OldKnowledge,New Vessel.
Essays on on-device AI, data sovereignty, and building systems that keep knowledge where it belongs.
Enter the archive →— 00 / ThesisEvery business runs on knowledge older than its software.
Latest Entries
Blast-Radius Budgets for Write-Capable Agents: Spend, Scope and Reversibility Are Three Caps, Not One Permission (2026)
Bug Bounty in the AI-Slop Era: Pay for the Reproduction, Not the Report (2026)
SEC Cyber Disclosure: The Four-Day Clock Starts When You Decide, So Make the Decision an Engineered Record (2026)
Active-Active Multi-Region: You Are Buying Disagreement, So Decide Who Wins Per Entity (2026)
ISO 27001 vs SOC 2 for Indian Product Companies: Choose the Control Set Once, Attest Twice (2026)
अथ प्रथमोऽध्यायः ॥
विद्या ददाति विनयं विनयाद् याति पात्रताम् ।
पात्रत्वाद्धनमाप्नोति धनाद्धर्मं ततः सुखम् ॥
We digitize centuries-old manuscripts. Then we build with the same discipline.
AppScale's roots are in a quiet project: structuring classical Sanskrit texts into faithful digital form. Extraction, structure, provenance, sovereignty — the same principles now power our client work.
Built for Every Business
Intelligence that never leaves the device
Offline-first, data-sovereign systems — LLMs, vector search, inference at the edge.
02Document IntelligenceAir-gapped document vaults
Sealed, searchable, provable.
03AI ProductsFull-cycle AI product builds
Mobile-first, production-grade.
04MCP & AI SecuritySecuring the agentic stack
Tool poisoning, prompt injection, confused deputies — studied and hardened.
05Indic Language AIOCR for scripts the world forgot
Sovereign OCR for Indic scripts.
06Consulting & Architecture19+ years shipping at scale
OTT, e-commerce & mobility platforms serving millions.
Blast-Radius Budgets for Write-Capable Agents: Spend, Scope and Reversibility Are Three Caps, Not One Permission (2026)
An agent's authority is a budget that depletes, not a permission that persists. Cap spend at the meter, scope in the credential, irreversibility at the platform.
Bug Bounty in the AI-Slop Era: Pay for the Reproduction, Not the Report (2026)
AI made vulnerability reports free to write and left them expensive to validate. Gate intake with identity and a runnable PoC, reproduce in a sandbox, pay for proof.
SEC Cyber Disclosure: The Four-Day Clock Starts When You Decide, So Make the Decision an Engineered Record (2026)
The SEC four-day 8-K clock starts at the materiality decision. How to engineer the facts, convening triggers and audit trail behind it, and what not to automate.
Active-Active Multi-Region: You Are Buying Disagreement, So Decide Who Wins Per Entity (2026)
Active-active is not two regions that both work; it is two regions allowed to disagree. Classify entities, pick a write model per class, and prove the failover.
ISO 27001 vs SOC 2 for Indian Product Companies: Choose the Control Set Once, Attest Twice (2026)
ISO 27001 and SOC 2 are two auditors reading one control set. Build it once, sequence by revenue geography, and skip the "SOC 2 in two weeks" package the AICPA now flags.
The Sidecar Tax: Ambient Mesh, the eBPF Data Plane, and What a Sidecarless Migration Actually Buys (2026)
Sidecarless meshes do not make L7 cheaper; they let you stop buying L7 for services that never used it. Istio ambient vs Cilium eBPF vs sidecars, with the honest limits.
Fleet Firmware Updates as a Security Control: Signing, Staged Rollout, and Rollback (2026)
The OTA updater is the root of trust after day one. A 2026 guide to offline signing keys, director targeting, A/B slots, staged cohorts and rollback that never un-patches.
AML Transaction Monitoring: The False-Positive Economics Nobody Models (2026)
AML alerts are free to generate and expensive to close. A 2026 architecture for tiered monitoring: rules for coverage, a scoring layer to route, dispositions as labels.
Carbon-Aware Scheduling: Energy as an Architecture Input for AI Datacenters (2026)
For AI work that can move in time or space, the cleanest grid hour is usually the cheapest. A 2026 guide to carbon-aware scheduling, marginal signals and clean-power procurement.
OT/IT Convergence Security: Architecture for When Downtime Is Physical (2026)
OT security inverts IT priorities — availability and safety first. A 2026 guide to Purdue zones and conduits, protocol gateways, data diodes and patching by reachability, not CVSS.
Digital Identity Wallets: Integrating EUDI and mDL Without Rebuilding Onboarding (2026)
A wallet credential is a presentation you verify, not an identity you store: integrate EUDI and mDL as a higher-assurance branch behind the onboarding step you already run.
Cyber Insurance Controls Mapped to Architecture: What Underwriters Actually Require (2026)
The cyber-insurance questionnaire is an architecture spec written by an actuary: map MFA, EDR and immutable backups to real systems, evidence each, and cut premium and loss.
Gaussian Splatting and Neural Rendering as Product Infrastructure: The 3D Capture-to-Web Pipeline (2026)
3D Gaussian Splatting became web infrastructure once delivery caught up: SPZ and SOG compression, WebGPU rendering, streamed LOD. The pipeline is the product — not the capture.
Age Assurance Architecture: Estimation, Verification, and the Privacy Trade-off (2026)
Age assurance is an attribute-release problem, not identity collection: estimation with a buffer age, double-blind tokens and retention you can prove — the 2026 architecture.
RLVR: Reinforcement Learning from Verifiable Rewards, and Where It Breaks (2026)
RLVR trains models against a verifier instead of a reward model. Where correctness is checkable it is powerful; where the checker can be gamed it fails.
Bot Management in the Residential-Proxy Era: Detecting Humanlike Automation (2026)
Rate limits and CAPTCHAs no longer stop bots riding residential proxies. The architecture that works scores intent from device, behaviour and network provenance.
Insider Threat and UEBA Architecture Without Surveillance Theatre (2026)
Insider detection fails as surveillance, works as economics: behavioural baselines, priced alerts, pseudonymised triage — the UEBA architecture that survives review.
Digital Public Infrastructure: Architecting on UPI, ONDC and Aadhaar-Class Rails (2026)
UPI, ONDC and Aadhaar give you a billion-user network without a contract — and no SLA, no chargebacks, no support queue. The architecture you owe a public rail.
External Attack Surface Management: Finding the Assets Nobody Owns (2026)
EASM is a discovery-to-ownership pipeline, not a scanner: seed, expand, verify, attribute, decide — and default unclaimed assets to decommission before they are exploited.
SIM Swap and the Telecom Channel: Designing Authentication That Survives It (2026)
SIM swap defeats SMS and voice OTP at the carrier, not in your stack. The architecture: demote the number, query carrier SIM-change signals, and tier recovery.
Bring this thinkingto your business.
conversation
One essay, most weeks. No noise.