The Workstation Blog
AI
Posts tagged AI.
WSL Vault for Compliance: One Tenant Never Opens Another’s Secrets
How WSL Vault keeps app, team, and environment tenants cryptographically isolated — so a stolen root-style token cannot empty the estate — and why dual-tenant control beats secrets sprawl.
Balinder WaliaRead 
Workstation AI Shop: Promoting the AI Sales Storefront Through int → test → acc → prod
Workstation AI Shop sells GPU machines with a fully autonomous AI Sales Agent that configures the basket. See how Ring Promoter moves each build through int → test → acc → prod — with Orbit screenshots release engineers and stakeholders share.
Balinder WaliaRead 
NVIDIA OpenShell: Secure Agent Runtime on Mac Studio and GPU Workstations
NVIDIA OpenShell governs autonomous agents with sandboxes, policy, and credential isolation. Workstation explains how to run it on Mac Studio (Apple GPU host inference) and on Linux with NVIDIA --gpu.
Balinder WaliaRead 
The Half-Built House: Why IT Projects Stall, and How to Get Them Moving Again
Why IT projects get stuck between 'nearly done' and 'live', and a simple way out: the house analogy, MoSCoW, a stakeholder vote, clear options and a deadline. Plus how to use AI with non-technical stakeholders.
Balinder WaliaRead 
Claude Code Routines: Scheduled Cloud Agents, Sub-Routines and Co-Routines
Claude Code Routines run saved agent tasks on Anthropic's cloud on a schedule, via API or on GitHub events. How they work, how to set one up, and how to chain them.
Balinder WaliaRead 
Ring Promoter v1.0.2 — Rings, Orbit and Lanes Side by Side
Ring Promoter v1.0.2 ships Orbit and Lanes side by side — pause on Orbit for the fleet, flip to Lanes when you need the matrix.
Balinder WaliaRead 
WSLVault: Why AI Agents Need Cryptographic Secrets Isolation
AI agents use secrets at machine speed across tools and tenants. WSLVault seals per tenant so a shared platform never leaks another team's plaintext.
Balinder WaliaRead 
Jobshout SEO Analyst AI Agent — Analyse Any Website & Fix SEO Issues Automatically
We ran Jobshout SEO Analyst on workstation.co.uk — score 44/100 — with concrete fix prompts for missing H1, truncated title, and oversized meta description.
Balinder WaliaRead 
WSLVault: Steal the Server. Not the Secrets.
WSLVault seals secrets before they touch disk — DEK to tenant KEK to root KEK — so a stolen host still leaves attackers with ciphertext they cannot open.
Balinder WaliaRead 
How to Deploy Secure AI Agents in Healthcare
AI agents can book appointments, take payments and support clinical work. Here is how healthcare teams can give them the right access, and no more.
Balinder WaliaRead 
Faster WSLProxy Deploys: Prebuilt Images, Build Cache — and Using AI So the Pipeline Work Actually Ships
Workstation WSL Proxy: compile OpenResty once into bwalia/wslproxy-openresty, warm Buildx/GHA layers, extract on bare metal, prefer DEPLOY_MODE=code — and why AI-assisted delivery made this cross-cutting work finishable.
Balinder WaliaRead 
Claude Code, Claude Cowork & ChatGPT for Business Teams
Which teams should use Claude Code, Claude Cowork, or ChatGPT/OpenAI Agents — and the controls Workstation recommends before production.
Balinder WaliaRead 
Enterprise Agentic Frameworks: LangChain, LangGraph & Airflow 3
Operational guide to LangGraph agents, LangSmith evals, and Apache Airflow 3 schedules — with Workstation promotion and edge patterns.
Balinder WaliaRead 
AI GPU Workstations: NVIDIA DGX Spark/Station & Mac Studio M5
How Workstation maps NVIDIA DGX Spark, DGX Station, and Mac Studio M5 into AI Labs and SME packages — factual positioning, no invented prices.
Balinder WaliaRead 
WSLProxy WAF Engine v2: Enterprise Enforcement You Can Explain
Workstation WSL Proxy WAF Engine v2: governed stages and signatures on the OpenResty hot path — explainable enforcement with support IDs.
Balinder WaliaRead WSL Proxy WAF: Explainable Web Application Firewall at the Edge
Workstation WSL Proxy WAF: governed stages and signatures on a live-config OpenResty edge — monitor or block, with explainable support IDs.
Balinder WaliaRead 
Every Release Earns Production: Making Promotions Boring and Safe
Ring Promoter makes promotion a protocol: health-gated hops through int → test → acc → prod, auto-rollback, and full history — every release earns production.
Balinder WaliaRead 
Ring Promoter — QA Gates Before Production
Ring Promoter QA gates: auto-promote early rings, keep a human gate before prod, and treat health plus version checks as first-class quality gates.
Balinder WaliaRead 
Uncovering LLM Bottlenecks: Observability, OTEL & Cost Control
Workstation on uncovering LLM agent bottlenecks with observability: OpenTelemetry, Prometheus/Grafana/Thanos, Langfuse — with clear pros/cons, cost levers, and usage metrics that protect margins.
Balinder WaliaRead 
Turbocharging LLMs
Workstation on turbocharging LLMs: PagedAttention paging for KV cache, vLLM serving, Self-Debugging for agents, PowerInfer token rates, and EG-MLA memory cuts — with production trade-offs.
Balinder WaliaRead 
Rust Async Blocking, Rayon & Modern Applications
Workstation on async Rust blocking, Rayon for CPU-bound work, and why Rust fits modern APIs, edge, agents, and CI/CD — inspired by Alice Ryhl’s Rayon guidance.
Balinder WaliaRead 
Ring Promoter: Modern CI/CD You Cannot Miss for AI-Powered Deployments
Ring Promoter is the modern CI/CD control plane for AI-powered deployments: shared rings, health gates, version verification, auto-rollback, and multi-app promote.
Balinder WaliaRead 
Workstation WSL Proxy: API Gateway, CDN & Agent Edge
Workstation WSL Proxy (WSLProxy) is a complete API gateway and CDN edge: live routing, WAF, cache, multi-POP DNS, MCP — with Agents Gateway and MCP Gateway in progress.
Balinder WaliaRead 
KubePilot: CoPilot, Pilot & AutoPilot for Faster Kubernetes Incidents
KubePilot helps SRE, DevOps, and platform teams move from noisy cluster signals to a safe fix — CoPilot, Pilot, and AutoPilot. Open source at kubepilot.org.
Balinder WaliaRead 
Muse Glimmer on Ollama: Always-On Local Agents on One GPU
Meta Muse Glimmer brings always-on local agents to a single GPU via Ollama: 30B, Apache 2.0, 128K context, vision and tools — Workstation business guide.
Balinder WaliaRead 
Agentic AI Security: MCP OAuth, VPN & HashiCorp Vault Leases
Secure enterprise AI agents with MCP OAuth 2.1, VPN-isolated tools, and HashiCorp Vault leases that auto-rotate and expire — plus Claude, OpenAI, and Cursor recommendations.
Balinder WaliaRead 
What is Deep Learning? Workstation Guide for Builders & Business
Workstation rewrite of AWS What is Deep Learning: neural networks, generative AI, vision/speech/NLP/recommendations, and how teams ship DL in the cloud or on Kubernetes.
Balinder WaliaRead 
Kimi K3 & Open Weights: Frontier Agents Without Locked-In APIs
Kimi K3 pushes open-weight models into frontier agent territory. What changed for developers, vLLM serving, MCP, and Workstation production advice.
Balinder WaliaRead 
Claude Opus 5 on AWS: Workstation Guide for Builders & Business
Workstation take on Claude Opus 5 on Amazon Bedrock: agentic coding, long-running agents, 1M context, ZDR by default, and how teams should adopt it.
Balinder WaliaRead 
Wise Developer Workflow + Multi-Agent Development Teams
How a wise developer works a new project — brainstorm, discuss, prototype, diagram, propose, ADR, PR, GitOps — plus Review Bots and Workstation multi-agent teams.
Balinder WaliaRead 
How a Wise Developer Works on a New Project
The wise path for a new project: brainstorm, teammate discussion, prototypes, diagrams, proposals, ADRs, small PRs with Review Bots, and GitOps for production-grade quality.
Balinder WaliaRead 
Amazon Bedrock, AgentCore, SageMaker & Q: Agents in Microsoft Teams
Implement Amazon Bedrock, Bedrock AgentCore, SageMaker, and Amazon Q, then launch a first business agent in Microsoft Teams — with requirements, tooling, and time boxes.
Balinder WaliaRead 
Kubeflow + Argo CD: GitOps MLOps on Kubernetes
Pair Kubeflow and Argo CD for MLOps on Kubernetes: train and register models in Kubeflow, promote InferenceServices with GitOps, roll back with git revert.
Balinder WaliaRead 
Claude Models Compared: Haiku vs Sonnet vs Opus vs Fable 5 (Mythos 5)
Choose the right Claude model tier: Haiku for fast routing, Sonnet for daily work, Opus for complex agentic coding, and Fable 5 for long-horizon autonomy. Includes a token-budget router blueprint.
Balinder WaliaRead 
Claude Fable 5: The Complete Guide to Anthropic's Mythos-Class Model
Claude Fable 5 is Anthropic's Mythos-class frontier model for long-horizon agents. Community reactions, YouTube reviews, when to use it, and how to save tokens.
Balinder WaliaRead 
Large Language Models Explained: How LLMs Work and How to Run Your Own on Kubernetes
What are Large Language Models and how do they work? A clear, non-technical explainer for managers and engineers — tokens, embeddings, transformers, training and inference — plus production Kubernetes YAML to deploy your own LLM with Ollama and vLLM.
Balinder WaliaRead 
Can an AI System Process and File a Self Assessment Tax Return to HMRC Automatically?
Can AI file UK Self Assessment to HMRC? FileMyTax shows bank PDF → extract → classify → calculate → MTD with a human gate. Built by Workstation for CognoAI. Not tax advice.
Balinder WaliaRead 
Building a VAT Return System with Claude Code from Your Invoices and Expenses Database
I rebuilt my quarterly UK VAT return as a Claude Code project: read invoices + expenses from Postgres, classify each line by VAT treatment, compute HMRC Box 1 to 9 with a deterministic Python engine, dry-run, then submit to MTD with a human approval gate.
Balinder WaliaRead 
Unboxing Mac Studio M4 and Running Your First LLM
I unboxed a Mac Studio M4 Max with 128 GB unified memory and 40 GPU cores, installed Ollama, ran Llama 3.1 8B locally, and built a private RAG pipeline - all on one quiet, 6.48 W idle desk-side box.
Balinder WaliaRead 
NebulaDNS Complete Feature Guide: k3s, Route53, Observability, and Enterprise DNS
Complete tour of NebulaDNS features: API-first control plane, Prometheus metrics, propagation gates, peer fingerprinting, DNSSEC roadmap, Helm/k3s operator story, and how to integrate with AWS Route 53 and CoreDNS.
Balinder WaliaRead NebulaDNS: Why Authoritative DNS Is a Game Changer in the AI Era
NebulaDNS is a safe-Rust authoritative DNS server with an API-first control plane, Prometheus metrics, propagation gates, and Kubernetes-native operations—built for visibility when AI services and agents depend on DNS more than ever.
Balinder WaliaRead 
Hosting AI Models on AWS Bedrock and Azure AI Foundry: Cost Control That Scales
Run production AI on AWS Bedrock and Azure AI Foundry with clear patterns for model choice, caching, batching, quotas, and FinOps—so innovation does not blow the cloud bill.
Balinder WaliaRead 
AI-Powered Database Troubleshooting: Intelligent Monitoring, Anomaly Detection, and Auto-Remediation
Leverage AI and machine learning for automated database troubleshooting, anomaly detection, query optimization, and intelligent alerting across MySQL, PostgreSQL, MongoDB, Redis, and Couchbase in production environments.
Balinder WaliaRead 
AI-Driven Business Models: Strategies for the Intelligent Enterprise
Explore AI-driven business models including AI-as-a-Service, AI-enhanced products, data monetisation, and strategies for building competitive moats with artificial intelligence.
Balinder WaliaRead 
AI-Driven Business Process Automation: The Complete Guide
A complete guide to AI-driven business process automation covering intelligent document processing, decision automation, workflow orchestration, and strategies for enterprise-wide automation.
Balinder WaliaRead AI-Powered CRM for Sales and Marketing: Predictive Analytics and Automation
How AI-powered CRM transforms sales and marketing with predictive analytics, automated lead nurturing, personalised campaigns, and intelligent pipeline management.
Balinder WaliaRead AI-Powered Penetration Testing and Continuous Security Monitoring
How AI transforms penetration testing with autonomous vulnerability discovery, continuous security monitoring, AI-driven incident response, and red team automation.
Balinder WaliaRead 