Software Architecture and System Design News
Latest curated articles from top engineering blogs
Shopify
AWS432 articles
AWS Architecture Blog·17h agoArchitecting for Digital Sovereignty on AWS using the Well-Architected Framework
This article introduces the AWS Digital Sovereignty Lens, an extension to the Well-Architected Framework that provides guidance for designing, building, and operating cloud workloads with strict sovereignty requirements. It outlines five key architectural concerns for sovereign workloads: locality, access control, continuity, portability, and transparency, and details how existing AWS controls and best practices can be layered to meet these mandates.
Meta's NTS: Building an Authenticated, Stateless Time Service at Scale
Meta discusses the implementation of Network Time Security (NTS) to provide authenticated time, addressing the long-standing vulnerability of unauthenticated NTP. The article details the stateless architecture for cookie management and key derivation, ensuring high availability and scalability while protecting against critical security risks like certificate invalidation and token expiry due to manipulated clocks. This system design is crucial for modern internet security where precise and verifiable time is a fundamental building block.
Building an AI Agent Gateway for Tool Access and Security
DoorDash developed a dedicated Agent Gateway to manage how AI agents discover, access, and securely use various tools and services within an enterprise environment. This gateway centralizes critical functions like authentication, authorization, credential management, tool catalog curation, and operational monitoring, addressing the complexities that standard protocols like MCP do not cover at scale. The architecture separates concerns into a data plane proxy and a control plane registry to enforce policies and ensure consistent security and access control for AI agents.
Adaptive Application Security in the AI Era
Cloudflare addresses the evolving landscape of application security, particularly with the rise of AI-driven attacks and AI-assisted development. They propose a connected, continuous application security framework that integrates risk discovery, access governance, runtime protection, and incident response, leveraging global threat intelligence and local application context through their extensive network visibility.
Designing a Resilient Public Certificate Authority at Scale: Cloudflare's Approach
Cloudflare is becoming a public Certificate Authority (CA) to enhance the web's security and resilience. This move involves acquiring an established root for broad compatibility and launching new roots for future standards like post-quantum cryptography. The initiative emphasizes designing for fault isolation, automated certificate management via ACME, and transparent operations to ensure high reliability and widespread adoption across the Internet.
Building an AI-Powered System for Post-Quantum Cryptography Migration at Cloudflare
Cloudflare is leveraging AI to build an internal tool, CryptoLabe, to manage their massive post-quantum cryptography migration by 2029. This system is designed to discover cryptographic usages in their vast codebase, analyze their runtime behavior and dependencies, and provide actionable reports to engineering and product teams. The architecture utilizes Cloudflare's Developer Platform components like Workers, D1, Durable Objects, Workflows, and R2 for scalable and isolated code scanning and analysis.
Designing Payment Integrations for AI Agents with Incremental Authorization and Financial Insights
This article discusses how Stripe's Link platform is evolving to support AI agents making purchases on behalf of consumers. Key architectural considerations include implementing incremental authorization for dynamic pricing, leveraging financial insights for smarter recommendations, and providing purchase protection for agent-driven transactions. These features address reliability, trust, and user experience in the context of autonomous spending.
Understanding Self-Replicating Prompt Injections and AI System Security
This article from OpenAI describes a new class of prompt injection attacks that can self-propagate like computer worms within AI systems. It highlights how these 'self-replicating prompt injections' aim to achieve malicious goals and induce models to reproduce the injection, posing a significant security challenge for AI system architects. Understanding these attack vectors is crucial for designing robust and secure AI-powered applications and platforms.
LLM Safeguards and Dynamic Model Routing for AI Systems
This article discusses Anthropic's implementation of cyber safeguards and dynamic model routing for Claude Sonnet 5.5. It details a multi-stage enforcement process involving classifiers and model fallbacks to manage security risks and optimize resource utilization for AI workloads. The system design considerations highlight trade-offs between security, performance, and user experience.
AI's Impact on Travel Platforms: Architectural Shifts and Fraud Prevention
This article explores how AI is reshaping the architecture of online travel platforms, moving from monolithic AI agents to specialized, interconnected components. It highlights the challenges and solutions related to integrating AI agents, managing fraud in automated transactions, and enhancing customer experiences through connected trip architectures, with a focus on Stripe's role in facilitating agentic commerce.
Architectural Review of Low-Latency Telemetry Streaming and Resilient Edge Hydration
This article provides an architectural overview of systems designed for low-latency telemetry streaming and resilient edge hydration in dynamic web environments. It delves into critical components such as thread-isolated event loops for efficient processing, cryptographic state validation for data integrity, and regional clearing infrastructures for robust data aggregation and distribution. The focus is on the interplay of these elements to ensure high performance and reliability at scale.
Designing Secure AI Agent Execution Environments with Hardware-Assisted Sandboxing
This article introduces Nvidia's Open Agent Safety Platform, a system designed to prevent AI agents from escaping their sandboxed environments and accessing unintended resources. It highlights the architectural approach of combining a software-defined runtime (OpenShell) with a hardware-based watchdog (Nvidia Sentry) for enhanced, deterministic enforcement of agent policies, addressing the limitations of model-level safeguards.