Great Lakes Software Symposium
October 22 - 23, 2026
NOTE: This is a hands-on workshop - bring a personal laptop (corporate ones may not allow the labs to work).
Learning and understanding AI concepts is satisfying and rewarding, but the fun part is learning how to work with AI yourself. In this 1/2 day workshop, author, trainer, and experienced technologist Brent Laster will help you do both! We’ll explain why and how to run AI models locally, the basic ideas of agents and RAG, and show how to assemble a simple AI agent in Python that leverages RAG and uses a local model through Ollama. And you'll get to follow through with hands-on labs and produce your own instance running on your system in a GitHub Codespace
In this workshop, we'll walk you through what it means to run models locally, how to interact with them, and how to use them as the brain for an agent. Then, we'll enable them to access and use data from a PDF via retrieval-augmented generation (RAG) to make the results more relevant and meaningful. And you'll do all of this hands-on in a ready-made environment with no extra installs required.
No experience is needed on these technologies, although we do assume you do have a basic understanding of LLMs.
Workshop Requirements
Attendees will need the following to do the hands-on labs:
- A laptop with power - It is strongly recommended to bring a personal laptop as corporate devices are sometimes too locked down to be able to run the labs!
- A GitHub account on the public GitHub.com (free tier is fine)
- Browser
NOTE: This is a hands-on workshop - bring a personal laptop (corporate ones may not allow the labs to work).
Learning and understanding AI concepts is satisfying and rewarding, but the fun part is learning how to work with AI yourself. In this 1/2 day workshop, author, trainer, and experienced technologist Brent Laster will help you do both! We’ll explain why and how to run AI models locally, the basic ideas of agents and RAG, and show how to assemble a simple AI agent in Python that leverages RAG and uses a local model through Ollama. And you'll get to follow through with hands-on labs and produce your own instance running on your system in a GitHub Codespace
In this workshop, we'll walk you through what it means to run models locally, how to interact with them, and how to use them as the brain for an agent. Then, we'll enable them to access and use data from a PDF via retrieval-augmented generation (RAG) to make the results more relevant and meaningful. And you'll do all of this hands-on in a ready-made environment with no extra installs required.
No experience is needed on these technologies, although we do assume you do have a basic understanding of LLMs.
Workshop Requirements
Attendees will need the following to do the hands-on labs:
- A laptop with power - It is strongly recommended to bring a personal laptop as corporate devices are sometimes too locked down to be able to run the labs!
- A GitHub account on the public GitHub.com (free tier is fine)
- Browser
NOTE: This is a hands-on workshop - bring a personal laptop (corporate ones may not allow the labs to work).
MCP, or Model Context Protocol, is a standardized framework that allows AI agents to seamlessly connect with external data sources, APIs, and tools. Its main purpose is to make AI agents more intelligent and context-aware by giving them real-time access to live information and actionable capabilities beyond their built-in knowledge.
Join AI technologist, author, and trainer Brent Laster as we learn what MCP is, how it works, and how it can be used to create AI agents that can work with any process that implements MCP. You'll work with MCP concepts, coding, servers, etc. through hands-on labs that teach you how to use it with AI agents.
With MCP, developers can easily integrate AI agents with a wide variety of systems, from internal business databases to third-party services, without having to build custom integrations for each use case. MCP servers act as gateways, exposing specific actions and knowledge to the AI agent, which can then dynamically discover and use these capabilities as needed. This approach streamlines the process of adding new functionalities to AI agents and reduces ongoing maintenance.
MCP is particularly useful for scenarios where AI agents need up-to-date information or need to perform actions in external systems-such as customer support bots fetching live ticket data, enterprise assistants accessing knowledge bases, or automation agents processing transactions. By leveraging MCP, organizations can create more adaptable, powerful, and enterprise-ready AI solutions that respond to real-world business needs in real time
Workshop Requirements
Attendees will need the following to do the hands-on labs:
- A laptop with power - It is strongly recommended to bring a personal laptop as corporate devices are sometimes too locked down to be able to run the labs!
- A free GitHub account on the public GitHub.com
- A browser
MCP, or Model Context Protocol, is a standardized framework that allows AI agents to seamlessly connect with external data sources, APIs, and tools. Its main purpose is to make AI agents more intelligent and context-aware by giving them real-time access to live information and actionable capabilities beyond their built-in knowledge.
Join AI technologist, author, and trainer Brent Laster as we learn what MCP is, how it works, and how it can be used to create AI agents that can work with any process that implements MCP.
With MCP, developers can easily integrate AI agents with a wide variety of systems, from internal business databases to third-party services, without having to build custom integrations for each use case. MCP servers act as gateways, exposing specific actions and knowledge to the AI agent, which can then dynamically discover and use these capabilities as needed. This approach streamlines the process of adding new functionalities to AI agents and reduces ongoing maintenance.
MCP is particularly useful for scenarios where AI agents need up-to-date information or need to perform actions in external systems-such as customer support bots fetching live ticket data, enterprise assistants accessing knowledge bases, or automation agents processing transactions. By leveraging MCP, organizations can create more adaptable, powerful, and enterprise-ready AI solutions that respond to real-world business needs in real time
This condensed hands-on session provides developers and technical leaders with a practical foundation in AI system security — from understanding the unique attack surfaces of LLMs and agents to applying effective guardrails, validation, and monitoring.
Participants explore key security principles across LLM pipelines, agent architectures, and Model Context Protocol (MCP) environments.
Through five focused labs, attendees learn how to detect vulnerabilities, prevent data leakage, and implement safe execution patterns for AI-driven workflows.
By the end of the session, participants will have a working understanding of common AI attack vectors, defensive design patterns, and secure deployment practices for agents and MCP-based systems.
The workshop combines rapid conceptual overviews with practical, short labs:
1.Lab 1 – Understanding AI Threat Surfaces
Explore how AI systems differ from traditional apps: prompt injection, training data poisoning, model exfiltration, and output manipulation.
2.Lab 2 – Secure Prompt and Context Handling
Implement techniques for input sanitization, instruction filtering, and chain-of-thought isolation in LLM and agent pipelines.
3.Lab 3 – Guardrails and Policy Enforcement
Apply open-source guardrail frameworks (e.g., Guardrails.ai or LlamaGuard) to validate responses and prevent unsafe completions.
4.Lab 4 – Securing Agent Tool Use
Configure tools and connectors with least-privilege access and safe error handling. Examine how to restrict and audit agent actions.
5.Lab 5 – Securing MCP Interactions
Learn how to authenticate, authorize, and scope MCP server calls. Practice securing endpoints and preventing untrusted tool injection.
Outcome:
Participants leave with an actionable framework for assessing AI application risk, implementing safeguards, and integrating secure development practices into their LLM and agent workflows.
Workshop Requirements
- A laptop with power - It is strongly recommended to bring a personal laptop as corporate devices are sometimes too locked down to be able to run the labs!
- A free GitHub account on the public GitHub.com
- A browser
This condensed hands-on session provides developers and technical leaders with a practical foundation in AI system security — from understanding the unique attack surfaces of LLMs and agents to applying effective guardrails, validation, and monitoring.
Participants explore key security principles across LLM pipelines, agent architectures, and Model Context Protocol (MCP) environments.
Through five focused labs, attendees learn how to detect vulnerabilities, prevent data leakage, and implement safe execution patterns for AI-driven workflows.
By the end of the session, participants will have a working understanding of common AI attack vectors, defensive design patterns, and secure deployment practices for agents and MCP-based systems.
The workshop combines rapid conceptual overviews with practical, short labs:
1.Lab 1 – Understanding AI Threat Surfaces
Explore how AI systems differ from traditional apps: prompt injection, training data poisoning, model exfiltration, and output manipulation.
2.Lab 2 – Secure Prompt and Context Handling
Implement techniques for input sanitization, instruction filtering, and chain-of-thought isolation in LLM and agent pipelines.
3.Lab 3 – Guardrails and Policy Enforcement
Apply open-source guardrail frameworks (e.g., Guardrails.ai or LlamaGuard) to validate responses and prevent unsafe completions.
4.Lab 4 – Securing Agent Tool Use
Configure tools and connectors with least-privilege access and safe error handling. Examine how to restrict and audit agent actions.
5.Lab 5 – Securing MCP Interactions
Learn how to authenticate, authorize, and scope MCP server calls. Practice securing endpoints and preventing untrusted tool injection.
Outcome:
Participants leave with an actionable framework for assessing AI application risk, implementing safeguards, and integrating secure development practices into their LLM and agent workflows.
Workshop Requirements
- A laptop with power - It is strongly recommended to bring a personal laptop as corporate devices are sometimes too locked down to be able to run the labs!
- A free GitHub account on the public GitHub.com
- A browser
NOTE: This is a hands-on workshop - bring a personal laptop (corporate ones may not allow the labs to work).
In this intensive 3-hour hands-on workshop, you'll learn to master the art and science of prompt engineering. Learn systematic frameworks for constructing effective prompts, from foundational elements to cutting-edge techniques including multi-expert prompting, probability-based optimization, and incentive framing. Through five progressive labs using Ollama and llama3.2:3b in GitHub Codespaces, you'll build production-ready templates and see quality improvements in real-time. Leave with immediately applicable techniques, reusable prompt patterns, and a decision framework for selecting the right approach for any AI task.
Modern AI systems deliver many capabilities, but their effectiveness depends entirely on how well they're prompted. This intensive workshop transforms prompt engineering from trial-and-error guesswork into a systematic, measurable discipline. You'll learn proven frameworks for constructing effective prompts and learn cutting-edge optimization techniques that deliver quality improvements in real-world applications.
Through five hands-on labs in GitHub Codespaces, you'll work with Ollama hosting llama3.2:3b to implement each technique, measure its impact, and build reusable templates. Every concept is immediately validated with code you can deploy tomorrow.
What You'll Master
The workshop progresses through five core competency areas, each reinforced with a practical lab:
Foundations of Effective Prompting begins with the six essential elements every prompt needs: task definition, context, constraints, role assignment, output format, and examples. You'll systematically transform a poorly-constructed prompt into an optimized version, measuring quality improvements at each step. This foundation eliminates the guesswork and establishes a repeatable framework for all future prompt engineering work.
Pattern-Based Techniques introduces few-shot learning and Chain of Thought (CoT) reasoning. Few-shot prompting teaches models through examples rather than explanations, dramatically improving consistency on classification and transformation tasks. Chain of Thought makes reasoning transparent, improving accuracy on complex problems by 20-40% while enabling you to verify the model's logic. You'll build a classification system and compare zero-shot, few-shot, and CoT approaches with measurable accuracy metrics.
Advanced Structural Techniques combines role-based prompting, structured outputs, and constrained generation into enterprise-ready patterns. You'll create an API documentation generator that uses expert personas, enforces strict formatting requirements, outputs reliable JSON, and maintains 90%+ consistency across diverse inputs. This lab produces production templates with automated validation—patterns you can immediately deploy in your organization.
Cutting-Edge Methods explores two powerful techniques gaining traction in 2025-2026. Multi-expert prompting simulates a council of experts (technical, business, security) analyzing complex decisions from multiple perspectives, catching blind spots that single-perspective prompts miss. Reverse prompting flips the traditional interaction: instead of you trying to perfectly specify requirements, the AI asks clarifying questions to discover what you really need. You'll measure 40-60% improvements in decision quality and 80-90% gains in requirement clarity.
Probabilistic and Incentive-Based Optimization introduces the latest research-backed techniques for extracting maximum quality from language models. Stanford's breakthrough probability-based prompting—requesting multiple responses with confidence scores—improves reliability by 30-50% on ambiguous tasks. Incentive framing (yes, “This is critical” and “Take your time” actually work) increases thoroughness by 20-40%. Combined, these techniques deliver 50-70% quality improvements on high-stakes decisions.
NOTE: This is a hands-on workshop - bring a personal laptop (corporate ones may not allow the labs to work).
In this intensive 3-hour hands-on workshop, you'll learn to master the art and science of prompt engineering. Learn systematic frameworks for constructing effective prompts, from foundational elements to cutting-edge techniques including multi-expert prompting, probability-based optimization, and incentive framing. Through five progressive labs using Ollama and llama3.2:3b in GitHub Codespaces, you'll build production-ready templates and see quality improvements in real-time. Leave with immediately applicable techniques, reusable prompt patterns, and a decision framework for selecting the right approach for any AI task.
Modern AI systems deliver many capabilities, but their effectiveness depends entirely on how well they're prompted. This intensive workshop transforms prompt engineering from trial-and-error guesswork into a systematic, measurable discipline. You'll learn proven frameworks for constructing effective prompts and learn cutting-edge optimization techniques that deliver quality improvements in real-world applications.
Through five hands-on labs in GitHub Codespaces, you'll work with Ollama hosting llama3.2:3b to implement each technique, measure its impact, and build reusable templates. Every concept is immediately validated with code you can deploy tomorrow.
What You'll Master
The workshop progresses through five core competency areas, each reinforced with a practical lab:
Foundations of Effective Prompting begins with the six essential elements every prompt needs: task definition, context, constraints, role assignment, output format, and examples. You'll systematically transform a poorly-constructed prompt into an optimized version, measuring quality improvements at each step. This foundation eliminates the guesswork and establishes a repeatable framework for all future prompt engineering work.
Pattern-Based Techniques introduces few-shot learning and Chain of Thought (CoT) reasoning. Few-shot prompting teaches models through examples rather than explanations, dramatically improving consistency on classification and transformation tasks. Chain of Thought makes reasoning transparent, improving accuracy on complex problems by 20-40% while enabling you to verify the model's logic. You'll build a classification system and compare zero-shot, few-shot, and CoT approaches with measurable accuracy metrics.
Advanced Structural Techniques combines role-based prompting, structured outputs, and constrained generation into enterprise-ready patterns. You'll create an API documentation generator that uses expert personas, enforces strict formatting requirements, outputs reliable JSON, and maintains 90%+ consistency across diverse inputs. This lab produces production templates with automated validation—patterns you can immediately deploy in your organization.
Cutting-Edge Methods explores two powerful techniques gaining traction in 2025-2026. Multi-expert prompting simulates a council of experts (technical, business, security) analyzing complex decisions from multiple perspectives, catching blind spots that single-perspective prompts miss. Reverse prompting flips the traditional interaction: instead of you trying to perfectly specify requirements, the AI asks clarifying questions to discover what you really need. You'll measure 40-60% improvements in decision quality and 80-90% gains in requirement clarity.
Probabilistic and Incentive-Based Optimization introduces the latest research-backed techniques for extracting maximum quality from language models. Stanford's breakthrough probability-based prompting—requesting multiple responses with confidence scores—improves reliability by 30-50% on ambiguous tasks. Incentive framing (yes, “This is critical” and “Take your time” actually work) increases thoroughness by 20-40%. Combined, these techniques deliver 50-70% quality improvements on high-stakes decisions.
As code generation becomes increasingly automated, our role as developers and architects is evolving. The challenge ahead isn’t how to get AI to write more code, it’s how to guide it toward coherent, maintainable, and purposeful systems.
In this session, Michael Carducci reframes software architecture for the era of intelligent agents. You’ll learn how architectural constraints, composition, and trade-offs provide the compass for orchestrating AI tools effectively. Using principles from the Tailor-Made Architecture Model, Carducci introduces practical mental models to help you think architecturally, communicate intent clearly to your agents, and prevent automation from accelerating entropy. This talk reveals how the enduring discipline of architecture becomes the key to harnessing AI—not by replacing human creativity, but by amplifying it.
Agile has become an overused and overloaded buzzword, let's go back to first principles. Agile is the 12 principles. Agile is founded on fast feedback and embraces change. Agile is about making the right decisions at the right time while constantly learning and growing.
Architecture, on the other hand, seems to be the opposite. Once famously described by Grady Booch as “the stuff that's hard to change” there is overwhelming pressure to get architecture “right” early on as the ultimate necessary rework will be costly at best, and fatal at worst. But too much complexity, too early, can be just as costly or fatal. A truly practical approach to agile architecture is long overdue.
This session introduces a new approach to architecture that enables true agility and unprecedented evolvability in the architectures we design and build. Whether you are a already a seasoned architect, or are simply beginning that path, this session will fundamentally change the way you think about and approach software architecture.
Microservices architecture has become a buzzword in the tech industry, promising unparalleled agility, scalability, and resilience. Yet, according to Gartner, more than 90% of organizations attempting to adopt microservices will fail. How can you ensure you're part of the successful 10%?
Success begins with looking beyond the superficial topology and understanding the unique demands this architectural style places on the teams, the organization, and the environment. These demands must be balanced against the current business needs and organizational realities while maintaining a clear and pragmatic path for incremental evolution.
In this session, Michael will share some real-world examples, practical insights, and proven techniques to balance both the power and complexities of microservices. Whether you're considering adopting microservices or already on the journey and facing challenges, this session will equip you with the knowledge and tools to succeed.
AI is accelerating software development at an unprecedented pace, but many teams are discovering a frustrating reality: faster coding isn’t translating into faster delivery.
The reason is counterintuitive. When you accelerate one part of a system, you don’t improve the system… you stress it. More code becomes more review, more coordination, more cognitive load, and ultimately, less flow.
This talk connects that modern failure mode to a foundational systems insight from The Goal: local optimization usually degrades overall performance. From there, Michael Carducci shows how to apply the Theory of Constraints to modern software delivery.
Using concrete examples, you’ll see how practices like XP, DevOps, Domain-Driven Design, and Team Topologies act as targeted interventions on specific bottlenecks—and how misapplying them can make things worse.
You’ll leave with a practical mental model for identifying constraints in your system, reasoning about trade-offs, and designing for flow in an AI-accelerated world.
Gartner just named the semantic layer a non-negotiable foundation for AI. Almost nobody in the industry knows what that means yet, or why it should worry them.
Every LLM response is a guess, not a fact. Most of the time it's close enough that nobody notices. Then it's wrong, and there was no way to see it coming, because the model doesn't know what your data means—the model doesn't know anything. It's always guessing, based on patterns, every time. The guess is right often enough to feel like magic. It will never be right 100% of the time, and can't change that. It's not a bug waiting on a fix. It's a hole in your architecture.
As one recent paper on the semantic gap puts it:
> “When AI systems enter the picture, descriptive documentation is insufficient. LLM-based interfaces operate directly over data representation. If meaning is not encoded structurally, the model infers it probabilistically.”
Your systems are full of structured data (JSON, databases, APIs) that means something to the code that built it and nothing to anything else, including the AI you just pointed at it. A field called status: 3 means nothing outside your system. Multiply that by every field, every service, every team, and you get an enterprise fluent in nothing but itself. That's the wall every serious AI initiative eventually hits, and it's why so many AI initiatives are underdelivering.
The fix isn't a bigger model or a new platform. It's a set of open standards that have quietly run major parts of the web for decades, built for making data mean something on its own, without a person or a program standing by to translate it. Once your data can say what it is, your AI stops guessing about it. Data-driven interactions become deterministic-first, your entire enterprise data landscape becomes more powerful, your token efficiency goes through the roof, and whole classes of problems in AI disappear. That's the semantic layer.
This workshop is a hands-on introduction to building one, starting from data you already have, with tools you already know. You'll leave with a working model of what a semantic layer actually is, why it's about to become as fundamental as the database, and why the people who understand it now will be the most valuable engineers in their organization for the next decade, while everyone else is still tweaking prompts.
Gartner just named the semantic layer a non-negotiable foundation for AI. Almost nobody in the industry knows what that means yet, or why it should worry them.
Every LLM response is a guess, not a fact. Most of the time it's close enough that nobody notices. Then it's wrong, and there was no way to see it coming, because the model doesn't know what your data means—the model doesn't know anything. It's always guessing, based on patterns, every time. The guess is right often enough to feel like magic. It will never be right 100% of the time, and can't change that. It's not a bug waiting on a fix. It's a hole in your architecture.
As one recent paper on the semantic gap puts it:
> “When AI systems enter the picture, descriptive documentation is insufficient. LLM-based interfaces operate directly over data representation. If meaning is not encoded structurally, the model infers it probabilistically.”
Your systems are full of structured data (JSON, databases, APIs) that means something to the code that built it and nothing to anything else, including the AI you just pointed at it. A field called status: 3 means nothing outside your system. Multiply that by every field, every service, every team, and you get an enterprise fluent in nothing but itself. That's the wall every serious AI initiative eventually hits, and it's why so many AI initiatives are underdelivering.
The fix isn't a bigger model or a new platform. It's a set of open standards that have quietly run major parts of the web for decades, built for making data mean something on its own, without a person or a program standing by to translate it. Once your data can say what it is, your AI stops guessing about it. Data-driven interactions become deterministic-first, your entire enterprise data landscape becomes more powerful, your token efficiency goes through the roof, and whole classes of problems in AI disappear. That's the semantic layer.
This workshop is a hands-on introduction to building one, starting from data you already have, with tools you already know. You'll leave with a working model of what a semantic layer actually is, why it's about to become as fundamental as the database, and why the people who understand it now will be the most valuable engineers in their organization for the next decade, while everyone else is still tweaking prompts.
Every generation of system integration has made the same mistake: a standard protocol with bespoke incantations on top. Telnet. CORBA. SOAP. even REST APIs. And now? MCP and tool schemas (the JSON WSDL). We can do better.
This session argues that the challenges of agentic AI are not a model problem or a tooling problem. They're an interoperability problem. And we already know how to solve it, we've been doing it for decades on the world wide web. The problem is tractable.
Through live demos and a real production system, you'll see what anarchic interoperability looks like for AI agents: a single way to talk to any system, without constraining what any system can do.
REST APIs often fall into a cycle of constant refactoring and rewrites, leading to wasted time, technical debt, and endless rework. This is especially difficult when you don't control the API clients.
But what if this could be your last major API refactor? In this session, we’ll dive into strategies for designing and refactoring REST APIs with long-term sustainability in mind—ensuring that your next refactor sets you up for the future.
You’ll learn how to design APIs that can adapt to changing business requirements and scale effectively without requiring constant rewrites. We’ll explore principles like extensibility, versioning, and decoupling, all aimed at future-proofing your API while keeping backward compatibility intact. Along the way, we’ll examine real-world examples of incremental API refactoring, where breaking the cycle of endless rewrites is possible.
This session is perfect for API developers, architects, and tech leads who are ready to stop chasing their tails and want to invest in designing APIs that will stand the test of time—so they can focus on building great features instead of constantly rewriting code.
Security problems empirically fall into two categories: bugs and flaws. Roughly half of the problems we encounter in the wild are bugs and about half are design flaws. A significant number of the bugs can be found through automated testing tools which frees you up to focus on the more pernicious design issues. Even in the time of AI, there's a discussion to be had.
In addition to detecting the presence of common bugs as we have done with static analysis for years, however, we can also imagine automating the application of corrective refactoring. In this talk, I will discuss using OpenRewrite and the Moderne cli to fix common security issues and keep them from coming back.
In this talk we will focus on:
- Understand that security is a process of risk-management, not using a tool or piece of software.
- Introducing the OpenRewrite OSS framework and demonstrate how it can automate common code remediation tasks.
- Using OpenRewrite and the Moderne cli to automatically identify and fix known security vulnerabilities including:
- Common Java flaws
- OWASP Top Ten
- Common Spring Issues
- Checking in credentials
- Integrating security scans with OpenRewrite for continuous improvement.
- Writing custom recipes for defining your own security policies
- Free up your time to address larger concerns by addressing the pedestrian but time-consuming security bugs.
- Understand when AI-based tools will help and when they won't.
Security problems empirically fall into two categories: bugs and flaws. Roughly half of the problems we encounter in the wild are bugs and about half are design flaws. A significant number of the bugs can be found through automated testing tools which frees you up to focus on the more pernicious design issues. Even in the time of AI, there's a discussion to be had.
In addition to detecting the presence of common bugs as we have done with static analysis for years, however, we can also imagine automating the application of corrective refactoring. In this talk, I will discuss using OpenRewrite and the Moderne cli to fix common security issues and keep them from coming back.
In this talk we will focus on:
- Understand that security is a process of risk-management, not using a tool or piece of software.
- Introducing the OpenRewrite OSS framework and demonstrate how it can automate common code remediation tasks.
- Using OpenRewrite and the Moderne cli to automatically identify and fix known security vulnerabilities including:
- Common Java flaws
- OWASP Top Ten
- Common Spring Issues
- Checking in credentials
- Integrating security scans with OpenRewrite for continuous improvement.
- Writing custom recipes for defining your own security policies
- Free up your time to address larger concerns by addressing the pedestrian but time-consuming security bugs.
- Understand when AI-based tools will help and when they won't.
While people are fixating on the threat AI brings to cybersecurity as
a discipline, there’s the considerably more pedestrian but crucial
perspective of securing these systems. The role of the CISO is
expanding beyond security practices to include risk management,
compliance, and more and these role expansions will cascade through
the organization.
Agentic systems collapse traditional boundaries between user, system,
and adversary. Not only do they introduce new risks, they challenge
foundational assumptions in security engineering. Identity and
authorization grants are fluid based upon contextual composition,
behavior becomes non-deterministic, and threat models become
continuous, not static.
What are the risks, challenges, and opportunities that are unleashed
at the intersection of security postures, agents with agency, ambient
authority, context-specific interactions, and engineering discipline?
How does one grow this capability in an organization and how does one
align their career in this direction.
In this workshop, we will cover:
- Introduction : Framing the Agentic Opportunities and Problems
- Threat Landscapes and Taxonomies Throughout the Layers
- Risk Models
- Architectural Patterns
- SDLC Integration and Touchpoints
- Frameworks and Governance for Industry Alignment
- Career Paths Centered at This Confluence
This will be a broad and deep discussion suitable for all levels of technical background and roles from developers, to architects, to tech leadership.
While people are fixating on the threat AI brings to cybersecurity as
a discipline, there’s the considerably more pedestrian but crucial
perspective of securing these systems. The role of the CISO is
expanding beyond security practices to include risk management,
compliance, and more and these role expansions will cascade through
the organization.
Agentic systems collapse traditional boundaries between user, system,
and adversary. Not only do they introduce new risks, they challenge
foundational assumptions in security engineering. Identity and
authorization grants are fluid based upon contextual composition,
behavior becomes non-deterministic, and threat models become
continuous, not static.
What are the risks, challenges, and opportunities that are unleashed
at the intersection of security postures, agents with agency, ambient
authority, context-specific interactions, and engineering discipline?
How does one grow this capability in an organization and how does one
align their career in this direction.
In this workshop, we will cover:
- Introduction : Framing the Agentic Opportunities and Problems
- Threat Landscapes and Taxonomies Throughout the Layers
- Risk Models
- Architectural Patterns
- SDLC Integration and Touchpoints
- Frameworks and Governance for Industry Alignment
- Career Paths Centered at This Confluence
This will be a broad and deep discussion suitable for all levels of technical background and roles from developers, to architects, to tech leadership.
If you are getting tired of the appearance of new types of databases… too bad. We are increasingly relying on a variety of data storage and retrieval systems for specific purposes. Data does not have a single shape and indexing strategies that work for one are not necessarily good fits for others. So after hierarchical, relational, object, graph, columnoriented, document, temporal, appendonly, and everything else, get ready for Vector Databases to assist in the systematization of machine learning systems.
This will be an overview of the benefits of vectors databases as well as an introduction to the major players.
We will focus on open source versus commercial players, hosted versus local deployments, and the attempts to add vector search capabilities to existing storage systems.
We will cover:
- A brief overview of vectors
- Why vectors are so important to machine learning and datadriven systems
- Overview of the offerings
- Adding vector search to other systems
- Sample use cases shown with one of the key open source engines
If you are getting tired of the appearance of new types of databases… too bad. We are increasingly relying on a variety of data storage and retrieval systems for specific purposes. Data does not have a single shape and indexing strategies that work for one are not necessarily good fits for others. So after hierarchical, relational, object, graph, columnoriented, document, temporal, appendonly, and everything else, get ready for Vector Databases to assist in the systematization of machine learning systems.
This will be an overview of the benefits of vectors databases as well as an introduction to the major players.
We will focus on open source versus commercial players, hosted versus local deployments, and the attempts to add vector search capabilities to existing storage systems.
We will cover:
- A brief overview of vectors
- Why vectors are so important to machine learning and datadriven systems
- Overview of the offerings
- Adding vector search to other systems
- Sample use cases shown with one of the key open source engines
One of the nice operational features of the REST architectural style as an approach to API Design is that is allows for separate evolution of the client and server. Depending on the design choices a team makes, however, you may be putting a higher burden on your clients than you intend when you introduce breaking changes.
By taking advantage of the capabilities of OpenRewrite, we can start to manage the process of independent evolution while minimizing the impact. Code migration and refactoring can be used to transition existing clients away from older or deprecated APIs and toward new versions with less effort than trying to do it by hand.
In this talk we will focus on:
Managing API lifecycle changes by automating the migration from deprecated to supported APIs.
Discussing API evolution strategies and when they require assisted refactoring and when they don’t.
*Integrating OpenRewrite into API-first development to ensure client code is always up-to-date with ease.
There's an implied context to your software running in the world and processing data. The problem is that it is usually a reductive and insufficient context to capture the fluency of change that occurs at multiple layers. This need for shared context spreads to API usage which often necessitates fragile, custom development.
In this talk we will address the importance of dynamic context in software systems and how to engender flexible, sufficiently rich context-based systems.
We will cover the history of context-based thinking in the design of software systems and network protocols and how the ideas are merging into something along the lines of “Information DNS” where we resolve things at the time and place of execution into the form in which we need it.
Consider software systems with the technical and financial properties of the Web.
While this is a developing approach to software development, it builds on established ideas and will help provide the basis for next-generation development.
Java is evolving rapidly, not just in performance and scalability, but in how enjoyable it is to write. In this session, we explore recent language and platform features designed to reduce friction, improve expressiveness, and help developers focus on solving problems instead of wrestling with boilerplate.
We’ll cover tools and features such as the Java Almanac and Playground for exploration, Stream Gatherers for building powerful data pipelines, Module Import Declarations to simplify modular development, and Lazy Constants for safer and more efficient initialization. Together, these changes signal a clear direction: Java is becoming more concise, more flexible, and more developer-friendly than ever before.
This session highlights a set of recent Java features that improve everyday development. The focus is on reducing ceremony, improving readability, and enabling more expressive code while staying within familiar Java patterns.
We begin with the Java Almanac and Java Playground, which provide ways to explore the language and quickly experiment with its features. These tools help developers learn, prototype, and validate ideas with less setup.
Next, we cover Stream Gatherers, an enhancement to the Streams API that allows developers to create custom intermediate operations. This makes it easier to express patterns like grouping, batching, and windowing directly within a stream pipeline.
We then explore Module Import Declarations, which simplify working with the Java Module System by reducing verbosity and making dependencies easier to manage. This lowers the barrier to adopting modules in real applications.
Finally, we look at Lazy Constants, which provide a safer and more flexible approach to initializing values only when needed. This improves performance characteristics while maintaining clarity and correctness.
By the end of the session, attendees will understand how these features contribute to a more streamlined Java experience and how they can apply them to write cleaner and more maintainable code
Workshop Requirements
You can opt to run the examples on GitHub Codespaces, in which case you don't need any setup
Otherwise, if you want to run locally:
- Git
- The latest JDK (26 at the time of this writeup)
- Maven
- IDE of Choice (Prefer IntelliJ) (Please upgrade)
Java’s concurrency model has undergone one of its most significant transformations in decades. This session introduces the core features behind that shift, enabling the development of highly concurrent applications with a simpler, more intuitive programming style.
We will explore Virtual Threads, Structured Concurrency, and Scoped Values. Together, these features allow developers to write code that looks sequential while scaling to handle large numbers of concurrent tasks, with improved clarity, safety, and maintainability.
This session focuses on the modern concurrency features introduced as part of Project Loom. These features change how developers approach parallelism and coordination in Java applications.
We begin with Virtual Threads, which provide lightweight threads managed by the JVM. They allow applications to scale to a large number of concurrent operations without the complexity of thread pools or reactive frameworks. Developers can write straightforward blocking code while still achieving high throughput.
Next, we examine Structured Concurrency, which introduces a way to organize concurrent tasks as a single unit of work. This approach simplifies error handling, cancellation, and lifecycle management by ensuring that related tasks are started and completed together.
We then explore Scoped Values, a safer alternative to ThreadLocal. Scoped Values allow data to be shared across a well-defined execution boundary, making context propagation more predictable and easier to reason about in concurrent programs.
By the end of the session, attendees will understand how these features work together to simplify concurrent programming in Java. They will gain a clear mental model for writing scalable applications using a style that is both readable and robust.
Workshop Requirements
You can opt to run the examples on GitHub Codespaces, in which case you don't need any setup
Otherwise, if you want to run locally:
- Git
- The latest JDK (26 at the time of this writeup)
- Maven
- IDE of Choice (Prefer IntelliJ) (Please upgrade)
Java is becoming easier to start with while continuing to push performance forward. This session explores features that simplify how programs are written and executed, as well as APIs that enable more efficient use of modern hardware.
We will cover Simple Source Files and Instance Main Methods, Launching Multi-File Source-Code Programs, the built-in Java WebServer, Value Objects, and the Vector API. These features make it possible to write lightweight applications with minimal setup while still leveraging Java’s performance.
This session focuses on features that reduce the barrier to writing and running Java programs, while also introducing tools for building efficient and high-performance applications.
We begin with Simple Source Files and Instance Main Methods, which remove much of the traditional ceremony required to start a Java program. Developers can write code more directly, making Java more approachable for quick tasks, scripting, and teaching.
Next, we explore Launching Multi-File Source-Code Programs, which allows multiple source files to be executed without a separate compilation step. This enables more realistic applications to be built and run with minimal setup, bridging the gap between simple scripts and structured programs.
We then look at the Java WebServer, a lightweight built-in server for serving content and testing applications locally. This feature makes it easy to spin up a simple server without external dependencies.
After that, we introduce Value Objects, which represent identity-free data and improve both correctness and performance. By focusing on immutable, value-based design, developers can write code that is easier to reason about and better aligned with modern JVM optimizations.
Finally, we examine the Vector API, which provides access to hardware-level optimizations for numerical and data-parallel operations. This allows developers to write code that leverages SIMD capabilities while remaining within the Java ecosystem.
By the end of the session, attendees will understand how Java supports both rapid development and high performance, and how these features can be combined to build applications that are simple, efficient, and modern.
Workshop Requirements
You can opt to run the examples on GitHub Codespaces, in which case you don't need any setup
Otherwise, if you want to run locally:
- Git
- The latest JDK (26 at the time of this writeup)
- Maven
- IDE of Choice (Prefer IntelliJ) (Please upgrade)
Java continues to evolve its language features while expanding its ability to interact with native code. This session focuses on improvements that make Java more expressive and flexible, as well as capabilities that bring it closer to the underlying system.
We will explore Primitive Patterns in instanceof and switch, Flexible Constructor Bodies, and the Foreign Function and Memory (FFM) API. These features improve how developers write conditional logic, construct objects, and integrate with native libraries, all while maintaining Java’s focus on safety and clarity.
This session highlights language and platform features that enhance expressiveness and extend Java’s reach beyond the JVM.
We begin with Primitive Patterns in instanceof and switch, which expand pattern matching to support primitive types. This allows developers to write clearer, more concise conditional logic, reducing boilerplate and improving readability in common control-flow scenarios.
Next, we explore Flexible Constructor Bodies, which relax previous constraints on constructor structure. Developers can perform logic before delegating to another constructor or superclass, enabling more natural object initialization and better alignment with real-world design needs.
Finally, we examine the Foreign Function and Memory (FFM) API, which provides a modern and safe way to interact with native code and memory. This API replaces many of the complexities of JNI, allowing Java applications to call native libraries and manage off-heap memory with greater clarity and control.
By the end of the session, attendees will understand how these features make Java more expressive as a language and more powerful as a platform, opening the door to cleaner code and new types of applications.
Workshop Requirements
You can opt to run the examples on GitHub Codespaces, in which case you don't need any setup
Otherwise, if you want to run locally:
- Git
- The latest JDK (26 at the time of this writeup)
- Maven
- IDE of Choice (Prefer IntelliJ) (Please upgrade)
In this half-day workshop, we’ll practice Test-Driven Development (TDD) by solving a real problem step by step. You’ll learn how to think in tests, write clean code through refactoring, and use your IDE and AI tools effectively. We’ll also explore how modern Java features (like lambdas and streams) enhance testability, and discuss what’s worth testing — and what’s not.
- Process of Testing
- Refactoring and Clean Code
- Benefits
- Setting a Project
- Using IDEs to your absolute advantage
- What role do new Java 8 Lambdas play in testing
- What to test and what not to test
- Integration with Ai
- Property-Based Testing
In this half-day workshop, we’ll practice Test-Driven Development (TDD) by solving a real problem step by step. You’ll learn how to think in tests, write clean code through refactoring, and use your IDE and AI tools effectively. We’ll also explore how modern Java features (like lambdas and streams) enhance testability, and discuss what’s worth testing — and what’s not.
- Process of Testing
- Refactoring and Clean Code
- Benefits
- Setting a Project
- Using IDEs to your absolute advantage
- What role do new Java 8 Lambdas play in testing
- What to test and what not to test
- Integration with Ai
- Property-Based Testing
Java has accumulated a diverse toolbox for concurrency and asynchrony over the decades, ranging from classic threads to parallel streams, from Future to CompletableFuture, and from reactive libraries to the latest innovations, including virtual threads, structured concurrency, and the Vector API. But with so many options, the question is: which ones should we use today, which still matter, and which belong in the history books?
In this talk, we’ll explore the entire spectrum:
- Classic Threads – the original concurrency primitive.
- Parallel Streams – data parallelism for the collections era.
- Futures & CompletableFuture – async results with callbacks and chaining.
- Reactive Programming – backpressure, publishers, and the rise of frameworks like Reactor and RxJava.
- Virtual Threads – Lightweight Concurrency Made Mainstream.
- Structured Concurrency – Taming async chaos with lifetimes and scopes.
- Vector API – data-level parallelism on modern CPUs.
We’ll also tackle the hard questions:
- Do virtual threads really kill the need for reactive programming?
- What does it mean by “hidden stack traces,” and how do they impact debugging and profiling?
- Where should you invest today, and what patterns should you abandon permanently?
In today’s data-driven world, the ability to process and analyze data in real time is no longer a luxury—it’s a necessity. Apache Flink, a powerful stream processing framework, has emerged as a game-changer for handling high-throughput, low-latency data applications.
In this session, you’ll gain a clear understanding of what Apache Flink is, how it works, and why it’s become a cornerstone for modern data infrastructure. We’ll explore key features such as its robust stream and batch processing capabilities, event-time handling, stateful computations, and fault tolerance. You’ll also discover how Flink integrates seamlessly with popular systems like Kafka, Kubernetes, and major cloud platforms.
Whether you’re working with real-time analytics, event-driven applications, or machine learning pipelines, Apache Flink provides the scalability and flexibility needed to turn massive streams of data into actionable insights. Join us to see why Flink is critical to modern data ecosystems and learn how to start leveraging its power in your projects.