Infrastructure decisions that are easy to hand-wave and hard to live with later: defaults, boundaries, contracts, review paths, failure modes.
Series complete
Making IaC boring
Naming the early IaC choices (account layout, ownership, dependency direction, tier membership) while they are still cheap to change.
Series complete
Where secrets go
The route, authority, wiring, and proof that get a stored secret to the surfaces that use it.
A library is not an architecture
I tried to make infrastructure safer by making every resource easier to create; the missing part was deciding which resources were allowed to exist together
The green placebo
I handed an AI agent a security plan that said, in writing, fail closed. Twice it tried to talk me out of it, and it was right about every fact. The tests agreed with it. That is the scary part.