I build with AI, and I put limits on it

Six rules

1. 1

   Rules first, model second

   Anything that can be decided by plain code is decided by plain code. The model only gets a vote on what is left.

2. 2

   Caps live in code

   Cost, rate and risk limits are enforced outside the model, where a clever prompt cannot talk its way past them.

3. 3

   Strict output or nothing

   The model answers in one fixed format. A reply in any other shape is thrown away, never guessed at.

4. 4

   Test with the model faked

   The AI client is replaced in tests, so parsing, refusal and fallback paths are proven offline, with no key and no network.

5. 5

   Measure before believing

   Benchmarks and logs, not vibes. Negative results get written down too.

6. 6

   A person owns the result

   Agents do the repeatable work. I set the bar, review the output and carry the blame.

What I have built

1. Versed

   AI inside a free product for kids

   A capped AI helper in Versed Study and AI-built flashcard decks in Versed Learn, in tools used by students.

   The guardrailPer-visitor and per-day limits enforced in a Durable Object after I proved a KV counter could not hold a rate limit. Deck generation is costed at about 3 cents a deck, so the free tier has a real number behind it. No user photo uploads on public content, and chat runs through a word filter with reports.

   Write-up: the rate limit that did not limit

2. blue-team-ai, open source

   An LLM in a security pipeline

   Syslog triage where detection rules and threat-intel matches run first and a language model classifies only what the rules could not settle.

   The guardrailTemperature zero, one fixed answer format, off-format replies discarded. If the API is down the run falls back to the rule results instead of failing. 36 offline tests with the model client faked.

   Code and passing tests on GitHub

3. Home server, 2x GTX 1080 Ti

   Running large models on my own hardware

   A 35-billion-parameter model served locally to a chat interface and an agent workspace, on nine-year-old GPUs that current toolkits have dropped.

   The guardrail46 to 71 tokens a second from measured changes only. A 48K context passed every normal check and then crashed mid-generation, so I now ship only configurations that finish a run at full depth. A script frees GPU memory when a game starts.

   Write-up: the benchmarks, including what made it worse

4. CSIT TISC 2026

   A national CTF with AI as a teammate

   TISC is Singapore's yearly individual capture-the-flag, ten levels that get harder as you go. The 2026 rules allowed AI tools, on the condition that you can explain everything they did. I only started on the final day, and cleared four levels before it closed.

   The guardrailSeveral challenges planted fake answers addressed to AI agents, so everything a challenge said was treated as untrusted input and none of the decoys were submitted. I kept a notes file per level in my own words, because a step I cannot explain is a step I do not understand yet.

   Read my write-up

5. Self-hosted agent workspace

   Debugging an agent that talked instead of acting

   My local AI agent kept announcing which tools it would use and then did nothing.

   The guardrailI tested all seven models against a raw tool-call request on both API paths before touching anything. Every model passed, so the model was not the problem. The causes were two layers up: a hidden text-based tool-calling mode, and tool definitions silently cut off by a context-size mismatch.

   Write-up: test the layers before theorising

6. Futures trading bot, paper traded

   An LLM as a bounded decision-maker

   An opening-range-breakout strategy where code filters the setups and a language model gives the final yes or no.

   The guardrailDrawdown, daily loss and position limits are enforced in code whatever the model says. One trade a day. A cooldown stops repeat calls unless the market has materially moved, which also cut the API bill. Every decision is logged and reviewed twice a week by a separate analysis run.

   Ask me about it

7. Versed content pipeline

   Agents doing real weekly work

   A scheduled agent pipeline that researches, drafts and builds a week of educational content for Versed, then publishes a review page.

   The guardrailRepeatable steps are scripts run by a cheap model. The expensive model is used once, for writing. Every research citation is verified against a literature database before a deck can ship. Hard rules: no invented users, numbers or quotes.

   See the products it supports

8. How this site and Versed get made

   Building with AI coding agents

   I direct AI coding agents the way I would run a small team: written specs, persistent project notes, review, and tests that have to pass in public.

   The guardrailNothing ships on the agent's say-so. Claims on this site were checked against the real repositories, which is how five stale tests and one detector that did not do what its README said got found and fixed.

   The repositories, with green builds