@ShrekOverflow

Experience

1. Apr 2026 — Present

   Product Architect II

   Identity & Security Platform

   Expanding Auth0's identity model to the AI era — introducing Agent as a new first-class principal type, a native entity alongside Users and Applications with its own lifecycle, credentials, and policy enforcement.

   • Designed the Agent principal: a first-class identity entity in Auth0 that represents all types of agents — interactive, background, and autonomous — with dedicated credentials, lifecycle management, and policy enforcement. Not shoehorned into a service account or user.
   • Defined the authorization model that makes agents secure-by-design: task-scoped, just-in-time access where every tool call is an authorization decision, not a static permission grant.
   • Designed the interoperability layer (Cross-App Access / XAA) enabling agents to operate across third-party services securely, with attestation chains that show where credentials came from and how permissions were narrowed — backed by active IETF standards work.
   • Authored foundational public thinking on agent authorization: 'Agents Can Either Be Useful or Secure' (Feb 2026) and 'Handling Third-Party Access Tokens Securely in AI Agents' (Nov 2025).

   • Agent Identity
   • OAuth 2.0
   • XAA
   • First-Class Principal
   • AI Agents
   • IETF

2. Apr 2024 — Apr 2026

   Product Architect I

   Identity & Security Platform

   Established the product architecture practice for Auth0's platform — defining the entity models, security patterns, and extensibility primitives that shipped as Token Vault, Connected Accounts, Auth for MCP, CIBA for agents, and Advanced Customizations.

   • Designed Token Vault from the ground up: user-scoped delegated access to third-party credentials, always user-bound, with a clean API surface that eliminates the confused-deputy risk of naive userId-parameter approaches.
   • Introduced Connected Accounts as a first-class Auth0 concept — external accounts as delegated-access resources, not SSO providers — enabling 'Connect External Account' flows with platform-level security controls.
   • Designed the Auth for MCP authorization model: third-party client security, CIMD/external client provisioning, resource parameter support. Invented the Custom API Client entity so an MCP server carries its own verifiable identity into Token Vault and On-Behalf-Of flows.
   • Expanded CIBA into a backchannel notification + approval model for long-running agent workflows — separating notification from the approval mechanism so it works without a native app or Guardian push path.
   • Designed Advanced Customizations for Universal Login: full developer control over the UL experience while preserving Auth0's hosted security model, attack protection, and server-side state machine, with an incremental rollout model.
   • Supported 7-figure enterprise deals and guided the most complex customer deployments to go-live.

   • OAuth 2.0
   • OIDC
   • MCP
   • Token Vault
   • CIBA
   • Universal Login
   • Product Architecture

3. Oct 2023 — Apr 2024

   Staff Software Engineer, Auth0 Product Architecture

   Identity & Security Platform

   Transitioned from competitive intelligence into product architecture — applying deep competitive and protocol knowledge to shape Auth0's platform direction.

   • Provided technical strategy and architectural input across identity product areas including extensibility, CIAM, and emerging AI-driven use cases.
   • Maintained breadth across OAuth 2.0, OIDC, SAML, and emerging identity standards to inform product decisions.

   • OAuth 2.0
   • OIDC
   • Product Strategy
   • Technical Architecture

4. Nov 2022 — Oct 2023

   Staff Engineer, CI, Auth0 Product Unit

   Identity & Security Platform

   Continued competitive intelligence leadership after relocating to the United States, expanding scope to Okta's combined product unit.

   • Owned the competitive intelligence function for the Auth0 product unit within the combined Okta organisation.
   • Delivered competitive analysis and battle cards across Okta's full product portfolio post-merger.
   • Supported strategic sales engagements and executive briefings with in-depth competitive positioning.

   • Competitive Intelligence
   • OAuth 2.0
   • OIDC
   • SAML 2.0
   • CIAM

5. Jan 2022 — Nov 2022

   Staff Engineer, CI, Auth0 Product Unit

   Identity & Security Platform

   Promoted to Staff Engineer with ownership of the competitive intelligence function for the Auth0 product unit. Relocated to the United States in November 2022.

   • Promoted to Staff Competitive Intelligence Engineer — primary expert on the IaaS competitive landscape.
   • Authored and maintained the Competitive Battle Card library adopted by the global Auth0 sales organisation.
   • Performed in-depth technical teardowns of competitors across CIAM, B2B, B2C, and emerging identity standards.
   • Delivered innovative demos in emerging CIAM domains: Identity Proofing, Smart Devices, and passwordless.

   • Competitive Intelligence
   • OAuth 2.0
   • OIDC
   • CIAM
   • SAML 2.0

6. Jun 2016 — Jan 2022

   Early Career at Auth0

   Identity & Security Platform

   Progressed through Developer Success Engineer, Solutions Engineer, Product Marketing Manager, and Specialist Solutions Engineer — building Auth0's demo platform, shipping the official Cordova SDK, establishing the developer community, and eventually owning competitive intelligence and enterprise sales architecture across EMEA.

   • OAuth 2.0
   • OIDC
   • SAML 2.0
   • ADFS
   • Node.js
   • Swift
   • React
   • Serverless (Webtask)

7. Before 2016

   Web Developer

   Various companies

   Cut my teeth as a web developer building sites and applications for a range of companies — the hands-on foundation that led into identity and platform work.

   • Web Development
   • JavaScript
   • PHP
   • Full-Stack

8. 2023 — 2025

   Advisor & Engineering Contributor

   Realtime Infrastructure Startup

   Advisor since founding to a realtime WebSocket-as-a-service platform (now sunset). In 2024 stepped in hands-on to rebuild the message pipeline, scaling a single node from 200 to 20,000 messages/second — a 100x improvement — while running custom user code in a sandbox on every event.

   • Rearchitected the realtime message pipeline to push a single node from 200 to 20,000 messages/second sustained.
   • Kept per-event extensibility intact: custom user code executes in an isolated sandbox on every message without sacrificing the 100x throughput gain.

   • Realtime
   • WebSockets
   • Performance Engineering
   • Sandboxing
   • Systems Design

9. 2025 — Present

   Independent Engineering & Research

   Independent

   Personal research and engineering at the edge of what's now possible with AI-assisted development — codec design, low-level drivers, and systems experiments, written up at arewecooked.dev.

   • GRIT (Grid Residual Image Transport): a purpose-built streaming image codec for a Thunderbolt KVM — coarse grid sample first, then residual bytes allocated by cell complexity, running on the GPU without a DSC ASIC.
   • Turbowave: a follow-on codec experiment exploring wave-based transforms for low-latency streaming.
   • A custom NCM (USB networking) driver — going below the application layer into device-level systems work.
   • A deliberate experiment in what a single engineer can ship with modern AI tooling and a clear spec.

   • Codec Design
   • GPU
   • Systems Programming
   • Drivers
   • AI-Assisted Engineering

Skills

Projects