I build API-first identity &authorization systems at scale.
The engineering side of me: backend microservices at Walmart Global Tech — identity & authorization platforms, an API-linter service, GraphQL APIs and OPA policy — with contract-first API design, test-coverage discipline, and query-performance debugging. Plus a saffron-growing rig I built with an ESP32 and no electronics background.
5
years across backend & platform
2
domains: healthcare → retail-tech
N+1 → 1
queries collapsed for latency
100%
coverage on GraphQL & OPA suites
System diagrams
How the systems fit together
I think in diagrams — so here are the core models I work on, animated. Tap a tab; open “How it works” for the details.
The authorization model
RBAC modelA user inherits permissions through groups and auth-groups; permissions grant actions on resources, and shares grant scoped, record-level access.
About
Backend engineer, identity & authorization
I'm an adaptable software engineer with 5 years building scalable, secure backend systems across healthcare and retail-tech — currently a Software Development Engineer III at Walmart Global Tech. My center of gravity is identity, authorization and API platforms: OAuth2/JWT, OPA policy, RBAC and GraphQL at enterprise scale, primarily in Java and Spring Boot.
- Primary stack
- Java · Spring Boot
- Domain
- Identity & Authorization
- API style
- Contract-first (OpenAPI / GraphQL)
- Focus
- Performance · Testing · Security
- Also into
- Spec-driven dev · AI tooling
- Availability
- Open to conversations
I work iteratively and evidence-first: I reach for logs, git diff, and the actual generated code before deciding what's wrong. I care about contract-first API design, test-coverage discipline, query performance, and not breaking existing conventions. I'm also a spec-driven-development and tooling enthusiast — I invest in my own workflow and write about what I learn.
What I work on
Identity & Authorization
The single largest theme of my work — services for users, tenants, sites, and an authorization/policy service. I build and refactor RBAC-style permission models, group↔permission associations, and record-sharing flows with ownership validation.
Vendor / supplier identity data
Multi-region composite-key entities (vendor number + region + start date) and their update/patch APIs, modeling naturally multi-dimensional identity data.
Auth integration
OAuth/OIDC via an enterprise identity provider — token creation & refresh, oauth-callback handling, single-use auth-code semantics, JWT handling, and secrets pulled from a vault.
Platform & data plumbing
Kafka and a Kafka-Connect JDBC sink, running on an internal Kubernetes-based cloud platform with a centralized config store, OpenTelemetry logging, and an Istio service mesh.
How I think & debug
- 01Reproduce, then read the evidence — call the API, capture the exact status and body, pull the correlated logs, then form a hypothesis.
- 02Localize by layer — for a failing request I ask where it broke (mesh vs. app vs. downstream) before why.
- 03Diff-driven — I anchor changes to what actually changed and target tests to exactly those lines.
- 04Plan for big things — for migrations and large features I write the plan first, then implement against it.
Working & communication style
- Iterative and conversational — many short, corrective turns rather than one giant spec, course-correcting quickly.
- High-context — long, specific prompts and design docs, usually with attached files, logs, or screenshots.
- I value explanations, not just fixes — I want to understand the mechanism, not only patch the symptom.
- I care about the written record — design docs, tech stories, and public technical articles about what I learn.
Experience
Where I've worked
From health-tech at Practo to identity & authorization at Walmart Global Tech — plus where it all started.
Aug 2024 – Present
Software Development Engineer III
Walmart Global Tech · Bengaluru
Where I went deep. I own identity, authorization and API-platform work at enterprise scale — the intricacies, the industry standards, and the process behind a multi-tenant, multi-region platform.
- Design and evolve the Resource / Action / Permission / Group / AuthGroup / Share RBAC authorization model for the platform.
- Led a monolith-to-microservices decomposition as part of a platformization effort — enabling independent scaling, faster dev cycles, and isolated per-service deployments.
- Built a shared authorization library consumed by multiple services — refactoring monolithic auth into a Strategy Pattern with pluggable OAuth2 token validators via a factory-based resolution layer.
- Designed the OPA (Open Policy Agent) architecture and a reusable policy/permission-evaluation library; authored policies for 3 identity services across 4 environments at 100% test coverage, deployed via GitHub Actions.
- Designed a multi-platform JWT token system using the Strategy Pattern for platform-aware cache keys, and migrated JWT encryption from symmetric to asymmetric keys for security and enterprise compliance.
- Built an entity sharing system letting users share dashboards, reports and resources with role-based access controls — with create/update/delete-share flows and ownership validation.
- Architected and deployed an API Linter microservice that validates API spec files against customizable, versioned rule sets — adopted across teams to enforce API design standards.
- Ship contract-first GraphQL + REST APIs — type definitions, resolvers and transformers — with 73+ unit tests at 100% coverage and a maximal test-coverage discipline.
- Designed reusable OpenAPI schemas with $ref / allOf composition, cutting schema duplication ~90%.
- Implemented multi-tenancy with tenant-aware authorization and JPA Specification-based dynamic query composition.
- Collapsed an N+1 permission query into a single native projection query, and root-caused cross-cluster incidents (a 504 on OAuth callback, a GraphQL-as-CORS failure) by reading mesh and app logs side by side.
- Lead plan-first identity migrations, and leverage AI coding agents with curated prompts, coding standards and project-aware rules to speed the API dev lifecycle and boost team productivity.
Mar 2021 – Aug 2024
Software Engineer (SE Intern → SE-1 → SE-2)
Practo Technologies · Bengaluru
The startup where I learned the most — breadth and ownership. I shipped across clinic software, communications, payments, infrastructure cost and patient conversion for a large health-tech platform.
- Integrated the government ABHA (Ayushman Bharat Health Account) system with the Practo 'Ray' Clinic Management Software, achieving M1, M2 and M3 certifications.
- Built an IVRS flow for appointment scheduling that increased appointment conversion by ~15%.
- Automated SMS/email delivery optimization — dynamic operator selection by delivery rate, latency and cost, plus reputation-weighted domain selection and suppression lists to lift open/delivery rates.
- Developed a Quota Management System (QMS) microservice for creating and managing quotas, and integrated other services' SMS + storage with it to optimize resource utilization and grow revenue.
- Coordinated the POS (Pinelabs) integration for clinic payment processing.
- Built a cross-OS CLI tool that spins up Docker-based local dev environments simulating production infrastructure, resolving all dependencies to boost developer productivity.
- Deployed open-source solutions company-wide: document signing (Documenso), AI sentiment analysis + tagging of doctor chats for easier CSAT scoring, and resource optimization with Karpenter.
- Reduced UAT environment costs by ~10% with a Kubernetes pod-fitting monitor.
- Exposed 3rd-party APIs for the Appointment Management System (Qikwell), revamped the Practo Ray SMS flow for compliance + dynamic templating, and consolidated multi-microservice data to revamp doctor ads.
Jan – Mar 2020
Web Development Intern
Trendytech
Built codersmaniac.com, a production-ready competitive-coding platform, from scratch.
- Full stack in PHP / JS / HTML / CSS / Bootstrap / MySQL, deployed on GCP.
- Designed a custom tokenizer-based scoring system for code submissions.
2017 – 2021
B.E., Computer Science & Engineering
CMR Institute of Technology, Bengaluru
Computer Science & Engineering, graduated with an 8.09 CGPA.
- Foundations in algorithms, systems, databases and software engineering.
- Where the habit of building side projects to learn really took hold.
Skill matrix
What I'm good at, and how I know
Proficiency mapped from how I actually use each tool — hover or focus any skill to see the evidence behind the level.
The languages I reach for day to day.
- Java (17)ExpertPrimary language across nearly all services — entities, services, repositories, controllers, mappers; refactors datatypes across a whole codebase; reasons about generics, Optional, and collections.
- SQLAdvancedHand-writes native queries with joins & projections, reads Hibernate-generated SQL, optimizes N+1, and models multi-column composite keys.
- TypeScriptAdvancedNestJS/Express GraphQL services (type-safe resolvers and transformers) and React front-ends like this one.
- JavaScriptAdvancedNode tooling, front-end interactivity, and the IVRS/communications work at Practo.
- PHPAdvancedSymfony services at Practo and the codersmaniac.com competitive-coding platform, built from scratch.
- PythonWorkingFlask services, scripting, tooling, and analysis-style tasks.
- RegoAdvancedAuthored OPA policies for 3 identity services across 4 environments at 100% test coverage.
- C / C++ (embedded)WorkingESP32/Arduino firmware side-project (the saffron climate rig).
Selected achievements
What I've shipped
Grouped by theme, drawn from real production work at Walmart Global Tech and Practo.
Identity & Authorization platform
Designed RBAC-style authorization primitives
Modeled Resource, Action, Permission, Group, AuthGroup and GroupPermission and the associations between them for a multi-tenant identity platform, including group→permission association endpoints and access-management policy inserts.
Built a shared authorization library
Refactored monolithic auth into a Strategy Pattern with pluggable OAuth2 token validators resolved by a factory layer, then packaged it as a shared library consumed by multiple services.
Designed the OPA policy architecture
Designed the Open Policy Agent architecture and a reusable policy/permission-evaluation library adopted across services — authoring policies for 3 identity services across 4 environments at 100% test coverage, deployed via GitHub Actions.
Built a record-sharing subsystem end-to-end
Delivered createShare, updateShare (PATCH) and deleteShareRecipient across the GraphQL graph, service and repository layers — with patch-path and ownership validation — then cleanly removed owner-id from the patch paths when requirements changed.
Shipped an entity-sharing system with RBAC
Let users share dashboards, reports and resources under role-based access controls, building on the same first-class, composable authorization primitives.
Hardened OAuth/OIDC token flows
Implemented token creation & refresh, oauth-callback handling and single-use auth-code semantics against an enterprise identity provider, and refactored a token-timeout/caching method for correctness.
Hardened the JWT & token system
Designed a multi-platform JWT token system using the Strategy Pattern for platform-aware cache keys with per-product session isolation, and migrated encryption from symmetric to asymmetric keys for enterprise compliance.
Led an identity migration, plan-first
Drove one of the largest efforts in my history — a migration of identity functionality and table design across services — planned as a written document first, then executed against it.
API-first design & platform
Built an API Linter microservice
Architected and deployed a service that validates API spec files against customizable, versioned rule sets — adopted across developer teams to enforce API design standards.
Maintained OpenAPI contracts in lockstep
Kept request/response entities, examples and generated Java classes in sync across multiple services while conforming to an internal API style guide.
Cut OpenAPI schema duplication ~90%
Designed reusable OpenAPI schemas with $ref / allOf composition, collapsing repeated definitions while keeping request/response contracts consistent across services.
Delivered end-to-end GraphQL APIs
Built queries and mutations across multiple domains — type definitions, resolvers and transformers — backed by 73+ unit tests at 100% coverage.
Standardized error handling on problem+json
Adopted RFC 7807/9457-style application/problem+json responses with consistent type/title/detail across endpoints.
Authored a full spec from domain entities
Wrote a complete OpenAPI spec in a single spec-driven session, then renamed generated classes to match naming conventions.
Shipped ready-to-import Bruno collections
Generated Bruno API collections straight from the OpenAPI spec — including versioned /v1 and /v2 variants — so the team could exercise endpoints without hand-building requests.
Platformization & architecture
Led a monolith-to-microservices decomposition
Drove a platformization effort that split a monolith into services — enabling independent scaling, faster dev cycles, and isolated per-service deployments.
Implemented multi-tenancy end-to-end
Added tenant-aware authorization with JPA Specification-based dynamic query composition so a single platform safely serves many tenants.
Database & performance
Eliminated N+1 query patterns
Consolidated multi-query permission fetches into a single native query with joins and a projection, mapping columns directly into the API response shape and removing a slower cursor-based path.
Optimized permission-list latency
Tuned group/entity queries and iteration-heavy response building for better latency on permission-list endpoints.
Designed composite-key update semantics
Modeled multi-region vendor identity keys (number + region + start date) and implemented PATCH/PUT with correct partial-update behavior.
Reliability & incident debugging
Root-caused a 504 on OAuth callback
Correlated Istio proxy logs with application pod logs across two clusters to isolate where the request was blocked — mesh vs. app — turning an opaque timeout into an actionable root cause.
Traced a GraphQL failure to CORS
Debugged a userContext failure down to a CORS misconfiguration surfaced in pod logs, reproduced across multiple regions.
Built a repeatable multi-cluster triage
Traced multi-cluster/multi-region request failures using pod + mesh logs — a skill I reused across several incidents.
Security & dependency health
Remediated Snyk findings, BOM-aware
Reasoned through CVEs and transitive versions — catching that a JWT library pin conflicted with the Spring Boot BOM-managed version — and executed fixes via a written plan without regressions.
Testing & quality
Sustained a high test-coverage bar
Repeatedly added and repaired JUnit/Mockito tests to keep coverage 'maximal' after every refactor, datatype change and rebase — 73+ GraphQL unit tests at 100% and OPA policy suites at 100% across environments.
Kept suites green through change
Fixed conflict- and change-induced test breakage as part of normal delivery, treating green tests as part of done.
Developer experience & knowledge sharing
Sped the API lifecycle with AI coding agents
Leveraged AI coding agents with curated prompts, coding standards and project-aware rules to accelerate the API dev lifecycle and boost team productivity.
Adopted Spec-Driven Development
Set up spec-kit on existing repositories and authored a project 'constitution' for consistent agent-assisted development.
Wrote a technical article series
Turned internal spec-kit learning into a shareable, implementation-first article series.
Configured AI engineering tooling
Set up GitHub Enterprise and Jira MCP servers, reusable review 'skills', and IDE tuning (VM options, profiler agents) to improve velocity.
Breadth & ownership at Practo
Certified ABHA integration (M1/M2/M3)
Integrated the government ABHA health-account system with the Practo 'Ray' Clinic Management Software, achieving M1, M2 and M3 government certifications.
Lifted appointment conversion ~15%
Built an IVRS appointment-scheduling flow and optimized SMS/email delivery — dynamic operator selection and reputation-weighted domain choice with suppression lists — to raise conversion and deliverability.
Shipped a Quota Management System
Built a QMS microservice and integrated other services' SMS + storage with it to optimize resource utilization and grow revenue, plus coordinated the Pinelabs POS integration for clinic payments.
Drove company-wide cost & tooling wins
Cut UAT cost ~10% with a Kubernetes pod-fitting monitor, built a cross-OS CLI for production-like Docker dev environments, and rolled out open-source Documenso signing, AI chat sentiment tagging, and Karpenter; exposed Qikwell 3rd-party APIs and revamped the Practo Ray SMS flow and doctor ads.
Selected work
Case studies, in Situation → Result
Real problems from identity, performance, and reliability work — anonymized, with the reasoning made explicit.
Writing
Notes from the work
Essays on spec-driven development, debugging distributed systems, and the design trade-offs I make by default.
Featured project · Agri-Tech
Growing saffron with an ESP32 and zero EE background
Proof that a backend engineer, armed with curiosity and AI, can cross into embedded electronics and ship a working physical system.
A climate-controlled environment for growing saffron
Saffron needs a very particular climate. I wanted to grow it, so I built the climate myself — despite having no electrical or electronics background. Using AI as my tutor, I figured out how to drive an ESP32 with a piezoelectric humidifier module and PWM dimming to hold temperature and humidity in a small controlled environment. It worked.
ESP32
The brain — reading sensors and driving the actuators, programmed from scratch with a lot of AI-assisted learning.
Piezoelectric module
An ultrasonic piezoelectric humidifier to add moisture on demand and hold the target humidity band.
PWM dimming
Pulse-width modulation to smoothly control power to the environment rather than crude on/off switching.
Next: hydroponic vertical farming — growing food in water, stacked vertically, with the same build-and-verify loop.