Gustavo Queiroz in a mirror selfie in a lift.

Software engineering, applied AI and a bookshelf.

The best wayto predict the futureis to invent it.

Alan Kay

Recent work

2 of 17
karpadotcg.com
Karpado Store

Karpado Store

A Pokémon card store with daily auctions, monthly raffles and an inventory to track won cards and every shipment.

2026

Visit the site
  1. 2026
  5. 2025
  10. 2024
  12. 2023
  13. 2023–25
  14. 2022
  15. 2021

Bookshelf

Everything I've read, from engineering to history.

62 books by 49 authors, across 9 topics. Average score 8.1.

All booksReading trails

Sort by

Topic

Score

Writing

  1. 2026

    Authorization in four questionsCapability, partition, relationship and tenant. Each question with its own mechanism, and no role trying to answer all of them.

  2. Cached permissions go stale in three waysUser version, catalog version and the clock. None of them can depend on a cron job.

  3. Who can give power to whomUsing a capability and granting it are different authorities. Model both.

  4. The prompt is not a security boundaryWhen an LLM writes the query, authorizing who asks isn't enough. What matters is what the answer can touch.

  5. A log is not one thingOperations, grants and access differ in volume, retention and criticality. And not every audit failure should have the same consequence.

  6. A foreign key doesn't guarantee the tenantA foreign key proves both rows exist. It doesn't prove they belong to the same customer.

  7. Mask before you call the LLMSwapping an ID for a placeholder is the start. The hard parts are the reverse map, the detector, the quasi-identifiers and the answer that comes back with the wrong placeholder.

  8. AI amplifies execution, not judgmentThe bottleneck moved from implementing to reviewing.

  9. ReBAC and RBAC: when to use eachRoles for what is broad, relationships for what is per resource.

  10. V60 without the fussRatio, grind and one variable at a time.
All writing