I design data systems that stay secure when everything else is compromised.
Deterministic Systems Lab is an independent research initiative working on zero-trust architecture for the most regulated data environments in healthcare, fintech, and federal government. The other half of the work is talking and writing honestly about what actually breaks in production.
The Problem
The credentials running your pipeline never expire.
That's the problem.
Most automated data pipelines run on long-lived service accounts. They're over-privileged, they sit around for 90 days between key rotations, and they're the fastest-growing attack surface in cloud data environments. In a federal healthcare system under FedRAMP High, one compromised ingestion role can mean bucket-wide access to an entire data lake.
Compliance frameworks don't close this gap. FedRAMP, HIPAA, and SOC 2 document that a system was secure at a point in time. They say nothing about whether it's secure right now, mid-transaction, while data is actually moving. The paperwork passes the audit. The service account is still sitting there with keys to everything.
The work here starts from a different assumption: that any long-running credential will eventually be compromised, so the goal is to shrink what a compromised credential can reach and how long it lasts.
The
Work
One shipped protocol, and the research driving it.
Identity-Per-Transaction (IPT) Instead of a static service account, the pipeline mints a unique, cryptographically scoped credential for every single file transaction, then destroys it milliseconds later. A compromised credential exposes one object for a matter of minutes rather than an entire data lake for months. Evaluated in a production FedRAMP-High environment, this cut the blast radius of a compromised identity by over 99.9% while keeping throughput linear.
IPT is implemented and public as pymayfly, an open-source credential library on PyPI with AWS, Azure, and GCP backends. It isn't a diagram. You can install it and read the code.
Where
the Research
is Going
Current Directions
IPT solves credential-mediated access risk at the batch level. It doesn't solve everything, and the interesting problems are in what it leaves open. If you're working on non-human identity, streaming authorization, agentic accountability, or re-identification defense, get in touch. I'd love to compare notes.
Three directions I'm actively working on, I'm keeping the specifics of the last two close while they develop:
-
Extending the per-transaction identity model from batch file ingestion to continuous streaming data, where the transaction boundary is much harder to define and the credential lifecycle has to keep up with the flow.
-
As autonomous agents start taking actions inside data pipelines, the question of who authorized what, and how you prove it after the fact, gets sharper. This is early, and it's where a lot of my attention is going.
-
My Ghost Drivers research showed that "anonymized" telemetry can be re-identified with 96% precision from spatiotemporal patterns alone. This direction turns that around: membership inference and re-identification attacks leave a trace in the sequence of queries an adversary runs, and I'm looking at whether tracking that query trajectory as a graph can detect and stop the attack before it succeeds.
Talks
Where this work has been presented
PyCon US
Zero Trust in 200ms: Implementing Identity-Per-Transaction with Python and Serverless
Long beach, CA - May 2026
IEEE BigDataSecurity
Zero-Trust Data Engineering: A Reference Architecture for Serverless, FedRAMP-High Healthcare Pipelines
NEw york city, Ny - May 2026
Santa clara, ca - june 2026USENIX PEPR
The Disposable Identity: Eliminating Non-Human Identity Risk in Federal Healthcare Pipelines
Seoul, Korea - aug 2026PyCon Korea
Tutorial: Build a Zero-Trust Data Pipeline in Python (Without an AWS account)