Darko Gjorgjijoski · Skopje, N. Macedonia

I design and ship trustworthy systems.

Software architect and senior engineer with 12+ years taking products from system design through secure, reliable production.

View case studiesDownload CV ↓

Open to remote software architect and senior/staff engineering roles.

capabilities

The systems view.

Four connected disciplines, applied from the first architecture decision through production operations.
01 / software architecture

Architecture that survives contact with delivery.

I turn product goals and constraints into clear boundaries, interfaces, quality attributes, and evolutionary decisions a team can actually implement.

→ System boundaries and interfaces→ Trade-off and risk decisions→ Incremental modernization paths
02 / production engineering

Build it, ship it, operate it.

I move across application code, data, delivery, observability, reliability, performance, and cost so architecture stays connected to what actually runs.

→ Hands-on product delivery→ Deployment and observability→ Reliability, performance, and cost
03 / security by design

Security in the architecture, not after it.

I model trust boundaries, identity, data exposure, dependencies, and failure modes early, then encode least privilege into the implementation.

→ Threat models and trust boundaries→ Identity and least privilege→ Data and supply-chain safeguards
04 / AI systems engineering

Useful agents with explicit boundaries.

I design AI-enabled workflows as software systems: tools, context, evaluation, identity, and human control, not a prompt wrapped in a demo.

→ Agent workflows and tool contracts→ Evaluation and regression suites→ Human approval and safe failure paths
how I work →
selected work

Architecture with evidence.

Products, platforms, and reference implementations described through constraints, decisions, operations, and outcomes.
reference implementation

Tenant-safe Support Agent

A multi-tenant support workflow where identity and authorization are enforced at every tool boundary.

evidence · 120/120 deterministic policy cases passed; 0 cross-tenant leaks; 0 unauthorized writes
reference implementation

Guarded Incident-response Agent

A Kubernetes diagnosis workflow with narrow RBAC, explicit approvals, and reversible actions.

evidence · 60/60 deterministic incident cases passed with 100% diagnosis and safe-action match
maintainer

InvoiceShelf

Open source invoicing - multi-tenant, SaaS-ready.

evidence · super-admin interface
all projects and case studies →
blog

Engineering notes.

Direct, practical writing on AI systems, architecture, production engineering, and security.
★ featured
Resource requests are load-bearing
A new node filled up with pods nobody moved. The scheduler thought they were free, and it was right, because they never said otherwise.
2026-07-27 · 4 min ·
2026-06-09 · 3min
Never set a Redis memory limit equal to its maxmemory
2026-04-14 · 4min
One public IPv4 for the whole cluster
2026-02-17 · 4min
Capability scoping for agent tools
all posts →