Agent tool authorization
Synthetic tool request, tenant policy check and human approval.
Try the interactive demo →Media / Engineering videos
Watch a tutorial. Try the example.
A selection of tutorials worth watching from Apple, Android and other engineering teams. Each video links to its publisher, with a related lab or service you can explore here.
ORIGINAL RECORDINGS / BROWSER DEMONSTRATIONS
Short product walkthroughs, made from working demos.
Short screen recordings from our interactive product demos. Watch the workflow, then open the demo and try it yourself.
Operations workflow
Sample work-queue interactions and local status transitions.
Try the interactive demo →Mobile experience concept
Local-state task management and progress feedback.
Try the interactive demo →DEMONIC BINARY / ORIGINAL TECHNICAL EXPLAINERS
Security and engineering decisions, explained.
Four short, silent visual explainers with readable chapters and transcripts. Each links to a detailed service and underlying engineering material.
API authorization: where tenant isolation fails
An original visual walkthrough of object access, owner checks, and negative-path retesting using a synthetic API.
View transcript
- Start with two tenant identities and an API object that belongs to the first tenant.
- An insecure object lookup returns a record based on its ID without enforcing the caller's tenant boundary.
- The correction scopes database access to the authenticated principal and the object owner's tenant.
- A negative-path regression test repeats the unauthorized request and expects denial while preserving authorized access.
Mobile security: the device is not the authority
An original visual walkthrough of authentication signals, sensitive data, and server-owned authorization decisions.
View transcript
- A native mobile client can store a session and collect an integrity signal, but those signals cannot grant unlimited access.
- The backend authenticates the user and checks the resource and requested operation for every protected API call.
- A malicious client can replay or modify a request. Protected operations must be enforced on the server.
- Validate revoked sessions, retries, offline sync and user switching before release.
Production debugging: trace the redirect loop
An original technical explainer based on Demonic Binary's published Cloudflare routing incident.
View transcript
- The symptom is a redirect loop on the public website after an asset request.
- Trace the host, path normalization and static-asset lookup before making a routing change.
- Correct the worker-to-asset boundary without creating a redirect cycle for missing files.
- Verify canonical hostnames, expected routes, 404 responses and a reversible deployment.
AI agent tools: permissions before execution
An original visual walkthrough of tool allowlists, user permissions and human approval checks.
View transcript
- The agent receives a user request and selects a tool that could change a business record.
- Model output is treated as untrusted input; the backend authorizes identity, resource and action separately.
- Privileged or irreversible actions require an explicit approval step before execution.
- Replays, prompt injection and failed retries must be tested and logged without exposing secrets.
Curated videos and screencasts
Tutorials from the teams behind the tools we use. Choose a video to load its player.
iOS / Apple Developer
Design with SwiftUI
Official Apple session about SwiftUI system components and design patterns.
No YouTube player loads until you choose to play. Playing may allow YouTube to process your visit under its privacy terms.
Watch for
- Native SwiftUI components
- Design consistency
- Product implementation choices
Android / Android Developers
Jetpack Compose: State
Official Android Developers screencast on observable state, recomposition and configuration changes.
No YouTube player loads until you choose to play. Playing may allow YouTube to process your visit under its privacy terms.
Watch for
- State ownership
- Recomposition behavior
- Reliable UI data flow
API security / Google Cloud Tech
OAuth, JWT, HMAC, oh my! API security for your enterprise
An engineering discussion of authentication and API security. Published in 2020; verify current standards before applying any patterns.
No YouTube player loads until you choose to play. Playing may allow YouTube to process your visit under its privacy terms.
Watch for
- Authentication vs. authorization
- Token and signature tradeoffs
- Monitoring boundaries
Try our interactive walkthroughs
Work through our own examples of API authorization, architecture and release planning right in your browser.
Interactive code review walkthrough
API authorization: reproduce a BOLA regression
Compare insecure object fetching against tenant-scoped authorization, then run all five synthetic test scenarios.
Open walkthroughHands-on architecture walkthrough
Architecture: identify client/server trust gaps
Work through authentication and service-boundary tradeoffs in a browser-only scenario.
Open walkthroughEngineering scoping walkthrough
Release readiness: build a review scope
Create a preliminary implementation and release plan, with clear constraints and handoff questions.
Open walkthrough