KALSCHATZI

Services

What I can help with, and the kinds of engagement that tend to work.

AI agents in production

Agent design and harnesses, tool integrations (MCP), evals, cost and latency, from prototype to GA.

Cost and latency work decides whether an agent ships.

  • Architecture review: what stands between your agent and production
  • Designing the eval suite you'll use to decide when an agent is good enough to release
  • Building or reviewing MCP tool integrations, with cost and latency budgets
  • MCP
  • evals
  • agent harness
The agent loopAn agent plans, calls a tool, observes the result and plans again, with evals running alongside the loop.plantoolobserveevals

Agent safety and sandboxing

Threat modelling, prompt-injection defences, sandboxes, egress control, credentials kept out of prompts, audit trails.

Agents that read untrusted content and call tools need controls built around them.

  • Review of your agent's tool permissions and sandboxing
  • Threat model for an agent handling untrusted input, with prompt-injection defences
  • Designing egress control, credential handling and an audit trail for agent actions
  • threat modelling
  • prompt injection
  • sandboxing
  • egress control
  • audit trails
Nested containmentAn agent runs inside a sandbox, which runs inside egress and identity controls.egress · identitysandboxagent

Platform engineering

Internal developer platforms teams choose to adopt: golden paths, Kubernetes, multi-tenancy.

  • Adoption assessment: where teams route around your platform, and why
  • Designing golden paths and a multi-tenant model on Kubernetes, shaped by the needs of the people who will use them
  • Help with roadmap and build-versus-buy decisions for a platform team
  • Kubernetes
  • golden paths
  • multi-tenancy
One shared golden pathMany teams all build and ship through one shared golden path.teamsgolden path

Cloud-native security

Security built into the platform: identity, policy, network boundaries, vulnerability management.

Developers meet security as defaults, not as a review at the end.

  • Designing default-deny networking and admission policies for a Kubernetes platform
  • Integrating image scanning and vulnerability management into build, deploy and run time
  • Defining security standards for cloud-native applications with your security team
  • Kubernetes
  • default-deny networking
  • admission policies
  • image scanning
Layered securityIdentity, policy, network and scanning layers sit under a shield.identitypolicynetworkscanning

Engineering practice

CI/CD, testing at every level, trunk-based development, breaking up monoliths without stopping delivery.

I help teams ship more often with fewer surprises.

  • Review of your path to production, with a prioritised plan to shorten it
  • Introducing automated pull-request checks and unit, integration and load tests
  • A plan to split a monolith into independently deployable services while you keep delivering
  • CI/CD
  • trunk-based development
  • pull-request checks
  • load tests
The delivery pipelineA change goes from commit to tests to deploy.committestsdeploy

Training and mentoring

Workshops for teams, mentoring for people starting in tech, and the free learning platform.

  • A workshop for your team on agent safety, Kubernetes or engineering practice
  • Mentoring for engineers early in their careers
  • Free self-paced material on the learning platform
  • agent safety
  • Kubernetes
  • engineering practice
A learning pathLearning steps rise from learn to practice to own.learnpracticeown

How working together goes

  1. 01TalkA short call about the problem.
  2. 02AssessA focused review, with written findings.
  3. 03BuildHands-on, alongside your team.
  4. 04Hand overDocs, training, no lock-in.

Book a call