Turkmen Mustafa Demirci
Founder, PolicyGate (independent project) | Backend engineer, 20 years in banking, telco & energy
Actions
Turkmen Mustafa Demirci is a backend engineer with around 20 years of experience across banking, telco and energy, currently working as a lead engineer in financial services. He is independently building PolicyGate, a proof-of-concept enforcement layer that applies policy to AI model and tool calls before they execute and signs every decision as independent evidence. His focus is the gap between what AI regulations and security reviews ask for and what engineers can actually implement and prove.
Links
The Race Condition That Made My AI Audit Log Worthless
I built a system that signs a record of every permit or deny decision an AI agent's tool calls go through, so auditors would have independent evidence instead of the agent's own logs. It worked, it passed my tests, and it was quietly useless: the decision record was written on a path that could race the actual execution, so a record could not prove it came before the action it described.
In ten minutes: how the bug hid, why "we log every decision" is not the same as "we can prove every decision came first," and the simple sequencing rule that fixed it. A short war story with a lesson for anyone building audit trails for AI agents, or for anything else that acts on its own.
The Agent Called a Tool. Who Said Yes? Runtime Policy and Signed Evidence for AI Agents
AI agents don't just generate text anymore. They call tools, hit internal APIs, move data and trigger payments, usually with whatever credentials the agent runtime happens to hold. When something goes wrong, the only record of what happened is the agent's own log, written by the same component that took the action. That is not evidence; it is self-attestation.
This talk walks through a working proof-of-concept I built as an independent project: a policy enforcement point that sits between the agent and its model and tool calls, runs in your own infrastructure, and stays deliberately separate from the agent it governs. Every call is evaluated before it executes, using policy-as-code (OPA/Rego): who is calling, with what scope, against which model, and whether the data is allowed to leave a given region. Every permit or deny decision is then emitted as a signed, tamper-evident record.
We'll get concrete:
- Threat model: prompt injection turning into tool misuse, over-scoped credentials, and agents that quietly route around controls.
- Why every tool or MCP invocation must be treated as its own authorization event, not one decision per conversation.
- Writing policies for agents: identity, scope, model allow-lists and data residency.
- Making decision records worth trusting: signing, sequencing and what an auditor can verify.
- The bug that broke it: my first build recorded decisions on a path that could race the execution, which quietly destroyed the value of the evidence. How I found it and how I rebuilt it.
- Limits: what this approach cannot prove, the "only path to tools" requirement, and why key custody becomes your new problem.
You'll leave with a reference architecture and policy patterns you can apply to your own agent stack, whatever framework you use.
Turkmen Mustafa Demirci
Founder, PolicyGate (independent project) | Backend engineer, 20 years in banking, telco & energy
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top