University of Illinois at Urbana–Champaign
B.S. Computer Science & Statistics · Minor in Econometrics
Cum Laude · GPA 3.95/4.0
Hi, I'm Jonathan He.
Software engineer passionate about security and building systems people can love and trust.
01. About
I'm a software engineer at Amazon building enterprise-level identity and authorization infrastructure that secures interactions between users, services, and increasingly AI agents. My work focuses on designing access control systems that scale across distributed services without sacrificing security, usability, or developer experience.
I'm particularly interested in how AI is reshaping security. As AI agents proliferate across distributed systems, I've been exploring how principles like least privilege and governed autonomy can give them enough authority to be useful while keeping their actions safe, constrained, and accountable.
Before Amazon, I studied Computer Science and Statistics at the University of Illinois.
02. Where I've Worked
Software Development Engineer II @Amazon
- Design delegated authorization for services and AI agents on Amazon's internal OAuth 2.0 issuer, enabling software to act on behalf of users without inheriting more authority than the task requires.
- Build context propagation across distributed services, so downstream systems retain the initiating user and authorization context needed for fine-grained access control and audit.
- Prototype an agent security enforcement layer with policy checks at tool-call boundaries, escalation paths for ambiguous actions, and centralized auditing.
Software Development Engineer I @Amazon
- Built a distributed authorization cache for token issuance, materially reducing latency on a high-throughput authentication path.
- Increased per-host throughput by profiling production traffic and led stress and chaos testing across critical dependencies, redesigning load-shedding and fallback behavior so the service degraded safely under overload.
- Enabled zero-downtime cryptographic migration through event-driven certificate reloading, improving cryptographic agility without interrupting live authentication traffic.
Software Development Engineer Intern @Amazon
- Built an eligibility-check button for Amazon's Selling Partner Services program applicants, streamlining the application flow for potential sellers.
- Automated configuration and progressive feature rollout for authorization infrastructure, reducing deployment time while adding observability and rollback controls.
03. Some Things I Think About
JUL 23, 2026
The Two Boundaries: Governing Agents Without Reinventing Access Control
The industry defines least agency as least privilege plus conditions. That framing bleeds non-determinism across your whole system. Two independent boundaries make the problem tractable.
Read →
JUL 19, 2026
Governed Autonomy: Security Beyond Permission
Least privilege was built for callers whose next action was known. Agents break that assumption. What comes next.
Read →