Enterprise security architect · agent & data security

“The model isn't the risk. Its permissions are.”

Enterprise security architect. Veteran. Now securing what agents can touch.

I’m Zodi, a security architect and military veteran based in San Diego. For 13 years I’ve built security controls that have to work in the real world, not just on a whiteboard.

Most of that time has been spent inside enterprise cloud, DevOps, container, and data-protection programs, where the stakes cut both ways. A bad control slows thousands of engineers. A missing one exposes everything they ship. The craft is finding the line that protects the business without getting in its way.

Today that same problem has a new shape. Agents read your data, call your tools, and act with credentials of their own. The question is no longer just who has access…it’s what an agent can do with it. That’s where I spend my time now: agent permissions, tool and MCP trust, and keeping sensitive data from flowing where it shouldn’t.

ZodOps is my working notebook. Inside are write-ups on image provenance, IAM graphs, admission policy, DSPM, DLP, and agent security. Each one aims to be practical enough to use and specific enough to build on. My rule of thumb: if a design can’t be committed to a repo, it isn’t finished.

If you’re building in agent or data security, or wrestling with a control that keeps getting bypassed, I’d love to hear about it.

Ping me and let’s talk shop.

~/about/zodi.sh

$ whoami --history
13y     security architecture · cloud & data protection
core    cloud security, data security, security automation
scope   enterprise accounts, large environments
focus   agent security
 
$ cat credentials.log
+  AWS Certified Cloud Practitioner — AWS
+  Certified DSPM Architect — Cyera
 
$ cat priorities.log
+  verify before trusting
+  risk-based over checkbox compliance
+  assume breach, design for containment
+  controls that ship with the code
 
$ cat reasoning-in-public.log
agent-security       active research · writing in progress
cloud-security      ongoing coverage · writing in progress
data-security       ongoing coverage · writing in progress
 
$ ls ./currently/
studying/   Azure Admin Associate Certification
studying/   AWS Certified Solutions Architect
 
$ cat reach.txt
→  linkedin.com/in/ztagedini