Writing
Published since 2021: what we have learned building systems that other people depend on, and then staying on them.
2026
07- Jul 2026Cyber security review as a delivery milestoneBooking the penetration test is the easy half. The milestone worth planning is the remediation window, with owners, severity definitions and a retest slot agreed before the report exists.Public sector
- Jun 2026Managed services: what 24/7 really means on a SundayRound-the-clock cover is a staffing arithmetic problem before it is a technical one: rota depth, a written handover between regions, and an escalation list that is still true.Delivery
- May 2026Recruitment platforms and the scaling wallHiring platforms rarely fail on traffic. They fail on the matching query, the notification fan-out, and one nightly job that quietly grew from twenty minutes to nine hours.Delivery
- Apr 2026The engineering behind a border control systemAvailability, offline operation, biometric thresholds and the audit trail, seen from the officer's booth at three in the morning rather than from the tender document.Public sector
- Mar 2026Supply chain visibility that survives a bad weekEvery visibility dashboard looks good in a normal week. The test is the week a port closes, a feed dies and a third of the numbers on screen are quietly eleven hours old.Delivery
- Feb 2026Clinical trial software and the regulator's calendarThe submission date belongs to the regulator and the trial. Every engineering decision downstream has to bend around a calendar the delivery team does not own.Delivery
- Jan 2026EHR data entry, and the cost of a wrong fieldA mistyped value in a clinical record is a patient safety event with a delay on it. Treating it as a data quality defect gets it the wrong queue and the wrong severity.Delivery
2025
12- Dec 2025Evaluation harnesses for models you cannot roll backA model rolls back in twenty minutes. The transactions it declined, the crews it dispatched and the patients it flagged are already out in the world and stay there.Intelligent systems
- Nov 2025What fifteen years of maintenance taught us about designFifteen years in, the systems we still maintain have taught us more than the ones we launched. Some early decisions aged quietly well. Others cost us for a decade.Engineering practice
- Oct 2025Cloud migration for systems with a physical dependencyThe interesting decisions are about what stays on site: hardware on a cable, licences tied to a host, control loops with a millisecond budget, and data with a legal address.Critical infrastructure
- Sep 2025DevSecOps when security review is a gate, not a stepIn government programmes the security function sits outside delivery and can stop a release. The pipeline's job is to make the assessment cheap, repeatable and dull.Public sector
- Aug 2025Senior engineers in a client's team, and the reporting lineEmbedded engineering works when one question is settled in writing: who sets priority. Ambiguity there produces most of the friction people blame on culture or communication.Engineering practice
- Jul 2025Staffing for year three from the first weekThe mechanics behind a promise that is easy to make and hard to keep: two names on every component, rotation one person at a time, and turning down work we cannot staff for its full life.Delivery
- Jun 2025Large language models behind a compliance boundaryWhere the weights run is the smallest decision. Pseudonymisation, retrieval permissions, evaluation and a reconstructable trail are what get a language model through a compliance review.Intelligent systems
- May 2025Inventorying what you encryptAsk an organisation where it uses cryptography and the answer is a list of TLS certificates. That list is accurate and it is a small fraction of the estate. How to find the rest.Emerging technology
- Apr 2025Crypto-agility as an architecture propertySwapping a cryptographic algorithm is a one-line change in a library. Everything around it, column widths, message formats, smartcards and scattered calls, is what makes it a project.Emerging technology
- Mar 2025Post-quantum cryptography: what to do before 2030Traffic captured today can be decrypted later. The migration is limited by hardware lifetimes, vendor roadmaps and third parties, so the sequencing matters more than the algorithm choice.Emerging technology
- Feb 2025Agentic AI in operations: where it earns its keepThe most useful autonomous component we run raises support tickets. Narrow decision space, cheap to undo, fully logged. Autonomy pays where those three properties hold, and is a liability elsewhere.Intelligent systems
- Jan 2025CBDC architecture: the choices that lock you inThe ledger question gets the whiteboard. The decisions that cannot be undone are the distribution model, the privacy floor and whether value moves offline, and they get made by default.Emerging technology
2024
12- Dec 2024Why we still write integration tests for ledgersOn an append-only system a defect cannot be quietly corrected. The history keeps the mistake and the fix side by side, which is why ledger work earns a heavier testing discipline.Emerging technology
- Nov 2024Settlement finality, explained for the people who sign offCommittees approve a settlement speed and rarely take a position on reversibility. Authorisation, clearing, settlement and reconciliation, written for the person signing the design off.Banking & payments
- Oct 2024Digital identity in a low-trust environmentWhere documents are unreliable and the network is worse, identity has to be modelled as a confidence level with a recorded reason behind it. Two-state identity leaves a system only two moves.Emerging technology
- Sep 2024Tokenising an asset nobody has tokenised beforeA token is a claim, and claims live in law. Mapping a physical asset onto a ledger is mostly the work of agreeing what the holder owns before a single contract is deployed.Emerging technology
- Aug 2024Self-custody wallets and the support burdenDigieCash puts private keys in the user's hands. That decision removes every repair tool a support team normally has and moves the whole support model earlier, into design and education.Emerging technology
- Jul 2024Blockchain after the hype: what actually shippedOur first production ledger shipped in 2016, and token platforms followed. An honest account of which parts of that work held up and which were a solution looking for a problem.Emerging technology
- Jun 2024Route planning that respects the driverAn optimiser that ignores what the driver knows produces shorter routes that nobody follows. Notes on objective functions, recording disagreement, and why adherence is a bad metric.Delivery
- May 2024Offline-first is a product decisionQueueing writes is the easy half. What happens when a representative returns from two days without signal is a product question, and it usually gets answered by whoever wrote the sync code.Engineering practice
- Apr 2024Field software for people who are never at a deskNotes from building mobile software for field sales and logistics: battery is a specification, sunlight breaks contrast ratios, and verification reads as surveillance unless designed otherwise.Delivery
- Mar 2024The difference between an alert and a signalAlert fatigue is an engineering failure, not an operator discipline problem. Notes on thresholds, dependency-aware suppression and who gets woken at three in the morning.Critical infrastructure
- Feb 2024Network outage prediction for a telecom operatorForecasting network failures was the straightforward part. Getting a network operations centre to act on a probability at two in the morning took longer and mattered more.Intelligent systems
- Jan 2024Robotic process automation, five years onWhich bots are still running, which were switched off, and where the brittleness actually appeared. Most of the value came from reading the process, not from the robot.Intelligent systems
2023
12- Dec 2023What an SLA actually buys youAn SLA is negotiated by procurement and read for the first time by an engineer at three on a Sunday morning. A guide to what the clock measures, what the exclusions remove, and what to insist on.Delivery
- Nov 2023Data lineage before data scienceThe first months of an AI programme are plumbing: provenance, ownership and reconciliation. Teams read that as a delay before the real work. It is most of the real work.Intelligent systems
- Oct 2023Human review is part of the architectureThe manual review box in an AI architecture diagram has a throughput, a failure mode and a maintenance cost. Design the queue, the escalation path and the reviewer's screen with everything else.Intelligent systems
- Sep 2023Fraud detection that survives an auditA customer was declined at a till in March. Eleven months later, explain it. What that question does to feature provenance and to the choice of model at the decision boundary.Banking & payments
- Aug 2023Putting a model into production inside a regulated bankThe model took six weeks. The system around it took the rest of the year. Lineage, evaluation, the review queue and rollback, and why they decide whether a bank can still run it a decade later.Intelligent systems
- Jul 2023Test automation as a service, and when it stops payingA test suite is code, with the same rot and the same maintenance cost. Where automation earns its keep, which tests are worth deleting, and how to tell when a suite stopped paying.Engineering practice
- Jun 2023Reporting nobody reads, and how to tell earlyWe logged who opened the reports we had built, and most of them were never opened twice. What separates a report that feeds a decision from one that satisfies a requirements document.Delivery
- May 2023The real cost of decommissioning a legacy systemEveryone estimates the build. The switch-off gets a line at the end of the plan with no owner and no cost. What decommissioning a decade-old system actually involves, and where the saving lands.Delivery
- Apr 2023Pricing rules that change per customer, per region, per weekIn distribution, the difficulty in pricing is never the arithmetic. It is resolution order, effective dates and the fact that every price is a promise somebody made to somebody else.Delivery
- Mar 2023Handover is a deliverable, not an eventA two-hour session in the final week is not a handover. A handover is complete when the receiving team has operated the system unaided while the outgoing team watched.Delivery
- Feb 2023Documentation that stays true after the second refactorMost documentation restates something the code already owns, so it goes quietly wrong. The kinds that survive record what the code cannot express, or fail loudly when they lapse.Engineering practice
- Jan 2023Designing for the engineer who inherits this in 2029Legibility is an architectural property, set by where the boundaries go, what things are called and what gets deleted. It cannot be added at the end by writing a wiki page.Engineering practice
2022
12- Dec 2022Auto-resolution without losing the audit trailAutomation that raises, routes and closes plant tickets without a human is straightforward to build. Making it explainable three weeks later is where the work actually is.Critical infrastructure
- Nov 2022Telemetry from plant hardware, and the parts nobody budgets forInstrumenting physical plant: gateways that buffer, clocks that drift, the difference between a gap and a zero, and why the raw series has to stay immutable.Critical infrastructure
- Oct 2022Predictive maintenance that operators will trustFrom the iConcept PowerTech platform in Indonesia: setting a false-positive budget with operations before tuning anything, and why an alert has to say what it saw.Critical infrastructure
- Sep 2022What it costs to engineer a system that cannot go downThe cost curve for availability is steep and badly understood. What each nine buys, why the fourth one is an organisational problem, and the hour best spent deciding what is allowed to be down.Critical infrastructure
- Aug 2022A dealer portal behind a four-thousand-product catalogueModern Houseware's dealer portal, and why the catalogue was the easy half. Resolving a per-dealer price, then storing it so an invoice still reconstructs eighteen months later.Delivery
- Jul 2022Choosing between a rewrite and a stranglerRewrites are a smaller category than most teams assume. The four conditions that make one correct, what a strangler actually costs, and the engagement where we chose wrong.Delivery
- Jun 2022When the knowledge base does more work than the agentsResolution time is the metric everyone asks for on a service desk. The cheapest ticket is the one never raised, and deflection is harder to measure and more useful.Delivery
- May 2022Modernising a core system without taking it offlineThe strangler pattern takes one sentence to describe and two years to run. The seam, the dual run and the reconciliation work are where the programme is actually decided.Delivery
- Apr 2022Arabic and English in one product, without two codebasesSupporting a right-to-left language is usually costed as translation. Translation is the cheap part. The expensive parts are layout direction, numerals and mixed-direction text.Engineering practice
- Mar 2022The first foreign exchange app in a branch-first marketZain Islamic Bank in Iraq wanted foreign exchange in customers' hands. The app could not finish the transaction, because cash is physical, and that shaped the whole design.Banking & payments
- Feb 2022Procurement is a design constraint, not paperworkIn public sector delivery, a third of the architecture is already written into the tender schedules. Reading them as legal formality is how programmes acquire expensive late changes.Public sector
- Jan 2022Multi-tier access is harder than it looksRestricting a manager to their own territory sounds like a filter on a list. It reaches every export, aggregate, notification and search index, and retrofitting it is expensive.Engineering practice
2021
04- Dec 2021Why we write the runbook before the last sprintA runbook written in the final sprint is a reconstruction from memory. Written during the build, every procedure in it has been performed at least once under real conditions.Engineering practice
- Nov 2021What a service desk changes when support runs on emailTata Realty's internal support ran on email and phone calls. That is a process with no record of itself, and what changed was a category, a clock and somewhere to look things up.Delivery
- Oct 2021Replacing a system that thirty thousand people use every dayWürth's field CRM replaced four separate third-party tools for roughly thirty thousand sales representatives. The engineering was the straightforward half. The sequencing was not.Delivery
- Sep 2021Most enterprise programmes fail in year three, not at launchLaunch goes fine because everyone is watching. The failure arrives later, when the senior people have rotated off and nobody left can explain why a batch job runs at 02:40.Delivery
Tell us which system the AI has to run inside
If that system is not ready for AI yet, tell us that too. An engineer will reply and say plainly whether we are the right firm for it.