Marlow Fernandez

Since January 2026 I've been building an AI governance practice through Vynkor: the controls, review standards, and evaluation work a team needs before putting models anywhere near regulated systems. The proving ground is a set of running proofs of concept rather than a whitepaper.

Day to day that means a self-hosted stack. OpenClaw as the agent runtime in Docker, LiteLLM as the gateway in front of every model call, and MCP for the tool surface an agent is allowed to touch. The gateway is where most of the interesting work lives: capability-tier routing so the runtime never names a vendor, virtual keys with per-workload budget caps and spend attribution, and prompt payloads kept out of proxy logs and third-party integrations. Models run both ways, frontier APIs through the gateway and local inference on llama.cpp and Ollama, currently Qwen3.8-27B and Muse Glimmer 30B on my own hardware behind a Cloudflare tunnel, presented to callers as ordinary OpenAI-compatible endpoints. Terraform, Docker Compose and GitHub Actions hold it together, including an automated PR review that runs through that same gateway on a cost-capped key.

The pattern I keep coming back to is removing capability rather than restricting it. The agent in the current POC has three typed tools and no shell, so the things it must not do have no function to call rather than a rule to break. The other half is verification: checking the running instance rather than the committed config, after finding more than once that a green test suite was answering a different question than it appeared to. Both lessons came from breaking the thing myself, which is the argument for proofs of concept over slide decks.