cmdev Academy — Honest AI & Cloud Security Writing

106 articles

HTTP 402 Wakes Up: What It Actually Costs to Charge AI Bots Through AWS WAF

AWS WAF can now return HTTP 402 Payment Required to AI bots — a price manifest in the response body, paid in USDC via Coinbase's x402 protocol. The status code that has been reserved and unused since 1990 just woke up at production scale. This piece walks through the stack that actually carries it, the cost surface that does not appear in the AWS launch blog, the architectural shift it signals, and what the feature does not solve.

June 30, 2026Mayowa A.9m

Cloud Security

The Card-Authorization Layer: Engineering Controls Pan-African Banks Need Before the Next FASTCash Night

On 30 January, ten UBA subsidiaries across Africa dispensed 1.143 billion CFA francs into a coordinated cash-out network — not because the ATMs were broken, but because the issuer switch had been told to authorise the transactions. ngCERT's June 25 advisory names the controls. This piece names where each control has to land at the engineering layer to actually defend against the next FASTCash night.

June 29, 2026Samuel A.9m

AI Security

Instructions Are Not a Boundary: A Least-Privilege Architecture for AI-Assisted Secure Code Review

A security agent can read source. It can also install packages, compile binaries, run test suites, generate exploit payloads, modify files, start services, send network requests, and create or delete artifacts. The system prompt that tells it not to is not a security boundary — it is a polite request to a workload that does whatever its tools permit. This piece walks through the three-agent role split (discovery, verification, remediation), the technical scopes that enforce each role, the verification-by-disproof pattern that catches false positives, and the blocked-capabilities catalogue that every AI-assisted secure-code-review architecture needs before the first finding ships to a pull request.

June 23, 2026Samuel A.18m

Engineering

When the Clinic Comes to Oja Oba: The Sire Mobile Unit Operating Model

Part one of this series put a small lit room at the market square. This piece moves the room. The Sire Mobile Unit is a Toyota Hiace that rotates through markets, working neighbourhoods, schools, and corporate sites on a recurring weekly schedule, anchored by a Sire Hub at the centre of the cluster and a supervising MD running a telemedicine queue from it. The kiosk was the concept. The mobile unit is the operating model — and the difference between the two is the difference between a clinic Mama Tola has to find and a clinic that finds her.

June 22, 2026Samuel A.16m

Cloud Security

SLSA Levels in Practice: What Most Organisations Claim vs What Their Pipeline Actually Enforces

Most organisations claim SLSA Level 2 or 3 on their security questionnaires. Most pipelines enforce Level 1 with manual sign-off. This piece walks the four SLSA levels honestly, names the gap between claim and enforcement, shows the reference toolchain for a defensible Level 2, and explains why the missing deploy-time verification step is where most claims fall apart.

June 16, 2026cmdev13m

Cloud Security

Cloud Security Posture Management in 2026: The Honest Vendor Comparison Wiz, Lacework, Orca, Palo Alto, CrowdStrike, and Aqua Won't Write

Every CSPM vendor comparison piece you have read is either marketing or written by a competitor with an axe to grind. cmdev has no commercial relationship with any of these vendors. This is the structurally honest version — six vendors, five dimensions, and the verdict per workload class — that procurement leads actually need.

June 15, 2026Samuel A.14m

Engineering

The Doctor at the Market Square: A Hybrid Telehealth Micro-Clinic Architecture for Last-Mile Primary Care

A market woman in Akure cannot leave her stall for a half-day public-hospital queue. A standalone GP clinic fails when the single doctor migrates. A pure telemedicine app cannot draw blood or check her pressure. Sirehs is the architectural answer that sits between these failure modes — a small lit room at the market square, a nurse on-site, a remote doctor on the screen, an African-first AI tier behind it, and a pharmacist with veto power over what gets dispensed. This is the architecture, the trade-offs we accept, and the boundaries the AI does not cross.

June 15, 2026cmdev14m

Strategy

Establishing an AI-Augmented BPO Operation: The Setup Playbook

Most companies that want to own an AI-augmented BPO operation know the destination but not the route. This is the 90-day setup playbook we run end to end — talent funnel, regulatory wiring, Connect plus Bedrock substrate, training programme, eval gate — stated explicitly so a prospective partner can see how we would build it with them.

June 14, 2026Samuel A.16m

Engineering

When Your Agent Needs to Run Code: Three Real Paths, the runc Reckoning, and the Trade-Offs Nobody Surfaces

A viral LinkedIn post argued that running agent-generated code inside a standard Docker container is a host-breach waiting to happen. Three weeks earlier, three runc CVEs were disclosed that proved the point in concrete. The architectural shift toward hardware-virtualised microVMs is real, the LangSmith Sandboxes release is real, and the engineering trade-offs the marketing leaves out are real too. Four paths, when each one fits, and the path most teams should actually be on.

June 13, 2026Samuel A.14m

Compliance

AI Bill of Materials (AIBOM): SBOM for the Model, the Prompt, the RAG Corpus, and the Fine-Tune Adapters

SBOM became a regulatory artefact three years after Log4Shell, and AIBOM is on the same arc. The substrate is more fluid — model versions, fine-tune adapters, RAG corpus snapshots, prompt revisions, and inference-time configuration all change faster than any release cycle. This piece sets out the seven elements an AIBOM actually contains, where each is generated, and the reference architecture that survives an EU AI Act Article 11 inspection.

June 13, 2026Samuel A.16m

Engineering

Hardened Containers for AI Workloads: The Tier Decision Most Teams Get Wrong

Every AI platform engineer eventually has to answer the question — runc, gVisor, Firecracker, Kata, or something else? The answers in vendor documentation reduce to either 'use ours' or 'it depends.' Both are unhelpful. This piece walks through the four production tiers honestly, the three workload axes that determine which tier fits, the two questions that change the answer, and the hybrid pattern most regulated AI platforms actually ship. With cost, latency, and isolation numbers from the production deployments we run.

June 13, 2026cmdev12m

Engineering

Frontier-Model Lock-In Is Real: How to Architect for Provider Independence Without the Multi-Cloud Tax

The frontier-model vendors and their analyst proxies will tell you the OpenAI-compatible API has solved portability. It has not. Lock-in is real, it lives at four specific layers — tool-call format, prompt investment, provider-specific features, and eval calibration — and the architectural pattern that bounds it is well understood. Claude-first is still the right default for most enterprise reasoning workloads. The question is how much lock-in you accept, where you accept it, and how cheaply you can leave when leverage matters. The honest engineering map.

June 12, 2026Mayowa A.16m