AI agents that work on a bank’s production cloud — safely.

The guardrails are the product.

Ali AlQattan · Software Engineer — AI agents on cloud & legacy banking systems · Manama, Bahrain

Software engineer who puts AI agents to work on legacy, regulated systems — safely. For a licensed bank on multi-region AWS, built a guarded operations toolkit that lets AI coding agents work on production infrastructure under audit, alongside Terraform, Jenkins CI/CD and Python/boto3 automation. Outside the bank, ships complete agent tooling alone, plus Flutter apps on the App Store and Google Play.

The guarded ops toolkit

How Claude Code and Codex work on a licensed bank’s production AWS without touching the wrong account. Private; it runs at Bank ABC.

Coding agents are quick at operations work and careless about where they are. On a licensed bank’s multi-region estate, one command against the wrong environment is an incident, and a secret pasted into a prompt is a breach.

One scripted command per task. EKS, databases, Lambda, EC2 and Jenkins each get a named command. The agent never improvises a raw CLI call against the estate.
Dry-run by default. Every command prints its plan and stops. Nothing changes until the call says so.
Explicit execution, typed for production. A change needs an explicit execute flag; production also needs its name typed back.
The environment is asserted first. Before every change the toolkit checks the credentials resolve to the environment the command names, and refuses on a mismatch.
Secrets never reach the model. Credentials are resolved inside the toolkit. The agent sees results, never the values.

Production infrastructure under audit, on the multi-region AWS of Bank ABC (ila Bank): Bahrain and Ireland, from dev to production. The same job keeps the bank’s wider estate running: the legacy core-banking batch, scheduled batch chains and database replication.

The code and the estate belong to the bank, so neither is public. This page describes the design only as far as my CV does; the replay uses synthetic names and values.

The work · The CV · Talk to me · Everything shipped · Breakdowns · GitHub · LinkedIn

Vox

Local voice runtime and MCP server for AI coding agents.

Open

room

Agent-supervision harness (tmux companion) for coding agents. Retired 18 Sep 2026; the case study stays.

Open

grokctl

Media-generation controller over two provider planes.

Open

kiro-claude-bridge

Zero-dependency Anthropic Messages API proxy.

Open

Payments QA Framework

Automated tests that drive a live payments app and verify to the ledger.

Open

Taken apart, on paper.

The Guardrails Are the Product — How I let AI agents act on production cloud without trusting them to be careful.
The Mic Opens in 0.44 Seconds — Talking to my coding agents felt like a walkie-talkie. Most of the delay turned out to be the audio player.
Nothing an Agent Says Can Run a Command — I built a tmux companion that showed seven coding agents at a glance. An audit then showed that displaying an agent's text was enough to run it as a shell command.
Every Game Keeps Its Face: How the Art on This Site Was Made — How the site's 37 stickers and game tiles were generated on 9 October 2026.
Pegasus, Cut Open — How NSO Group’s spyware gets onto a phone without a tap, how to tell if it got onto yours, and the one defense researchers say holds.
The One-Command Press — How a Breakdown gets published on this site: one command, one markdown file, and tests that refuse a hollow page.

Shipped and running

22 live products — every one of them self-hosted and one click away. Open one and you are using the real thing.

AFTERTRACE

A two-minute cosy mystery: sneak in and hide a treasure, then switch sides and follow your own clues to name the culprit.

game · mobile · mystery · three.js · typescript
EWA Tracker

Track your family's EWA electricity and water meters to project the end-of-cycle bill.

flutter · mobile · app · utility
ASCII RUSH

An endless runner drawn entirely in text. The last train left without you; run the city after dark, ride the train roofs, bank the coins.

endless runner · ascii · canvas · single file · no dependencies
SPEEDERO: NIGHT RUN

A one-thumb night street-racing roguelike. Hold to load, let go to strike: drift the docks, build a car from 26 parts that change how it drives, and beat three bosses before dawn.

3d · racing · roguelike · three.js · one-thumb · daily · challenges
COIL

A calm, daylight take on snake: collect energy, graze danger for speed, and close a loop with your own body to capture everything inside.

game · mobile · arcade · three.js · typescript
Vox

Local shared voice for every agent on your Mac — one mic, many voices, no cloud STT.

mcp · voice · local · macos · agents
Chameleon

One secret word, one bluffing chameleon: play solo against computer players, or with 3–8 friends on their phones.

game · mobile · solo · multiplayer · party · social-deduction · websocket
LANEBRAWL

A one-lane 1v1 hero brawler: push the wave, break the turret, shatter the core. Fight a bot or a friend by room code, on a phone or a desktop.

game · multiplayer · 1v1 · lane · pixijs · websocket · typescript
Mobilescape

A tiny RuneScape for your thumb — a shared world that keeps working while you sleep.

game · mobile · multiplayer · mmo · three.js
Payments QA Framework

Watch an automated test drive a live payments app — Playwright + Cucumber, verified down to the ledger.

testing · playwright · cucumber · bdd · ci · typescript
SCRAPYARD

Play a 3v3 scrapyard MOBA: three salvage-built champions, two roads, a jungle and the Warden.

game · 3v3 · moba · godot · multiplayer · mobile
PEARL DUEL

A perfect dodge can turn the tide in this duel between Gulf pearl divers.

1v1 · 3D · Online · Touch · Gulf
Doodle Focus League

Trace cute doodles on a focus break — honest scoring, streaks, and shared rooms where friends vote on the best.

game · drawing · multiplayer · vanilla-js
Banana Protocol

Three friends, one bomb, no one has the whole picture.

game · multiplayer · co-op · party
grokctl

Drives Grok Imagine through real Chrome — every result proven by bytes on disk, never by the page's word.

cdp · playwright · typescript · agents
The Grove

A small shared town you build together: chop, fish, smith and fight, play Kout at the Lantern Court, and leave the world a little better for whoever logs in next.

game · multiplayer · webgl2 · sqlite · no-dependencies
liverics

Live lyrics, like subtitles, for the music you're already playing.

desktop · extension · music · electron
Designer Portfolio

Adnan AlQattan’s 3D work and character animation, with interactive models and a downloadable CV.

web · three.js · 3d · portfolio
NEON HORDE

Portrait mobile bullet-heaven — draft weapons, survive five escalating bosses, defeat the Null Sovereign at level 50.

game · roguelite · typescript · mobile · canvas
Foodventure

A one-minute souq cooking game: pour karak, fold samboosa, stir halwa and keep the queue smiling.

game · mobile · casual · react · bahrain
ANON

Ask behind the mask — anonymous Q&A with tags, votes, and full Arabic support.
KOUT

Bahraini partnership cards, with a little pixel magic in every hand.

cards · Bahraini Kout · offline · online · Arabic · pixel art