Architect & Tech Lead · Jul 2026 - Present
Trust Gateway
Data-minimized verification infrastructure: a record held by one institution becomes a signed, policy-evaluated yes/no decision for another — without the record ever leaving the source's network.
The Challenge
Organizations constantly need to confirm facts held by someone else — is this degree real, is this person who they say they are — and today that usually means copying the record, or granting broad access to the database that holds it. A national public university in Peru wanted to verify degrees against the SUNEDU national registry and bind them to RENIEC's DNId national digital identity, without granting any database access or credentials and without personal data leaving its network.
What I Built
With one other engineer, I architected and lead the build of Trust Gateway: 18 services and 15 shared packages, defined by nine normative requirement documents I wrote. An API gateway authenticates clients and derives tenant context; an orchestrator coordinates but never decides; source connectors run inside the source's network and own access, mapping, and minimization; a policy engine owns outcomes and explanation codes; and a signing service returns the exact signed envelope. Every decision is an ES256 detached signature over RFC 8785 canonical JSON, carrying a recomputable SHA-256 commitment to the record it rests on — so a relying party can prove what an answer was based on without ever holding a copy. An append-only audit service keeps per-tenant hash chains, signed receipts, daily Merkle checkpoints, and locked-retention evidence packages.
Key Decisions
Determinism over cleverness: the same request returns the original signed result, the same identity with different content is rejected as a conflict, a signing failure means no completed transaction, and unknown values are never guessed — each rule has a test. Boundaries are enforced in code and CI, not by convention: OAuth 2.0 client credentials between every service, PostgreSQL row-level security with least-privilege roles, signing keys in Azure Key Vault, and every local-only development mode refused by configuration validation in production. The supply chain is locked down with a 7-day dependency cooldown, SHA-pinned GitHub Actions, and container image scanning, and the infrastructure is 7,400+ lines of Terraform across 13 modules and 3 environments.
Impact
I'm leading a TRL 4 lab pilot with the university's data-governance office and laboratory, run on synthetic data in a locked, no-egress Azure sandbox. Milestones 1 and 2 were delivered on schedule in October 2026 — all eight agreed scenarios plus negative cases, with test vectors the university's lab reproduced independently — and the first technical review came back favorable with observations, which I turned into a field-by-field traceability matrix and a corrected interoperability contract. A zero-PII scan across databases, logs, the audit store, and signed envelopes is a pilot acceptance criterion.