Soviic

Sprint 2 of the Soviic build is complete. The workflow builder is working end to end — triggers fire, actions execute, the engine runs, and the activity feed logs everything. But the most important things that happened in Sprint 2 weren't the features. Here's what actually stood out. The security catch. While building out the workflow execution engine, I found a schema policy that would have allowed a user to access another organization's data. Not a theoretical risk — a real one, with a clear path to exploitation. No customers on the platform yet, so no exposure. But it was there, and it would have shipped if I hadn't been looking. I fixed it before moving forward. That's the whole point of building security in from the start rather than bolting it on later. Problems found in development cost almost nothing to fix. The same problem found after customers are live is a different conversation entirely. The silent bug. I also found a bug that had been sitting dormant in the database layer for weeks. It wasn't breaking anything visible — because nothing had exercised that code path yet. Sprint 2 did. The bug surfaced, I traced it, fixed it, and moved on. This is one of the underappreciated realities of software development. Some bugs don't announce themselves. They sit quietly until exactly the right conditions wake them up. The answer isn't to be perfect — it's to build test coverage and actually exercise your code paths before customers do. The email. I tested the email action end to end. Not "it looks right in the code" — I mean I triggered a workflow, watched the execution engine run, and confirmed an actual email landed in an actual inbox. That's the standard. The system either does the thing or it doesn't. Sprint 3 is integrations — Google Workspace, Slack, OAuth. The foundation is solid. Now we connect it to the tools small businesses already use. What's a process in your business that you'd automate first if you could? #Soviic #BuildingInPublic #SaaS #WorkflowAutomation #SmallBusiness #Founder #Supabase #CyberSecurity

Everyone's still typing prompts into a chat box and calling it "using AI." That's not the shift. The shift is agents. Watched a genuinely useful breakdown on this and the framework stuck with me: chat pulls on you, an agent pushes on you. Chat waits for a prompt. An agent runs a loop — diagnose, assemble a plan, take action, assess its own work — and keeps going until the job is actually done. The part that hit hardest as a security guy: the whole build process is basically least-privilege access control applied to AI. - You don't hand it the keys to the car on day one - You give it a narrow scope, one job, one lane - You approve everything at first, then loosen the leash in stages - You only let it run unsupervised once it's earned that trust Sound familiar? It should. That's identity and access management. We've just never applied it to an "employee" that doesn't sleep. Swipe through the carousel below for the full 5-step framework. Building a few of these for CyberSentinel Services and Soviic right now — the discipline is remembering an agent with too much scope and zero guardrails isn't automation, it's an unmonitored privileged account. (Video that sparked this in the comments ↓)