That work rests on a deep foundation. Across regulated industries — energy and utilities, banking, healthcare, insurance, higher education, and government — Max has architected enterprise identity programs spanning identity governance and administration (IGA), privileged access management (PAM), access certification, role-based access control (RBAC), federation, single sign-on, and multi-factor authentication. He implemented a privileged access management program for a major North American energy and utilities company, securing the credentials behind critical infrastructure operations, and has led identity governance rollouts onboarding hundreds of mission-critical applications and cleansing identity data for well over a hundred thousand users under aggressive audit deadlines. His programs have repeatedly satisfied demanding compliance regimes — SOX, HIPAA, GDPR, PCI, FFIEC, and others — giving him a practical, audit-tested command of the governance and least-privilege disciplines that secure AI now urgently requires. 

Max pairs that identity heritage with hands-on AI engineering. He has architected and deployed production LLM and multi-agent systems on cloud-native, serverless infrastructure: a document-intelligence platform using managed retrieval-augmented generation (RAG) services to automate ingestion of complex technical and contractual documents at enterprise scale, a multi-agent procurement-optimization framework, and a graph-based agentic system for automated regulatory-compliance mapping. In each, security and identity were engineered in from the foundation — least-privilege access, scoped execution roles satisfying organization-level governance policies, agent credential vaulting, and tool-level authorization controls — rather than retrofitted. 

Where most teams are only beginning, Max has already done the work of extending identity to non-human actors. On a production multi-agent system he progressively hardened authorization from coarse OAuth/RBAC toward fine-grained, dynamic authorization, and he has designed credential brokering, scoped tokens, delegation, and tool-gateway policy controls for AI agents. He approaches these systems with an adversarial mindset, performing attack-path analysis and threat modeling against the failure modes specific to agents — prompt injection, tool misuse, unsafe delegation, data exfiltration, and unauthorized expansion of an agent’s privileges mid-workflow — and he pairs every system with end-to-end observability and structured audit logging so that agent actions, tool calls, and credential usage remain traceable and defensible. He designs toward the identity and access standards that underpin trustworthy agentic systems — OAuth 2.0/2.1 and OIDC for delegated authorization, SCIM for identity lifecycle and provisioning, SPIFFE for workload identity, AuthZen for fine-grained authorization, and certificate lifecycle and secrets management — alongside emerging agent-protocol standards such as the Model Context Protocol (MCP). 

Within the AEC context, this protects what these firms can least afford to lose: intellectual property in drawings, models, and specifications; confidential bid and contract data; and the integrity of the AI copilots and project-management agents now making real decisions on real projects. Max designs secure “paved-road” patterns that let engineering and construction teams adopt agentic AI safely — ensuring a scheduling agent cannot reach privileged financial data, a design-review model cannot be manipulated into leaking proprietary work, and an automated document workflow cannot become an exfiltration channel — while bringing the same compliance discipline that satisfied auditors in banking and healthcare to the contractual and regulatory standards the construction industry demands. 

Max pairs hands-on engineering with deep analytical rigor. He teaches graduate courses — spanning probability, simulation-based inference, and regression — in the University of Texas at Austin’s highly regarded MSAI (Master of Science in Artificial Intelligence) program, building on a magna cum laude background in mathematics and physics. A polyglot engineer who selects the right language for each job across AI workloads and cloud-native infrastructure, he is fluent at framing an ambiguous problem, prototyping the highest-value solution quickly, and evolving it into a reliable production system. 

Key Accomplishments 

• Architected enterprise identity and access programs across energy/utilities, banking, healthcare, and insurance, including a privileged access management (PAM) implementation for a major North American energy and utilities company. 

• Hardened a production multi-agent AI system’s authorization model from coarse OAuth/RBAC to fine-grained, dynamic authorization, and designed credential vaulting and tool-level policy controls for autonomous agents. 

• Architected and delivered an AI-native document-intelligence platform on managed RAG services, reaching [95–100%] field-level accuracy across [eight] product lines with a [71]-test automated validation suite, secured with least-privilege access and structured audit logging. 

• Led identity governance rollouts onboarding [100+] mission-critical applications and cleansing identity data for [100,000+] users under aggressive audit deadlines, satisfying SOX, HIPAA, GDPR, and PCI requirements. 

• Applies modern identity and access standards relevant to agentic security — OAuth 2.0/2.1, OIDC, SCIM, SPIFFE, AuthZen, and certificate lifecycle management — to credential brokering, delegation, and workload-identity design for AI agents. 

• Implemented end-to-end observability and audit logging for agentic pipelines, enabling traceability of agent actions, tool calls, and credential usage for incident investigation and compliance. 

• Teaches graduate courses in UT Austin’s highly regarded MSAI program, bringing formal statistical rigor to AI risk assessment and threat quantification. 

By uniting two decades of enterprise identity architecture with hands-on AI engineering and an adversarial security mindset, Max helps AEC organizations deploy autonomous AI they can actually trust — capturing the speed and insight of agentic systems without inheriting the risk. He is a valuable asset to any firm building the trust infrastructure that secure AI demands.