from the shelf of Zoey Jia
The Trophy Cabinet
Eight ways to go wrong in this book. Collect them all.
or, Who May Pass
Cozy in here. The gate approves.
“Before you go any further, the gate would like to know who you are.”
Pick a bookmark and slip it into the book.
The short road: a map, and a résumé.
The long road: the whole fable, traps included.
“Who goes there? Every request that enters this kingdom must say who it is. So, I'm afraid, must you.”
I'm Zoey (Huiwen), and I keep the gate. At Ring, in Cloud Connectivity, I work on the part of the system that decides who you are, which devices you can see, and what you may turn on.
It sits underneath features like Search Party and Fire Watch. I came as an intern in 2025 and stayed. My rubber ducks (the AI agents I work with, page 9) call this the founding of the kingdom.
If you wonder how a philosopher came to keep a gate, turn to page 2.
If you would like to see the gate, turn to page 4.
If you came only for the rubber ducks, turn to page 9.
If you are a recruiter in a hurry, unfold the map.
If you would like to read the internal design docs, turn to page 451.
“Philosophy. Cloud. A startup. A master's degree. Every road ended at a laptop.”
Before the gate, I wandered.
“Charms! Earn them by questing, spend them on wonders, and come back tomorrow. Everyone comes back tomorrow.”
For one winter I sold charms. At Character.AI, as an intern on the monetization team, I built Charms into the iOS and Android apps: perks you earn with daily quests instead of a subscription.
If you would like to see what I guard now, turn to page 4.
If you have already spent all your charms, turn to page 402.
“HALT. None shall pass without a token, a role, and a name in the proper document.”
This is the gate I keep: the API gateways and authorization services that ask, for every request, “may this person do this?”
Things a gate gets blamed for, an incomplete list:
If you hold a valid token, turn to page 5.
If you hold no token, but a very good reason, turn to page 401.
“I walk behind you and repeat everything you say. No one listens to me. That is the point.”
Search Party asks neighbors' outdoor cameras to look for a lost dog, and Ring says it reunites more than a dog a day. Something must decide which cameras may join. That is my part.
The answer used to live in a list kept by hand. I wrote the design and led the move into a dedicated eligibility service, checked inside authorization itself.
If you smell smoke, turn to page 6.
If you would rather skip the shadow and enforce on day one, turn to page 500.
“The hills are burning, and you would make them tap seven times? One tap. ONE.”
Fire Watch helps neighbors spot wildfires. I was the point of contact for the gate's side of its one-click activation: one click for the customer, several teams for everyone else.
I mapped the path, settled who owned which door (longer than the code, as is tradition), and rolled it out region by region through configuration, because nobody redeploys near a wildfire.
If you would like to know what happens after something goes wrong, turn to page 7.
If you would like to settle which team owns the endpoint, turn to page 409.
“Tell me what happened. Not what you remember. What HAPPENED. Bring the timestamps.”
When things go wrong, someone writes it down. I have written two post-incident reviews, the first in my second month, which is a very efficient way to meet everyone.
I rebuilt the timelines from primary sources, fixed the figures earlier drafts had wrong, and saw one through senior review to publication.
If you would like a key, turn to page 8.
If you would like to find out whose fault it was, turn to page 404.
“I open one door, for one traveler, for one hour. Then I forget their face.”
I made the gate hand out short-lived delegated tokens, so a service further in can act for a user without ever holding the user's own key.
Along the way I found a missing permission that still produced a perfectly successful, perfectly empty key. It returned 200. It was very proud of itself.
If you hear quacking, turn to page 9.
If you would like a key that never expires, turn to page 403.
“We used to just listen. Then we started talking back. Now we would very much like to run rm -rf. The gate says no.”
Engineers explain their code to rubber ducks. Mine talk back: a workspace of AI coding agents, each on one problem, with a default-deny guard between them and anything that matters. It became an accepted talk at an internal developer conference.
“The word that best describes Zoey is source?”
Duck #3, under oath
squeeze a duck
If you have learned nothing yet, turn to page 10.
If you would like to give a duck production access, turn to page 200.
Every fable has one. This one has five, each learned by first doing the opposite.
If you would like to know where the road goes next, turn to page 11.
“Shh. One shelf so far. The quietest library in the kingdom.”
The road ahead runs into the woods where the agents live: AI agent security, letting an agent act for someone without letting it do everything that someone can. Field notes go on these shelves once they reproduce.
Volume I
Every rule is one hop away: bypassing tool-call guards in AI coding agents
still writing this one ✎
If you would like to see how this fable ends, for now, turn to the last page.
The End.
If you are a recruiter after all, unfold the map.
If you would like to look up from the book, there is a shelf behind it.
If you would like to start again, turn to the cover.
If you would like to write to the engineer, send a raven (or a LinkedIn message).
Zoey (Huiwen) Jia · Software engineer, Ring (Amazon) · San Francisco Bay Area
API gateways and authorization. Led the device-eligibility design behind Search Party, from shadow mode to production. Point of contact for Fire Watch one-click activation. Short-lived delegated tokens at the gateway. On-call for three services, and post-incident reviews.
Monetization: built Charms into the iOS and Android apps.
Ticket-triage automation for a gateway routing service. Parity testing for an Nginx to Envoy migration by mirroring production traffic.
M.S. in Computer Science.
Built AmaSpeak, an AI English coach, as its full-stack engineer. Ran marketing for AMA Interview.
Cloud AI, Hangzhou.
B.A. in Philosophy, Politics and Economics.
Heading AI agent and LLM security.
Tools Java, Python, JavaScript and TypeScript, AWS, Envoy, authorization and identity.
Project statement · 2026
A personal harness for running many AI coding agents at once, safely.
A workspace built on Claude Code. Each tab is its own agent with exactly one topic, launched with a written goal and a short list of folders it may write to. Every tab runs behind a guard that reads every tool call before it happens: reads are free, writes stay inside the tab’s own folders, and anything the outside world would see is refused. Around the tabs sits a set of small command-line tools for drafting, judging, watching, remembering, and checking.
The first version was an orchestrator, three isolated research workers, and a synthesizer that merged their findings into a knowledge base, keeping contradictions and naming its gaps. The workers ran in parallel not for speed but because shared context degrades quality: a single session got worse after four or five sources. I also tried two ways for agents to coordinate, claiming work through git locks or assigning it up front. The output was equally good; the static version took minutes to set up instead of ten and never failed to claim its work. That became the default.
59 small tools~20,000 lines6 skills of my own4 guard profiles
A hook that refuses to let a message claim a cause without a number beside it is drafted, but not wired in. Desktop notifications cannot prove they were seen. And the guard has been wrong before: red-teaming it, I once walked past every rule with a single ssh hop. That is why the bypass hunt is now its own research, on the library shelf.
402.
Payment required. The Merchant smiles warmly. The Merchant will see you tomorrow. And the day after that.
401.
The gate has heard your reason. The gate was genuinely moved. The gate still requires a token.
500.
The new path disagreed with the old one in a way nobody measured. The customers measured it for you.
Turn back to page 5, and let the shadow walk a little longer.
404.
Culprit not found. A good review hunts for mechanisms, not people. People are rarely the root cause. They are usually just the last ones holding it.
403.
Forbidden. A key that never expires is not a key. It is a liability with a nice handle.
451.
Unavailable for legal reasons. Some pages of this book were written in confidence, and they stay that way. They did not burn. Probably.
409.
Conflict. Three teams believe they own the endpoint. Two believe nobody does. A meeting has been scheduled. It will be followed by a document.
200.
OK. Everything succeeded. The duck is thrilled. And that is exactly the problem: the scariest response is a success that should have been a no.