Thierno DIALLO

As AI coding agents became part of daily work, their rapid adoption exposed inconsistent quality, duplicated effort, and the absence of shared standards. In response, I led the creation of a common framework for the team.

I authored a governance model that settles the essential questions: who owns a skill, how contributions are reviewed, how each one is tested independently and released in preview first, how skills compose, how activation rules keep two of them from competing for the same request, and what quality thresholds are expected before anything is shared. To make evaluation repeatable and objective, I designed a weighted scoring rubric and implemented a deterministic Python tool that scores skills and workflows, flags critical issues, and ranks improvements by impact.

I also built reusable agent skills the team could compose — Jira issue management, GitLab pipelines and merge requests, local Git operations, feature-environment resolution, automated quality evaluation, and Kubernetes diagnostics restricted to read-only investigation, so an agent can help diagnose a cluster without being able to change it. Two orchestration workflows combine those skills into structured troubleshooting and evaluation processes, each with an explicit contract, declared dependencies, safety guardrails, and defined failure handling.

The framework is used across the team. I still review contributions, help colleagues build and debug their own workflows, unblock them when an agent or a tool integration misbehaves, and adjust the model as feedback comes in.

Company-wide Single Sign-On was the next step for a multi-tenant healthcare SaaS platform used in several countries. I designed and implemented the enterprise identity-provider integration end to end. The decision that shaped everything else was to delegate authentication while keeping roles, permissions, and organizational access under the platform's control, and without removing the existing username-and-password login.

I owned the architecture, the security model, the Java/Quarkus implementation, the coordination with stakeholders, and the technical documentation. The integration uses the OIDC Authorization Code Flow with PKCE and Pushed Authorization Requests, with state and nonce validation.

Most of the difficulty was in what happens after the login. I designed server-side management of authentication state and external tokens, including refresh and cleanup tied to the session lifecycle, and a provider-agnostic identity-mapping model that refuses ambiguous account matches. I also solved callback routing for dynamic test environments without weakening redirect validation.

The integration is now in production and actively used by healthcare professionals, providing secure federated authentication while preserving internal authorization boundaries.

Every clinical document on the platform passes through a single storage service, originally backed by self-hosted MinIO and one of the services I had helped build. When the company moved the platform to Azure, a colleague and I took on the storage workstream. Doctors use the product during their consultation hours, so there was no maintenance window long enough to move every document at once. The migration had to run with the platform live, and without losing a single file.

Rather than a single cutover, we made the service talk to both backends at once and moved the routing decision into the database: each MinIO tenant record pointed to the Azure tenant replacing it, and each clinic's bucket pointed to whichever tenant physically held it. Migrating a bucket became a database update instead of a deployment, and a feature toggle could send all traffic back to MinIO instantly, since nothing had been deleted there — precisely to preserve backward compatibility.

I wrote the Python migration tooling, run as a Kubernetes job: parallel copying, a bookkeeping table that made every run resumable, and object counts compared on both sides before any routing record was repointed — copy, verify, then switch. We ran it outside consultation hours, migrating a set of buckets, stopping, and later picking up where we had left off. I also wrote the backward-compatible read and write paths that let the two backends coexist while buckets moved across one by one.

The workstream ran for about nine months, from design through to the final cutover, with no downtime and no data loss. Once production had been stable on Azure, I owned the cleanup that removed the old implementation, its toggle, provisioning scripts, and dependencies.