About
I'm Tristan McKinnon. I design data systems that stay secure when everything else is compromised.
Most of my work sits at a friction point that regulated industries know well: the collision between the speed data engineering demands and the guarantees compliance requires. I spend my time on the parts of that problem that don't have clean answers yet, and I write and talk about what actually breaks when you try to solve them in production.
Research grounded in production, not the other way around
Deterministic Systems Lab is my independent research initiative. It's where the zero-trust architecture work lives: the published research, the open-source code, the talks, and the problems I'm still working out.
The research doesn't come from theory. By day I'm a Staff Data Engineer, building FedRAMP-High healthcare data pipelines at scale. That production work is where the research questions come from, and it's the reason I care about whether an idea survives a real compliance audit and a real attacker, not just a whiteboard. The two halves feed each other. Something breaks in production, it becomes a research question. The research produces something that works, it goes back into the pipeline.
What I’ve built and published
The center of the work right now is Identity-Per-Transaction (IPT): instead of long-lived service accounts that sit around waiting to be compromised, the pipeline mints a scoped, ephemeral credential for each transaction and destroys it milliseconds later. It's implemented and public as pymayfly, an open-source library on PyPI with AWS, Azure, and GCP backends. You can install it and read the code.
IPT is documented in my IEEE BigDataSecurity paper on zero-trust reference architecture for serverless healthcare pipelines. I've presented this line of work at PyCon US, USENIX PEPR, IEEE BigDataSecurity, PyCon KR, and ATBHE. On the privacy side, my Ghost Drivers research showed that "anonymized" fleet telemetry can be re-identified with 96% precision from spatiotemporal patterns alone. I've also published on human-AI collaboration in data science education with Elsevier, with a second piece in the same vein forthcoming.
Current research directions
IPT closes one gap. The interesting work is in what it leaves open, and I'm actively pursuing three directions: extending the per-transaction identity model to streaming data, building accountability into agentic systems that take actions inside data pipelines, and a graph-based approach to defending against re-identification through query trajectories. I'm keeping the specifics of the last two close while they develop.
I recently began a Doctorate of Engineering (D.Eng) at George Washington University, on the AI/ML track, to formalize this research on deterministic security for AI systems.
Get in touch
If you're working on non-human identity, streaming authorization, agentic accountability, or re-identification defense, I'd like to compare notes. The open problems are more interesting to me than the solved ones.