating a conflicting account of the event.
Treat uncertainty as a recorded outcome
A missing match or an ambiguous candidate set is preserved. Investigators can distinguish an unsupported attribution from a supported one.
Require identity checks, not just a high score
A candidate with the wrong role or policy cannot win because its timing happens to be close. Correlation records preserve eligibility reasons and the scoring policy used.
Design for retries and duplicate delivery
Conditional writes and stable record identities make repeated delivery explicit. Conflicting content under the same identity is rejected rather than silently replacing evidence.
Validation & current scope
Built and tested, with work still in progress.
Local validation covers 9 scenarios and 371 automated acceptance tests, including competing tool calls, delayed telemetry, missing evidence, and idempotent event replay. The correlation engine preserves unique matches, ambiguous results, and insufficient-evidence outcomes.
These results describe local acceptance testing, not production accuracy. The system attributes observed activity; it does not block agent actions or guarantee a unique match. Investigation speed improvements have not been established.
The public demonstration shows the interaction and possible outcomes. It does not run the production scorer or connect to customer AWS accounts.