Architecture stories with enough detail to be useful.

Delivery teams lose context between business discovery, technical specification, configuration, generated artifacts, validation, and testing. That creates repeated clarification loops and weak traceability from requirement to shipped work.

• Split the workflow into specialized discovery, developer, decision, validation, and testing agent responsibilities.
• Used enterprise knowledge retrieval so specifications and generated artifacts stay traceable to source context.
• Added human review points for governance-sensitive outputs.

• Scoped data access and traceable retrieval grounding.
• Audit trails for agent-generated artifacts.
• Reusable agent patterns for multiple SaaS workflows.
• Review gates for high-risk or customer-facing changes.

Teams needed a bridge between business expectations, ServiceNow platform capabilities, internal R&D applications, and implementation-ready technical guidance.

• Converted business requirements into platform workflows, application structures, and implementation-ready documentation.
• Kept reusable architecture patterns separate from customer-specific configuration.
• Combined hands-on delivery with mentoring so platform knowledge did not stay isolated.

• Role-aware workflow and instance governance thinking.
• Reusable design assets for repeated solution patterns.
• Operational documentation for maintainability.
• Clear boundaries between configuration and customization.

Static lists miss new threats, while lexical and content-based models can depend on labeled data and signals that attackers can alter. The project asks whether trust and distrust patterns between linked sites can expose malicious domains.

• Modeled websites as nodes and hyperlinks as directed signed edges.
• Used strong and weak balance constraints to infer missing signs within directed triads.
• Classified unseen domains with a transparent 51% majority rule over incoming edge signs.

• Rule-based explanations instead of opaque model scores.
• No classifier training or retraining for new domains.
• Sparse-graph processing over 48,205 nodes and 384,592 edges.
• Explicit handling of low-evidence domains through an unknown outcome.

IDS and SIEM workflows can produce many alerts without enough causal clarity. Analysts need interpretable evidence paths and low-risk ways to confirm or reject competing attack explanations.

• Modeled telemetry as a probabilistic causal evidence graph.
• Used Bayesian inference to compare attack explanations in real time.
• Added an active intervention loop for probes, logging, decoys, and scoped isolation.

• Low-risk interventions before disruptive response.
• Explainable evidence paths for analyst review.
• Scoped response actions tied to uncertainty reduction.
• Graph-based reasoning over evolving telemetry.

Security teams and researchers need reliable benchmarks for malicious URL detection. Weak or outdated datasets make it harder to compare models, reason about trustworthiness, and study modern phishing and malware behavior.

• Focused the benchmark on richer URL representations rather than only lexical surface features.
• Framed the dataset around reproducible comparison and model trustworthiness.
• Connected the project to broader security-evaluation needs for phishing and malware detection.

• Consistent benchmark structure for reproducibility.
• Feature-rich representation for modern URL analysis.
• Extensible evaluation pattern for future research.
• Trustworthiness framing beyond raw classifier accuracy.