|
Missing trailers, cargo theft, identity fraud, internal collusion — across EU and NA lanes for Amazon Transportation. Then I write down the method so other teams can use it. |
EU AI Act, GDPR, ISO/IEC 42001, NIST AI RMF — turned into tools a team can act on in an afternoon instead of a quarter. |
Everything below runs client-side or offline. No uploads, no server, no telemetry, zero dependencies.
flowchart LR
A["🔍 Carrier fraud investigations<br/>Amazon Transportation"]
B["📖 freight-fraud-taxonomy<br/>12 patterns · 77 indicators"]
C["🗺️ freight-risk-atlas<br/>control-coverage scoring"]
D["📡 FOMO<br/>EU risk news monitor"]
E["📜 EU AI Act · GDPR<br/>ISO 42001 · NIST AI RMF"]
F["🇪🇺 eu-ai-act-scanner"]
G["🔒 gdpr-compliance-scanner"]
H["🎛️ ai-governance-control-room<br/>4 frameworks · 56 reqs · 29 controls"]
I["📋 policy-audit<br/>evidence vs. policy audit"]
A --> B --> C
A --> D
E --> F --> H
E --> G --> H
E --> I --> H
classDef freight fill:#0b2b3a,stroke:#38bdf8,stroke-width:2px,color:#e2e8f0
classDef gov fill:#1e1b4b,stroke:#818cf8,stroke-width:2px,color:#e2e8f0
classDef src fill:#111823,stroke:#5b6b82,stroke-width:1px,color:#8b9bb4
class A,B,C,D freight
class F,G,H,I gov
class E src
|
An open reference taxonomy of freight and carrier fraud — 12 patterns, 77 detection indicators, 137 countermeasures split preventive / detective / responsive, plus 31 false-positive tests so the indicators don't fire on legitimate carriers. Sourced to 11 public references. |
|
|
A carrier risk assessment engine — scores how well controls cover three stages: pre-award, in transit, post-event. It measures coverage, not probability of fraud, and says so. Ships an interactive detection timeline and a fraud-pattern relationship network. |
|
|
A logistics and supply-chain risk news monitor for the German/EU market. English and German sources, categorised by risk type, re-scanned automatically every six hours by a GitHub Action. |
|
|
A living freight-fraud investigation simulator. A freight network runs itself — trucks, drivers, trailers and carriers over a real topology — and the analyst sees only what was recorded. What actually happened is held in the simulation and is structurally unreachable from every analyst-facing surface, so the exercise cannot be gamed by reading the answer. |
|
|
A loss-prevention reading of European police-recorded crime: 8 Eurostat offence categories, 41 countries, 2008–2024 — plus a German BKA panel that reaches 2025, carries a shoplifting category Eurostat has no code for, and breaks down to all 16 Bundesländer. The reasons it might be wrong are printed above the charts, not in a footnote. |
|
|
A tiny farewell arcade game built on the taxonomy above: flag or clear 108 real cards — 77 genuine risk indicators, 31 genuine innocent explanations — against a 60-second clock that tightens its pace in the last third. Best score persists locally. No invented data, no backend. |
|
|
An operator console for AI governance. 4 frameworks mapped to 56 requirements and 29 controls, with 84 evidence artefacts — so for any one control you can see everything it satisfies at once. 8 controls span three or more frameworks. |
|
|
Classify an AI system against Regulation (EU) 2024/1689 in about ten minutes. 14 risk-qualifier questions, each mapped to a specific article with an "explain why" panel → 22 requirements across 5 risk tiers → compliance score, ISO 42001 + NIST AI RMF crosswalks, exportable report. |
|
|
Drop in a CSV / Excel / JSON file, get an instant GDPR exposure report: which columns hold personal data, how sensitive, what to do about it. 35 field-name rules + 9 value-regex detectors, risk score out of 100. Parsing happens in your browser — the file never leaves your machine. |
|
|
Natural-language search over the Control Room's 56 cited requirements, ranked with a BM25 implementation written from scratch — no embeddings, no external model, no API key. Shows exactly which query terms earned a result its rank. |
|
|
Self-assessment coverage against Regulation (EU) 2022/2554 (DORA) — 19 cited requirements across the ICT risk-management, incident-reporting, resilience-testing and third-party pillars. Answer, score, export; the citation for every requirement travels with it. |
|
|
The evidence side of governance: feed it a document corpus (policy, architecture, code) and it finds where regulation → control → documented policy → actual implementation diverges, with every finding traced back to the source text. Doesn’t replace a control room — feeds one. |
|
|
Seven named agents investigate a real repository together — one maps it, one stress-tests it, one audits the others. 815 tests across 60 files, 30 of them adversarial attacks (16 guard-layer + 14 council-layer) against the agents themselves, because an investigator you cannot attack is one you cannot trust. |
|
|
A persistent synthetic freight-carrier economy that ticks forward one real day at a time via an unattended GitHub Action, while a BYOK AI council investigates flagged incidents from a redacted case brief that never carries the sim's own ground truth. A public leaderboard tracks the council's win rate against fraud it never gets to see labelled. |
|
|
An operational risk register that runs entirely in the browser — register, scoring, treatment plans and review cycles, with import/export so the data stays yours. No account, no server, no telemetry. |
|
|
AI decision forensics: replay a model’s past decision deterministically, mutate one input, and see exactly how the outcome and its governance score would have changed — a counterfactual you can inspect, not just an accuracy number. |
|
A trained fraud classifier evaluated against ground truth from a simulator built to have some (structuring, layering, collusion rings), not a downloaded 99.8%-legitimate CSV. Honest metrics, SHAP explainability, graph-based collusion-ring detection. |
|
Seals a forecast before the outcome exists, grades it once reality arrives, and refuses to forecast when the history can’t support the evaluation protocol. Real Eurostat data, rolling-origin backtest, MASE, no hindsight. |
|
|
An interactive zoom through ten scales of the universe, from one planet surface to the edge of the observable universe — then two steps further, into territory explicitly labelled not measured. Two AI models run in your browser: one searches by meaning, one talks. |
|
|
An interactive 3D galaxy for quantum physics: 20 concepts orbit as planets across 5 themed solar systems around a central black hole. Ask a question in plain language and an in-browser AI flies you to the concept that answers it. |
|
|
A browser survival-shooter with a deterministic engine underneath the spectacle: waves, weapons, bosses, maps and loadouts, built in autonomous phased sessions with a real test suite over the pure engine/AI/collision logic. |
|
|
A dark-fantasy habit-tracker RPG: real workouts, reading, and daily discipline earn XP, creatures and gear in a vanilla HTML/CSS/JS game with no framework and no backend. v2.3's retention systems (streak shields, daily directives, loot caches) live in one additive file that wraps the core engine through guarded hooks, so a thrown error falls back to the original shipped game instead of a blank screen. The creature/boss universe here is what HAKAI // WORLD below was built from. |
|
|
An explorable 2.5D living world built from the HAKAI Protocol universe — same creatures and lore, walked into instead of clicked through. Two known test failures are named in the README, not hidden. |
|
|
A puzzle game where the rules are never quite what they seem — every generated level is BFS-verified solvable before it’s shown, so a level that looks unfair is provably not. |
| Model-driven fraud prevention impact | >$15M |
| Reduction in EU/NA carrier-audit false positives | ~40% |
| Loss-forecasting engine accuracy | ~95% |
| Risk reporting automated, manual → generated | ~90% |
| Monthly audit events monitored | 80K+ |
| Investigators working off the RCMT wiki + SOPs I wrote | 20+ |
I apply DMAIC to risk problems: find the risk → analyse the data behind it → automate the manual step out of it → measure whether it actually moved.
AWS Lambda Amazon Bedrock Amazon Connect Amazon Lex Regulation (EU) 2024/1689
🏆 Certifications
- ☁️ AWS Certified Solutions Architect
- 📊 Lean Six Sigma Black Belt & Green Belt
- 🔐 ISO 28000 Supply Chain Security · ISO 9001 Internal Auditor
- 🛡️ Cybersecurity Foundations · Power BI / Data Analytics · Risk Management
🧰 Other things I've built
- All-in-one-desk — offline-first Python productivity suite: document conversion, OCR, KPI calculators, email and flowchart generators. Flask · Tesseract · LibreOffice · PyInstaller.
- hakai-protocol-v2 — a real-life RPG for habits: quests, XP, gear, bosses, streaks. Zero dependencies, offline save system. Live
- a-conversation-with-existence — a book I wrote.
- mind-galaxy — the book's 18 chapters, laid out as an explorable 3D galaxy instead of a table of contents.
🌱 What I'm working toward
- Deepening the EU AI Act / ISO 42001 / NIST AI RMF intersection beyond what the tools already encode
- Applying anomaly detection to carrier fraud patterns
- Moving into AI governance / risk roles in the EU market
