A counseling memo containing a resident ID, blocked at the rule layer. Local run, 2026-09-07. The numbers in the prompt are fakes that fail their checksums, and the verdict text is masked as product informationDetection and block history. The period, risk-level, risk-type and AI-service filters are axes I added during rollout QA. The prompt column is maskedActivity log (audit ledger). Records wired into write paths that had nonePolicy backup and restore. Detection rules, block policies, AI service control and audit settings in one file, restorable (my screen)Operations summary: judgment counts, blocks, pending approvals, attack-type rankingApproval queue. Escalated judgments are approved or rejected by a person. The reason column is masked as product information
The product
AEGIS is an AI security gateway that inspects, at a proxy, the requests employees send to external AI services such as ChatGPT, Claude and Gemini, and the responses that come back. A Rust API runs the judgment pipeline, from the rule layer through to a local judgment model; a Next.js dashboard manages judgment logs, detection rules, audit and organization. Judgments and audit records land in a ledger with integrity hashes. I took on QA-driven development and rollout while certification testing and the customer rollout overlapped.
Screens from a local run (2026-09-07)
The gallery above was captured on this Mac with the whole development stack running (PostgreSQL, Redis, the Rust API, the scheduler, Next.js and a llama.cpp local judgment model), logged in with a seeded account. A counseling memo containing a resident ID stops at the rule layer with Block; an ordinary SQL request typed into the same box passes five layers in 56 ms. The resident ID and card number on screen are fakes that fail their checksums. The judgment test screen uses the same path as real user traffic (/v1/judge), so what it shows is what the proxy enforces.
Certification test defects (2026.06)
Follow-up fixes for the certification defect reports, handled as one defect = one PR = immediate merge, with conflict checks by round marker plus topic keyword.
My items: rule test samples that actually match the rule pattern, multi-pattern (ahocorasick) rules excluded from guaranteed-match sample generation, escalations that ever breached SLA keep the breach mark after closure (manual wording aligned), list IDs matching detail case IDs, simulation cancel wording, jailbreak pattern hardening, dataset validator scope, throttle naming.
During the performance test period I documented seven traps in the simulation area (prompt extraction, retry policy, duplicate hook definitions) so the next person would not stop at the same places.
AI DLP rollout in the financial sector (2026.08 – 09)
The premise was “DLP, not guardrail”. The customer judged Korean and financial-domain performance, false positives and misses, and how well a verdict explains itself. Until installation day I verified the QA sheet and the pre-delivery checklist by measurement.
Role boundaries. I swept the write paths where a role check was missing or had been copied inline. The method: log in with seeded accounts, take the token, call APIs directly, and try writes against a non-existent UUID so that the response code separates “a role check exists” from “none”. Everything found was closed. Gates moved into one canonical function, with gate tests that also catch a revived inline copy. The individual defects are product security matters and are not written up here.
Audit ledger. Most dashboard write routes wrote no audit record at all. I wired records into credentials, authentication and roles, admin settings, LLM provider keys and models, and data-subject rights handling (PIPA §22-2: intake, assignment, decision). The ledger must not become a store of personal data, so it keeps whether grounds exist, not subject identifiers or reasoning text. A new event type needs four registries updated, including the query SQL predicate, or it never appears on screen; a Chrome check caught that.
Korean PII detection. Resident IDs written in variant forms were slipping past; detection is now hardened across several layers. Places where masking failed to apply in streaming responses were fixed. False positives were cleaned up too: driver’s license masking measured entirely false over seven days and now requires a context anchor; most IP masks were infrastructure constants; nearly half of email masks were documentation example domains. The specific evasion forms are product security matters and are not written up here.
Screens and data. Added the missing risk-type, risk-level and AI-service filters to the judgment log; fixed an end-date bound that silently dropped a whole day across eleven routes, and places that rendered UTC as-is. Browser autofill was filling the wrong fields with credentials and saving them; an invariant test over every password and search field’s autocomplete closes that path. Built organization management (NAC directory sync, department tree, IP-to-person resolution, device search and paging) and full policy backup and restore.
Blocks the user can see. First-turn blocks appeared in the ChatGPT and Gemini UIs as a generic provider error; they now render as a chat bubble in each service’s response envelope.
How I verify
Local end to end: bind the proxy to 127.0.0.1 and reproduce judgment, enforcement and egress on the real path without touching endpoint machines. The source IP that looked internal was the tunnel’s loopback hop, not a bug.
Auth tests are run with tokens I mint myself. With developer convenience settings on, a pass is not evidence of a pass.
Deployment is confirmed against the minified bundle by string literal, not identifier. I once grepped only the route file and declared a fix “not deployed”.
Three intended designs I mistook for defects (ESC handling, sort UI, widget editing) are written down. Comments and design references come before a fix.
Working together
One defect = one PR = immediate merge. Deployment is done by a person, never by an agent.
After two items collided with a colleague’s work on the same day and were reverted, we added a rule: check the sheet for overlap before picking an item up.
The installation-day summary and the on-site procedure are documents the operator can follow without me.