Blog
Architecture Patterns for Building Gateways with Envoy Proxy
A problem-and-solution guide to building API gateways on Envoy Proxy, covering control plane options, authorization patterns, and a comparison with OSS gateways that ship authorization as plugins.
Evolution of AuthN/AuthZ Architecture (1): From Monolith to Identity Provider
Part 1 of a 5-part series that traces OAuth/OIDC through the lens of why each architecture became necessary. It walks through the limits of monolithic session auth, the password anti-pattern, and the introduction of an Identity Provider (IdP).
Evolution of AuthN/AuthZ Architecture (2): API Gateway and Microservices
As the number of services grows, governing token validation becomes a governance problem. This part covers centralizing authentication with an API Gateway, the Phantom Token and Token Exchange patterns, and the organizational trade-offs behind them.
Evolution of AuthN/AuthZ Architecture (3): Advanced Client Authentication and Migration Strategy
Starting from the inherent weakness of Bearer tokens, this piece walks through hardening against theft with PKCE, BFF, DPoP, and sender-constrained tokens, plus a realistic step-by-step migration strategy away from legacy setups.
Evolution of AuthN/AuthZ Architecture (4): Authorization Server Internals and Reliability
How should you structure the internals of an authorization server (AS)? This piece covers separation patterns—externalizing login/consent, federation-based delegation, and preventing authorization from being absorbed into the AS—along with reliability design centered on availability and key lifecycle, plus external yardsticks for quality when building from scratch.
Evolution of AuthN/AuthZ Architecture (5): Data Model and Operational Design for a Custom Authorization Server
The side of an authorization server that RFCs don't specify—what it remembers, who it grants what to, and how it lets things be managed. This piece works through the data model and operational design of a custom AS, organized around four entities: Client, Resource Server, Grant, and Token.
Cognitive Technical Debt: If Teams Keep 'Aligning Every Time,' That's Debt
Paying calibration costs in cross-team collaboration without accumulating 'protocol converters'—contracts, ADRs, shared vocabulary—is debt that compounds. Rereading the three Team Topologies interaction modes as cost-allocation design.
The Specification Problem in the AI Era: Translation Asymmetry and the Location of SSoT
This article examines how AI development communities reinvented the concept of 'specification,' and argues—based on the asymmetry of determinism and falsifiability between intent and Implementation—where the Single Source of Truth should be placed.
Migration of Software Development Bottlenecks: From Compute to Cognition to AI
Reexamining the history of software development through the lens of the Theory of Constraints. Three bottlenecks—compute resources, cognitive resources, and context windows—share an isomorphic structure, revealing an invariant problem of finite resource management.
What Determines the Upper Bound of Software Quality: Human Desire, AI Intelligence, and Shared Knowledge Design
What determines the upper bound of software quality? This article examines the question through three axes: human articulation ability, AI intelligence, and shared knowledge design, tracing the evolving relationship between humans and AI.
The Nature of 'Specification': Understanding Software through Requirements, Contract, and Implementation
Decomposing the ambiguity of 'specification' and 'feature' in software development, proposing a framework of Requirements, Contract, and Implementation for precise reasoning about software.
Structure and Behavior: Achieving Agility and Quality with Types and Tests
Speed and correctness aren't a trade-off. This article explores a two-layer strategy—types for structure, tests for behavior—to achieve both agility and quality in software development.
Subject Position: Function Application Styles in OOP and FP
The difference between shape.area() and area(shape) isn't just syntax—it reflects how we conceptualize the relationship between data and operations.
Trying ABR-Geocoder
Testing ABR-Geocoder, a geocoding tool provided by Japan's Digital Agency. Covers address normalization accuracy, setup methods, and operational guidelines for AWS ECS.
Skepticism on Specification-Driven Development
In the age of AI coding agents, the 'write all specs first' approach is making a comeback. But isn't this just a rehash of Waterfall? Examining this through history and the importance of feedback loops.
Complete Resource Overview for ECS Fargate
A comprehensive guide to understanding ECS Fargate resources organized in a three-layer structure, enabling confident infrastructure builds from scratch