Payments

Every security architecture problem I have ever worked on, from payments to confidential computing to AI agents, has come down to the same question: Where is the data, and what happens to it? Not “what framework are we using.” Not “are we zero trust.” Not “which compliance checkbox do we need.” Those matter eventually. But they are not where you start. You start by following the data. The questions When I was at RBC working on mobile payments, I learned this the hard way. Every time I was confused about how to approach a security problem (and there were many times), the answer was always the same: stop thinking about the system. Start thinking about the data. ...

For a lot of product and engineering teams, security has a branding problem. Too often, it shows up at the end of the process as the function that says no. No, that architecture won’t pass review. No, that workflow isn’t compliant. No, you can’t ship it that way. The problem isn’t that the risks are imaginary. Most of the time, they aren’t. The problem is what happens next: teams learn to avoid security for as long as possible. They treat security review like a tollbooth at the end of the road instead of a design partnership at the beginning. ...

It’s been a while since I felt giddy reading a specification. The release of Google’s Agent Payments Protocol (AP2) brought back memories of my payments days—waiting eagerly for Visa and Mastercard to publish updates on network tokenization, or when Android introduced Host Card Emulation. Here’s what stood out. What Is AP2? The Agent Payments Protocol (AP2) is Google’s ambitious attempt to create a cryptographic foundation for AI agent–initiated commerce. Released on September 16, 2025 with backing from 60+ organizations, it tackles the central trust problem: ...

Back when mobile payments were still in their infancy—long before Apple Pay became a household name—I found myself captivated by the possibilities of NFC technology. As a grad student at Dalhousie University, I started tinkering with NFC and co-founded a small startup called Alfred NFC, where we experimented with peer-to-peer transactions. That was my first real taste of what would become a lifelong fascination with secure technology ecosystems. As graduation approached and the reality set in that Alfred NFC wouldn’t become the next big thing, I faced a crossroads. I applied to countless Canadian companies and banks for NFC-related work—anything that would let me stay in this space I was so passionate about. But the callbacks never came. So I pivoted: I interviewed for several Java developer roles and received multiple offers. It was a safe, predictable path forward. ...