Principal Software Engineer, Agent Policy Fabric

What you'll do

• Build and harden the Runtime Policy Verifier, signed policy bundle verification, and trust-root handling.
• Implement deterministic projections from canonical APF policies into OpenShell-native runtime policies and constraints.
• Create conformance suites, including golden fixtures, fuzz tests, and property tests to prove runtime contract adherence.
• Define public substrate interfaces for runtime-context attestation, adapter path declaration, and session hooks.
• Establish architecture standards for versioning, schema compatibility, latency budgets, and fail-closed defaults.
• Write technical specifications and defend bounded security claims during architecture reviews for internal and partner teams.
• Convert working-draft contracts into engineering artifacts for Product Security, Fleet, and Identity teams.

What we're looking for

• Bachelor's degree or equivalent experience.
• 15+ years of industry experience in systems software, security engineering, distributed systems, or policy infrastructure.
• Strong programming skills in Rust, Go, C++, or Python.
• Experience designing production services, APIs, schemas, policy engines, authorization systems, or signed artifact pipelines.
• Familiarity with Linux systems, IPC, protobuf/gRPC, CI, test automation, and cloud or enterprise deployment environments.
• Practical experience with authorization, cryptographic signatures, trust roots, revocation, and zero-trust architecture patterns.
• Ability to write technical specifications, align engineering owners, and turn architecture drafts into buildable interfaces.
• Experience with OPA/Rego, Cedar, Zanzibar-style authorization, or policy compilers (preferred).