Principal Software Engineer, Agent Policy Fabric

This is a fully remote position, open to applicants in California, +4 more states.

📋 Description

• Take ownership of APF Core Services: Develop and enhance the Runtime Policy Verifier, including signed policy bundle validation, trust-root management, freshness checks, rollback protection, subject binding to the verified runtime context, revocation assessments, and authorization APIs utilized by APF-compatible enforcement points.

• Design Policy Projection: Execute deterministic projections from the canonical APF policy into OpenShell-native runtime policy, adapter constraints, credential requirements, audit obligations, and model-visible tool indicators, ensuring the atomic projection-admission contract is maintained.

• Build Conformance and Verification: Produce golden fixtures, compatibility assessments, negative tests, fuzz/property tests, and conformance suites that demonstrate APF-compatible runtimes and adapters adhere to the same agreements.

• Collaborate with Runtime Owners: Work closely with OpenShell and Infrastructure engineers on public runtime interfaces for projection consumption, runtime context attestation, sanctioned adapter pathways, direct egress verification, and admission/rejection protocols.

• Implement the Runtime integration surfaces. Manage the collaborative efforts with OpenShell and other runtime stakeholders to establish public substrate interfaces that APF leverages — including runtime-context attestation, approved adapter path declarations, projection acceptance and rejection protocols, quarantine measures, and stop-session hooks. Ensure each is documented as a public RFC or PR.

• Propel Architecture Maturity: Define versioning, schema compatibility, latency expectations, availability behaviors, fail-closed defaults, last-known-good policy management, and engineering review documentation for Product Security, Fleet, Identity, and partner teams. Advance technical specifications, draft documents, advocate for bounded claims in security and architecture assessments, facilitate open-decision resolutions, and transform working-draft contracts into engineering artifacts for adoption by Product Security, Fleet, Identity, and partner runtimes.

⛳️ Requirements

• A Bachelor's degree (or equivalent experience)

• Over 15 years of industry experience in systems software, security engineering, distributed systems, or policy infrastructure

• Proficient programming skills in Rust, Go, C++, or Python

• Experience in designing production services, APIs, schemas, policy engines, authorization systems, or signed artifact pipelines

• Familiarity with Linux systems, IPC or service-to-service APIs, protobuf/gRPC or similar wire formats, CI, test automation, release engineering, and cloud or enterprise deployment environments

• Hands-on experience with authorization, cryptographic signatures, trust roots, revocation, subject binding, rollback protection, secure-by-default failure handling, and zero-trust architecture patterns

• Capability to write clear technical specifications, coordinate multiple engineering stakeholders, defend bounded claims, and convert working-draft architecture into implementable interfaces without excessively scoping the runtime.

🏝️ Benefits

• Competitive salaries

• Generous benefits package

• Equity