$ agent --sandbox gvisor --egress allowlist
I'm Tiago Alves, an engineer with 15 years in software. I help teams put AI agents into production safely, and build the platforms and security underneath them, so the people using them move faster.
Agent design and harnesses, tool integrations (MCP), evals, cost and latency, from prototype to GA.
Threat modelling, prompt-injection defences, sandboxes, egress control, credentials kept out of prompts, audit trails.
Internal developer platforms teams choose to adopt: golden paths, Kubernetes, multi-tenancy.
Security built into the platform: identity, policy, network boundaries, vulnerability management.
CI/CD, testing at every level, trunk-based development, breaking up monoliths without stopping delivery.
Workshops for teams, mentoring for people starting in tech, and the free learning platform.
Work I've led over my career.
Principal architect of an AI-powered security service: agents in hardened sandboxes, from design to GA in ~6 months.
An internal developer platform for a bank, security built in, from one tenant to ~50 teams (250+ engineers).
A company-wide CRM: CI/CD, automated tests, trunk-based development, a monolith split; releases needing hotfixes down from 100% to about 10%.
Helping scale a multi-region, active-active Kubernetes platform hosting thousands of applications.
Agree what success looks like before building.
Not a review at the end.
Make the right way the easy way.
The delivery speed of the people you serve.
I'm a Staff Software Engineer based in Lisbon, with 15 years across AI agents, platform engineering and security, and I've led teams of ~15 engineers. Kalschatzi is my consultancy, named after my two dogs, Kali and Schatzi.
