Principle 01
Deterministic engines establish evidence; AI explains it rather than inventing it.
Technical work
Engineering Principles
The rules that govern how OrdoAI establishes, preserves, and explains security evidence.
Non-negotiable rules
Engineering Principles
Principle 02
Failed or unavailable checks never become a false Pass.
Principle 03
Monitoring begins automatically after discovery, even when ownership is uncertain.
Principle 04
Temporary outages never delete assets, findings, baselines, or historical evidence.
Principle 05
Findings remain attributable to the asset and scan that produced the evidence.
Principle 06
Lifecycle, assessment, enrichment, findings, reporting, and future agent behavior remain separate concerns.
Principle 07
Tenant isolation and RLS are treated as security boundaries.
Principle 08
Significant changes follow a plan-first, approval-before-change workflow.
Engineering validation evidence
Validated Engineering
Verification results from the current development state, presented as evidence of correctness rather than as vanity metrics.
- 83 automated tests passing, 0 failed.
- TypeScript passes with zero diagnostics.
- Production build passes.
- demo.testfire.net validation: reachable HTTP 200, detector coverage successful, 13 open findings refreshed without duplicates.
- RLS isolation tests passed for same-tenant, cross-tenant, anonymous, status-only updates, invalid status, and service-role lifecycle in isolated PostgreSQL testing.
- Zero duplicate finding keys in validation scans.
What this project demonstrates
Experience Through Engineering
Capability areas exercised directly by building and validating OrdoAI.
Security architecture and threat modelingExternal attack surface management / ESPM designSecure multi-tenant authorization and PostgreSQL RLSEvidence integrity and lifecycle modelingTypeScript / frontend-backend product developmentSecurity testing and regression validationDNS, TLS, HTTP, email authentication and browser security analysisAPI / enrichment integration designSSRF protection and safe outbound request designAI-assisted security analysis with deterministic evidence boundariesDetection / monitoring / change-intelligence thinking