abbas tolgay yılmaz

Interposed

Remote · 2026 – Present

Hardware-rooted enforcement gate for AI agent actions. A per-host Linux daemon hooks the kernel (LSM-BPF) and intercepts every exec, file open, and network connect a coding agent (for example Claude Code) makes before it runs. Trust-listed actions pass; anything else blocks until a human approves it with a FIDO2 tap. Validated end to end on a live host.

• LSM-BPF kernel enforcer (8 hooks: exec, file_open, socket_connect, ptrace, and more) over a watched-PID tree. A policy broker (AAuth Person Server) enforces the trust and quarantine policy and fires a passkey ceremony on any non-trusted target.
• Hardware key seals the policy on disk via FIDO2 CTAP2 hmac-secret, so an agent cannot rewrite its own permissions the way it edits a config file. Vendor-agnostic across YubiKey, Nitrokey, SoloKeys, and any CTAP2 key.
• On-device intent oracle annotates each approval with the action's likely intent using a local model, so a human decides with context rather than a raw syscall, and nothing leaves the host.
• Custom Linux kernel image (bpf-lsm enabled) plus a Firecracker microVM sandbox to isolate untrusted agents behind a sealed policy floor, driven from the same operator that runs host enforcement.
• Per-host Ed25519-signed audit log. Offline license injection and zero telemetry, so it runs fully air-gapped for regulated networks. sha256-checksummed releases, no forced auto-update.
• Fleet operator (desktop app) manages many hosts over a mutually-authenticated Noise transport: per-machine capability and protection-tier probing, tap-gated remediation, and a live embedded terminal.
• Contributor to auth-go, the first Go implementation of the IETF AAuth draft the broker builds on (agent identity and cross-domain authorization): github.com/aauth-dev/auth-go.

ConsAuth Systems

Remote · 2025 – Present

Consent-first identity platform: custom IdP + OAuth2/OIDC (Ory Hydra), Go services, PostgreSQL/Redis. SSO across apps with user-owned preferences and Solid/WebID-aligned flows; optional private pod provisioning.

• Owned protocol and service design around Hydra: authorization & token issuance, client/developer lifecycle, consent and scope modelling. The same mental model as scaling trusted auth and app-to-app permission flows for many consumers.

Governate Oy

Helsinki, 1.2025 – Present

Post-quantum file security platform built from scratch in Go on GCP: hybrid AES-256-GCM + Kyber-1024 encryption, policy-based access control, and cross-platform clients.

• Go Fiber backend with mTLS, WebAuthn, MFA, and audit logging to ClickHouse; real-time layer over NATS and Redis; Grafana + Prometheus observability; GitHub Actions CI/CD.

Start a World Peace Teknoloji A.Ş.

2023 – Present

Freelancing, open-source contributions, and building and experimenting with products.

Vattenfall Energy Trading GmbH

Hamburg, 2019 – 2022

• Contributed building a containerized data platform aggregating real-time feeds from 50+ wind turbines at Princess Alexia Wind Park.
• Designed modeling pipelines processing 5M+ telemetry events/day using Kafka and Cassandra.
• Improved energy trading accuracy by 18% through turbine curtailing and production scheduling optimizations.
• Reduced forecast deviation by 25%, increasing revenue from wind asset trading.
• Engineered secure infrastructure for EV charging networks, supporting 1,000+ active charging sessions/day.
• Secured SCADA communications for power plants including CHP and nuclear facilities, strengthening cybersecurity compliance with OpenMUC library.

Element Insurance AG

Lübeck, 2018 – 2019

• Enhanced and scaled insurance microservices serving 100K+ policyholders across multiple internal teams.
• Delivered 5+ new platform capabilities by integrating APIs and shared services across departments.
• Led cloud migration efforts, moving 70% of workloads to AWS, improving system reliability.
• Implemented Infrastructure-as-Code (Terraform) reducing environment setup time by 80%.
• Built and optimized React dashboards used daily by 50+ internal users.

Türkiye İş Bankası A.Ş.

Istanbul, 2017 – 2018

• Reverse-engineered and integrated legacy SOAP/WSDL endpoints using SmartBear SoapUI's Java SDK, enabling automated testing of the bank's internal service infrastructure.
• Built and maintained internal web tools with Spring Boot backend and jQuery/vanilla JS, HTML, CSS frontends.
• Optimized API testing workflows, improving reliability and reducing manual verification overhead across core banking services.
• Collaborated with cross-functional banking teams to document and standardize internal service contracts, improving onboarding for new engineers.