AI systems engineering · Agent execution assurance · Applied AI · Critical infrastructure

I design and build software that connects AI reasoning to controlled, observable real-world actions. My work spans Python, API integrations, identity and authorization, distributed systems, operational networks and evidence-driven evaluation.

My engineering principle: a model can propose an action; it should not grant itself the authority to execute it.

See working systems · Public RFC contributions · Inspect the evidence · Get in touch

Policy-gated tool execution with exact-call authorization, bounded review, separated dispatch, effect evidence and transparent negative-result reporting.

Inspect: run five guided scenarios · machine-readable claim register

Scope: research software for bounded, controlled pilot evaluation — not a certified production security product.

A runnable simulation-only testbed for HVAC, lighting and other building controls. It combines signed work orders, separate credentials, policy decisions, simulated actuators and independent read-back. The tests demonstrate where action permission and observed effect must be checked separately.

Inspect: architecture and runnable setup · federated test results

Scope: simulated plant and bounded test runs. No physical OT/BMS write path.

Building-energy software with meter ingestion, multi-tenant data, dashboards, anomaly analysis and AI-assisted operational insights, informed by hands-on infrastructure and building-systems work.

Inspect: platform overview · architecture and operating model

• Agent Authority Conformance Profiles (AACP) — independent draft evidence model for seven distinct agent-authorization properties, without aggregate security scores. This is not the LF Decentralized Trust lab of a similar name.
• Assured Agent Execution — reference control-plane patterns joining REMORA to approval, execution and selected system-of-record effect checks.
• vericlaim — CI-oriented checks for drift between technical claims and supporting artifacts.

My applied-AI experiments also include DressMeUp/StyleDNA, a virtual fashion try-on and AI-styling prototype. I do not present this as a reproducible public deployment.

I contribute technical reviews, testable boundary statements and implementation feedback to public discussions in CoSAI / OASIS Workstream 4 (WS4). Here are concrete examples, each linked to the actual contribution rather than a general standards logo:

• Agent Manifest RFC discussion #149 — I proposed the non-transitive boundary between declared deployment state, authorized exact calls, non-bypassable execution and verified effects, with specific negative tests. Read my proposal and the author's response.
• Evidence Sufficiency RFC discussion #189 — I reviewed the strict meaning of not_established, proposed separating checker input from authored test expectations and corrected vector provenance boundaries. Read my review and inspect a related REMORA regression artifact.
• Containment follow-on #172 — contribution to the documented containment/evidence work, with explicit contributor attribution in the draft. Merged attribution update and credit preference.
• Observer independence, PR #240 — I tested a proposed observer criterion against REMORA and distinguished key separation, custody independence, observer independence and observation coverage. Read my review and the later merged follow-on.

These are review and engineering contributions; they are not claims of primary RFC authorship, CoSAI representation, standards adoption, certification or endorsement of REMORA.

I prefer a reproducible test and a narrow claim over an impressive number without context.

• REMORA claim register — claims tied to evidence and evaluation scope.
• Capability maturity register — implemented, connected and unestablished capabilities.
• Negative results — what did not work, and where utility or assurance remains limited.
• OT testbed results — results from bounded, identified test runs; no claim of live physical control.

Important limitation: simulation, conformance-vector reproduction and research benchmarks do not independently establish complete mediation in an arbitrary production deployment. A passing result only supports the property, assumptions and revision actually tested.

I am the founder and managing director of Luftfiber AS in Norway. My background includes more than 15 years across telecommunications, ISP infrastructure, Linux services, network security, wireless systems and building technology. That operational experience shapes my software design: explicit ownership, least privilege, recoverable failures and verifiable outcomes.

Technology: Python · TypeScript/React · PostgreSQL/Supabase · REST APIs · Docker/Linux · LLMs and tool integrations · policy-as-code · networking and OT/IoT.

I welcome engineering collaboration, independent reproduction, technical review and applied-AI/product discussions.

Email · LinkedIn · Luftfiber AS