Theofanis Tsakanikas

AWS Bedrock (Agent · Knowledge Base · Guardrails) · OpenSearch Serverless · Lambda · Databricks Mosaic AI · XGBoost · Kafka/MSK · Terraform

• RAG grounded in law. A Bedrock Agent answers over a Knowledge Base of verbatim EUR-Lex regulation (AMLD5, GDPR, PSD2, RTS-SCA) on OpenSearch Serverless with Titan v2 embeddings, citing its exact source. Its only tool is a VPC-internal Lambda action group, so it never touches raw data.
• Anti-hallucination as code, not as a prompt. A five-check deterministic gate — schema · no-PII · grounding · faithfulness · decision. Every cited article must exist in the retrieved context, and the agent may escalate but never soften a decision.
• Guardrails proven, not merely configured. PII redaction, prompt-attack filter and contextual grounding at 0.75, bound at an immutable version, CI-gated on a labelled red-team set — and the gates themselves attacked on every pull request: 80 planted violations, each refused by the named check for the named reason.
• Shipped, then destroyed. One CI dispatch provisioned the whole AWS + Databricks estate in 1h 37m — sub-50 ms fraud scoring, promotion gate passed at AUC 0.866 against a 0.83 floor — then tore it down to zero cost. EU AI Act Annex IV documentation is generated from the code and CI-checked.

AWS Textract · Bedrock Data Automation · Bedrock · SageMaker · Step Functions · Lambda · Iceberg on S3 · Athena · OpenSearch · Redshift · EMR Serverless · Terraform

• The confidence threshold is derived, never chosen. Every system like this meets the same question — at what score do we publish? — and most answer with a number that sounds safe. Each field here declares an error budget; the threshold is the lowest score whose 95% upper bound on published-and-wrong still fits it, with N printed beside every figure. Where no threshold fits, the field is declared always-review: 31 of 36 fields, and the reason named per field.
• The refusal is the result. Publishing everything is 26.72% wrong; a hand-picked 0.85 is 4.68%; derived is 0.22% with no declared budget missed — and the queue cost is printed beside the wrong-rate every time. Calibration transports: ECE 0.0592 on 100 real photographed pages against 0.0815 on the generated corpus, so the reader is better calibrated on paper it has never seen.
• Models propose; deterministic code decides. A four-tier cascade routed by declared language eligibility, not tried in a line — Greek, Dutch, Chinese and Arabic skip two tiers outright. A published field that cannot be located on the page is a build failure: 120/120 corrupted boxes refused, each by the layer that should catch it.
• The human loop is measured, not assumed. Declared capacity 4,320 decisions/day against 120,000 queued — the gate fires and passes only on a named acceptance that expires. gate-proof plants 61 violations and requires the named gate to refuse each one.
• Shipped, then destroyed. One dispatch ran the suite, then applied five Terraform layers in 49m 32s with Textract, Bedrock, SageMaker, OpenSearch Serverless and Redshift Serverless live — 34/34 checks against the real account, then torn down the same day. checkov 718 passed, 0 findings.

AWS Bedrock AgentCore (Runtime · Gateway · Identity · Memory · policy engine · observability) · Knowledge Bases · Guardrails · OpenSearch Serverless · Iceberg / Athena · Cedar · Terraform

• A contract cannot pre-authorize its own failure. The reasons a figure goes undisclosed are a closed vocabulary, split in two: lawful omissions are printed and an auditor accepts them; internal failures block the report. A contract may declare the first and never the second — that is how “we could not compute it” quietly becomes “it was not material”.
• The LLM never owns a number. It interprets the standard, cites evidence and writes the narrative around a figure; deterministic code resolves every figure through declared SQL over a pinned Iceberg snapshot and owns the decision to abstain. The gate then scans the rendered DOCX/XLSX/PPTX rather than the data behind it — 4/4 artefacts clean across two regulatory regimes (CSRD/ESRS and EU AI Act Annex IV), 537 numerals checked, each carrying its resolver, source snapshot and lineage id inside the document an auditor receives.
• Isolation and injection, measured. 12/12 cross-tenant routes closed — one memory store per tenant, not one store with a tenant key; 16/16 poisoned documents flagged, each for the rule it was written for, 0/11 benign wrongly flagged. Cedar policy is deployed verbatim, so the offline evaluator and the deployed engine cannot drift.
• A gate never shown to fail is a comment. make gate-proof breaks each control on purpose and requires the named gate to refuse it for the right reason: 25 planted, 25 refused, 0 accepted, 0 stale — alongside 40 preflight checks, terraform validate on 5 layers and checkov at 0 findings.
• Shipped, then destroyed. One CI dispatch applied four Terraform layers, seeded the lakehouse, built the dbt models, ingested the evidence corpora, stood up the AgentCore surface and issued the documents in 21m 47s — then verified 32/32 checks against the live account and 10/10 on the agent surface, and tore the estate down the same day.

AWS IoT Core · Kinesis · Managed Service for Apache Flink · Apache Iceberg on S3 · Athena · dbt · SageMaker (Feature Store · Pipelines · Model Registry · endpoint) · Lake Formation · Step Functions · Terraform

• Fail closed is the wrong reflex on a grid. Refusing to publish is safe in a report factory; on a distribution network the transformer keeps heating while nobody decides. So the safe state is a conservative deterministic action — and the requirement that costs something is that it confesses to being one: 485,442 W against a declared 450,000 W → 8 charging sessions throttled, every one marked as a fallback from the actuator into the decision record. A fallback that looks like a model decision is worse than an outage.
• No decision comes out of a window that has not closed. One stream feeds three decisions needing three different definitions of “we have seen enough” — curtailment in seconds, meter anomaly in hours, settlement restated over days. On the live estate: 0 of 3,779 rows published before their interval ended, checkable as SQL against the deployed table; 3,779 distinct lineage ids, so no two rows share an identity; 285 restatements, 285 of them naming what they replaced.
• The promotion gate refused the model this repository trained. Per-group precision read 1000/1000 in the most deprived tercile against 181/1000 in the least — the opposite of the expected shape, and worse: every true case in one tercile was confirmed by an inspector (66 of 66) and almost none in the other (4 of 23), so the model looks flawless exactly where the dispatch log is densest. A reviewer reading that table would conclude it is fairest on the group it flags three times as often. Written up in docs/BIAS-FINDING.md rather than deleted.
• A consequential decision about a person cannot be actuated automatically. Not a policy — the contract does not load and the actuation type cannot be constructed: 20 pending, 0 actuated, then exactly one, on a named human review. Erasure is complete to a declared boundary with all 6 legs confirmed against the estate independently of the certificate, and the certificate names the leg deletion cannot reach.

LangGraph · Pinecone RAG · AWS · Azure · GCP · Databricks · Trino · Kubernetes · Terraform

• Four platforms, one code path. A Supervisor/Architect/Infra/Medic graph designs, deploys and repairs data pipelines across AWS, Azure, GCP and Databricks. When a deployment fails the Medic reads the real CI logs, patches the exact line and redeploys with no human in the loop.
• Standards-first RAG, evidence-gated fixes. Agents retrieve versioned engineering standards from Pinecone at generation time. A fix is refused unless its evidence quote appears verbatim in real output, so a hallucinated fix has nothing to route to; the heal loop is bounded and fail-closed.
• Agent reliability, measured. An offline harness scores routing and the evidence gate over 17 cases across 14 failure classes with no LLM, no cloud and no keys, plus a live mode that catches model regressions.

Databricks Unity Catalog · Snowflake · Terragrunt · AWS · Azure · GCP · OPA/Rego · Genie

• One JSON contract, two engines. The same domain contract drives Unity Catalog across three clouds and Snowflake, with a checker that computes each principal's effective capability per engine and proves the two match.
• Governance as a merge gate, not a report. A credential-free analyzer fails any pull request that grants read on PII, cross-checked by an independent OPA/Rego implementation and attacked on every run with six crafted violations. Packaged as the reusable govgate CLI and GitHub Action; documented exceptions expire and turn the build red again.
• The copilot is subordinate to the deterministic core. A Genie space caged to four read-only governance tables shows the SQL behind every answer and declines what it may not know.

Databricks · Spark Structured Streaming · Unity Catalog · Terraform (5 layers) · Amazon Managed Grafana

• Explainable by design. A Medallion lakehouse correlates vehicle telemetry with driver biometrics over a ±60-second temporal join. The Gold view emits each factor's point contribution and its primary driver, defined once in code so the generated model card cannot drift from the formula.
• GDPR Art. 9 enforced, not documented. Unity Catalog column masks NULL the biometrics for unprivileged principals — the same query returns different data depending on who runs it — and outgoing Slack/PagerDuty alerts carry no special-category fields.
• Production hygiene throughout. Declarative data quality with quarantine, an SCD-2 driver dimension, PSI drift on the risk distribution, real vehicle-telemetry replay, dashboards as code, keyless OIDC CI/CD.

Kafka (Avro + Schema Registry) · Spark · BigQuery · dbt · Redis TimeSeries · GKE Autopilot

• Keyless, 100% Infrastructure as Code. A GKE Autopilot streaming stack on Workload Identity Federation — no service-account keys anywhere — dual-sinking a validated stream to Redis TimeSeries for live serving and BigQuery for analytics, with dbt marts refreshed every two minutes.
• Data quality with a reason attached. A declared contract drives validation and a dead-letter topic that records why a row was rejected; a z-test drift detector catches a miscalibrated sensor whose readings are all still individually in range, alerting Slack at 3σ.

Airflow · PySpark · dbt · PostgreSQL · S3 · Glue/Athena · Terraform

• The contract is the single source of truth for validation, rejection lineage and PII pseudonymisation. Rejected rows are quarantined with the rule they violated rather than dropped, per-run data-quality metrics reach Grafana, Glue catalogs the S3 zones so the quality history is queryable in Athena, and the generated data dictionary is CI-checked against the contract.