Week 13 — Guardrails & security¶

At a glance

Phase 4: Production & AI Architecture · Starts: Mon 21 Dec 2026 · Planned: 16h 45m

Build: Capstone: guardrails layer (input/output/tool), prompt-injection red-team suite in CI

By day¶

System Design · 45 min · Rate limiting: token bucket, leaky bucket, sliding window log/counter; distributed limits with Redis + Lua → Rate limiting & quotas w13-sd-1
DSA · 25 min · Max Area of Island + Clone Graph → Graphs: BFS, DFS, topological sort, union-find · resource w13-dsa-1
Python · 20 min · Rep: structlog JSON logging with contextvars (request_id, tenant, run_id) → Observability in Python: structlog, OpenTelemetry w13-py-1
Communication · 30 min · Grammar: Nominalisation vs strong verbs (clear writing) → Week 13 drills · day 1 w13-comm-1

Agentic AI · 60 min · OWASP Top 10 for LLM Apps + OWASP Agentic Top 10 2026 (ASI01-ASI10) — threat-model the capstone per item → Guardrails & security: OWASP LLM/Agentic Top 10, prompt injection · resource w13-ai-1
DSA · 30 min · Pacific Atlantic Water Flow → Graphs: BFS, DFS, topological sort, union-find · resource w13-dsa-2
Communication · 30 min · Vocabulary: Executive vocabulary: mandate, remit, accountable → Week 13 drills · day 2 w13-comm-2

DSA · 25 min · Surrounded Regions + Rotting Oranges (multi-source BFS) → Graphs: BFS, DFS, topological sort, union-find · resource w13-dsa-3
Architecture · 45 min · AI-native architecture: LLMs as non-deterministic components — deterministic shells, eval gates, fallbacks, human override (FoSA 2e GenAI chapters) → AI-native architecture: LLMs as system components w13-arch-1
Python · 20 min · Rep: OpenTelemetry manual spans around tool calls with GenAI attributes → Observability in Python: structlog, OpenTelemetry · resource w13-py-2
Communication · 30 min · Speaking drill: The 3-minute executive briefing → Week 13 drills · day 3 w13-comm-3

Agentic AI · 60 min · Lethal trifecta (private data + untrusted content + exfiltration): find every trifecta path in the capstone and design mitigations → Guardrails & security: OWASP LLM/Agentic Top 10, prompt injection · resource w13-ai-2
Java/Spring AI · 30 min · Micrometer observations for Spring AI ChatClient/VectorStore; view token metrics → Observability & testing: Micrometer, OTel, Testcontainers w13-java-1
Communication · 30 min · Idioms & phrasal verbs: Money talk: bottom line, cost a fortune, break even → Week 13 drills · day 4 w13-comm-4

System Design · 45 min · AuthN/Z: OAuth2/OIDC flows, token exchange, multi-tenant isolation, zero trust — how MCP OAuth fits → Security: authN/Z, OAuth2/OIDC, zero trust, multi-tenancy w13-sd-2
DSA · 25 min · Course Schedule + Course Schedule II (topological sort) → Graphs: BFS, DFS, topological sort, union-find · resource w13-dsa-4
Python · 20 min · Rep: FastAPI middleware for OIDC JWT validation + tenant resolution → FastAPI for production w13-py-3
Communication · 30 min · Writing: Executive updates → Week 13 drills · day 5 w13-comm-5

Agentic AI · 120 min · Capstone build: guardrails (input classification, tool allow-lists + arg validation, output PII redaction) + promptfoo OWASP agentic red-team preset in CI → Guardrails & security: OWASP LLM/Agentic Top 10, prompt injection · resource w13-ai-3
DSA · 30 min · Number of Connected Components (union-find) + Graph Valid Tree → Graphs: BFS, DFS, topological sort, union-find · resource w13-dsa-5
Java/Spring AI · 30 min · Write the polyglot rationale: which capstone parts belong in Java vs Python and why → Java vs Python for AI: polyglot architecture decisions w13-java-2
Communication · 30 min · Record & shadow: The 3-minute executive briefing → Week 13 drills · day 6 w13-comm-6

System Design · 45 min · Written design: multi-tenant LLM gateway — auth, quotas by tokens, routing, caching, fallbacks, audit, cost attribution → Design a multi-tenant LLM gateway · resource w13-sd-3
Architecture · 30 min · Write ADR 013 for capstone: guardrail placement (gateway vs in-graph vs tool server) and fail-closed policy → AI-native architecture: LLMs as system components · resource w13-arch-2
Staff+ · 30 min · Read lethain on writing engineering strategy (diagnosis, policy, actions); pick a strategy topic from work → Writing engineering strategy & vision · resource w13-staff-1
Communication · 30 min · Soft skills + weekly review: Stakeholder mapping and framing → Week 13 drills · day 7 w13-comm-7
Review · 60 min · Explain-it-back: OWASP agentic top risks + lethal trifecta; flashcards on rate limiting algorithms → Guardrails & security: OWASP LLM/Agentic Top 10, prompt injection w13-rev-1