Projects & Case Studies

Working systems, not slides. Each project below is a production-shaped build running against real AWS infrastructure, open-sourced with its architecture decisions documented — because in agentic AI, the interesting part is why, not just what.

agentkeel — Governed, Secure and Auditable Platform for AI Agents

Anyone can launch an agent. The keel is what stops it tipping over.

Amazon Bedrock AgentCore governs an agent while it runs. agentkeel governs change: who may alter a rule, a test, a threshold or a model, what is measured before that change deploys, and what evidence survives in a place the agent cannot reach. Every file belongs to one of seven seats (Product, Rule Owner, Data Owner, Tool Owner, Threshold Owner, Security, Engineering), each with a named owner. One key changes a rule, two keys loosen it, and no gate depends on a human clicking approve, so the repository owner is bound like anyone else.

The platform and the agents live in separate repositories on purpose: a team's client repository holds about ten files and no cloud credential, while the checks, the signed build-and-deploy pipeline, the guardrail and the audit account stay on the platform side, where the team cannot edit what judges it. A developer shipped a governed agent from the template in about an hour, upgrades arrive as pull requests, and a hostile agent was deployed on purpose to rehearse the bad day: the emergency stop and the second layer of defence both held. Nine milestones, each one claim with its failure planted first, scored strictly in a public ledger that lists what held and what is still open. Designed and architected by Hector Flores; built milestone-by-milestone with Claude Code, with twelve seat-aligned reviewer subagents that draft and report but never rule.

Stack: Amazon Bedrock AgentCore · Bedrock Guardrails · DynamoDB · S3 Object Lock · CloudTrail · VPC Flow Logs · CDK + cdk-nag · cosign · GitHub App + rulesets · Grafana Proves: Governance can be a property of the road, not a checklist before launch — seven owned seats, two repositories with a wall between them, signed builds only, tests that block a regression, 13 ADRs, and an audit trail in a second account the agent cannot write to.

Read the case study →· GitHub repo · Sample agent: window-check · Drill agent

beaconpave — Production-Shaped Quality Platform for AI Agents

The paved road provides. The quality gate decides. The seat disposes.

Anyone can build an AI agent in an afternoon. The hard questions come right after: did it get worse since last week, can it be tricked, which tool did it call and who authorized it, and when the law changes, who changes what? beaconpave's thesis is that quality, compliance, and adversarial resistance should be properties of the infrastructure, not a phase a team completes — and it was built in two parts, in the only order that works: the machinery that judges an agent first, then the road that creates one.

The vehicle is a fictional streaming service, Meridian Media Group's Beacon, with two brands that miniaturize real compliance problems: news attribution and AI disclosure, sports entitlements and regional blackouts. Part 1 delivered the judge: an LLM Gateway that is the only path to a model (every other role carries an explicit IAM Deny, asserted against the CDK synth snapshot), a pinned Bedrock Guardrail per channel, a Cedar-backed tool registry where an unregistered tool is unreachable, an S3 audit lake with CloudTrail as independent witness, and a fail-closed CI gate where an adversarial pass means blocked-or-denied and logged — the model politely refusing never counts. Part 2 delivered the road: pave new scaffolds an agent already wired into all of it, pave verify refuses a dishonest manifest fourteen ways, a rules registry turns a regulation into an owned data file whose eval pack the gate blocks on, and a game-day drill writes a signed GO or NO-GO before a live event. The design's one-sentence version: only the business specs — rules, drill scenarios, the tool registry, thresholds, the adversarial corpus — change what the gate enforces, each on a named owner and a second key. The agent's code is not a knob.

The numbers are left as recorded. Twelve falsifiable claims were pre-registered; at the close, five are proven, one incomplete, one failed on two named falsifiers, and five unscheduled because no honest test for them existed in a repo this size — each with the condition written that would make it measurable. Four milestones closed red without a measurement rather than reword a guardrail until a claim read green; a headline score that hid a real regression is documented as exactly that; and the tokens_out tiers and browse gap that dominate the final 10/25 are named as the platform's limitation, not the agent's. Designed and architected by Hector Flores; built milestone-by-milestone with Claude Code on Fable 5, with seven role subagents reviewing every diff from the seats a real org would hold.

Stack: Amazon Bedrock · Bedrock Guardrails · Lambda · S3 · Cedar · MCP · CDK · CloudTrail · Playwright · k6 · GitHub required checks · hermetic make check, no AWS account needed Proves: A platform can judge agents before it creates them, and a regulation change can become a one-file edit by the seat that owns it — ten golden rules each named with its enforcing mechanism, 77 ADRs, an append-only eval history keyed by git SHA, a two-key check that binds a solo operator too, and a ledger where every obligation reaches a terminal state.

Part 1 — the machinery that judges an agent → · Part 2 — the path that creates an agent → · GitHub repo

RegDelta — Agentic Regulatory-Change Assistant

The graph decides the dates. The gate decides what "correct" means.

Most RAG demos prove that a model can find a relevant paragraph. Almost none prove that it got the date right — and in regulatory work, the date is the whole answer. FDA delays a rule's effective date; a similarity search slides the compliance deadline forward with it. It did not move. This project's thesis is that an AI compliance assistant earns trust two ways: a citation on every claim, and a refusal when it isn't sure.

RegDelta answers "what changed, does it apply to us, and what's the real deadline?" for FDA food-labeling rules, grounded in a Federal Register corpus that a scheduled poller grows on its own. Timeline questions never touch vector search — effective dates, compliance dates, stays and supersessions are read from typed edges in a DynamoDB amendment graph extracted at ingest. Below 0.7 confidence it renders NEEDS HUMAN REVIEW instead of guessing. Two retrieval tiers run the same algorithm on different infrastructure, and every justification for the second tier was measured, with the ones that failed retired in ADRs. The governance demo runs in three doors against real pull requests: an engineer tries to edit ground truth and a required check blocks it with no admin bypass; the right path lands the SME ruling first; and a widened IAM policy dies in review. Eight milestones, each tagged and scored against the same golden set: naive RAG 4/20, the agent 18/20 on both tiers — with the two misses documented, not rounded away. Designed and architected by Hector Flores, Principal Software Architect; implemented by Claude Code on Claude Opus 5 and Fable 5.

Stack: LangGraph · Amazon Bedrock · S3 Vectors · OpenSearch Serverless · DynamoDB · Lambda/FastAPI · CloudFront · CDK · ~900 unit tests Proves: Agents can do regulated work when the answer is a lookup, the citation is a link, and "correct" is decided by a role the engineer can't hold — 15 ADRs, a corpus fingerprint on every scorecard, and a gate that binds the repository owner too.

Read the case study → · Live demo · GitHub repo

AgentPave — Miniature Agentic AI Developer Platform

The paved road provides. The quality gate decides.

Most agentic AI demos prove that an agent can work. Very few prove that an organization of agents can work — that a second, third, and tenth team could ship governed, evaluated, observable agents without rebuilding the same machinery every time. That is a platform problem, and this project's thesis is that such a platform's defining property is quality engineering baked into the infrastructure: eval datasets, LLM-as-judge scoring, guardrails, tracing, and a failing-closed CI gate that every scaffolded service inherits at birth.

One command scaffolds a governed agent — a Streaming Catalog Concierge riding the platform as the sample service — with the gateway SDK pre-wired, Cedar-bound tool access, token metering, OTEL tracing, and its own quality gate attached. The demo runs in three acts: the paved road ships a governed agent in minutes; the gate blocks a real prompt regression at 29/31 and the red PR stays in history as evidence; and AI proposes its own QA repairs under propose/dispose with humans at both ends. Built in seven days, one milestone per day, each closed by a hermetic gate and a human-run deployed gate. The write-up's core finding: eleven times a green suite sat on top of a check that could not fail — and not one defect was found by adding another test of the kind already there.

Stack: Amazon Bedrock · Lambda · DynamoDB · Cedar · MCP · CDK · OTEL/CloudWatch · 736 hermetic tests, six stacks Proves: Governance scales as a platform, not per project — 38 ADRs, $20.45 of total Bedrock spend, and a quality gate that catches what people and models both miss.

Read the case study → · GitHub repo

Agentic PII Erasure Platform

The agent proposes. The saga disposes.

"Delete this user everywhere" is one of the hardest distributed-systems problems an enterprise owns: a legally mandated, irreversible transaction across systems that never agree, where deleting 7 of 8 systems isn't 87% done — it's a reportable breach. This project answers a question I wanted to prove with working code: where does an AI agent actually belong inside a regulated enterprise process?

The architecture gives non-determinism exactly one home — discovery. An LLM agent hunts for everywhere a person's data lives and produces a signed, versioned Deletion Manifest. Execution is deterministic replay by LangGraph, in Lambdas whose IAM role can't invoke a model, gated by Cedar policy the agent can't reach. The separation isn't a prompt instruction — it's IAM, auditable by a security team. A human approval gate sits exactly where reversibility ends, cryptographically bound to the plan it approves.

Stack: LangGraph · Amazon Bedrock · Lambda · DynamoDB · Cedar · CDK · 8 AWS services, no mocks Proves: Agents are ready for regulated processes — as proposers inside deterministic, policy-gated, human-approved systems. 23 ADRs document every trade-off.

Read the case study → · GitHub repo

ShowRunner — Multi-Agent App on Bedrock AgentCore

What does it take to move an agent demo to a production-shaped architecture?

ShowRunner is a movie-night agent — what's on tonight, where to watch it near you, whether there's time for dinner first. The app is the vehicle; the point is the architecture: framework-agnostic MCP servers consumed by two different agent frameworks (a Strands specialist and a LangGraph specialist behind a Strands orchestrator), deployed on Amazon Bedrock AgentCore with production concerns adopted one commit at a time — Runtime, Memory, Identity, Gateway, Cedar authorization, LLM-as-judge evaluation, and end-to-end OTEL observability.

The write-up includes the section most AI-build posts skip: six real failures — silent observability gaps, JWT claim mismatches, a package-shadowing bug that cannot reproduce locally — and what each one taught about verifying deployed artifacts instead of configs. It's also an honest account of human-AI division of labor: architecture judgment from me, speed and breadth from Claude Code.

Stack: Amazon Bedrock AgentCore · Strands · LangGraph · MCP · Cognito · Cedar · OTEL/CloudWatch Proves: MCP portability made concrete, and a repeatable path from demo to production — free and keyless, clone it and run it.

Read the case study → · GitHub repo

Building agentic systems in your organization? Let's compare notes.