Zoey Jia

“Who goes there? Stand still, traveler, and state your name. Every request that enters this kingdom must say who it is, and so, I am afraid, must you.”

Hi! I'm Zoey (Huiwen), a software engineer in Cloud Connectivity at Ring, where I work on the part of the system that says no. Politely, quickly, and a very large number of times a day.

Specifically: who you are, which devices you can see, and which features you may turn on. If a request wants into Ring, it talks to us first. That puts me underneath some of Ring's most visible features, like Search Party, which helps neighbors find lost dogs, and Fire Watch, for wildfires. Most of my work happens where several teams meet, which means I spend a lot of time drawing boxes and asking who owns them.

I joined as an intern in the summer of 2025, liked it, and came back full-time in 2026. My rubber ducks (the AI agents I work with, more on page 9) consider this the founding of the kingdom.

I'm a big fan of shadow traffic, and of kill switches that have been pulled at least once in a drill.

If you are wondering how a philosophy student ended up guarding gates, turn to page 2.

If you would like to see what I guard, turn to page 4.

If you came only for the rubber ducks, turn to page 9.

If you are a recruiter in a hurry, turn to page 11.

If you would like to read the internal design docs, turn to page 451.

“I have walked many roads. Philosophy. Cloud. A startup. A master's degree. And every one of them, every single one, ended at a laptop.”

Before the gates, I wandered a bit.

• USC, B.A. in Philosophy, Politics and Economics, 2023. Excellent preparation for arguing about who owns an endpoint.
• Alibaba Cloud, Hangzhou, summer 2023. Solutions architect intern in Cloud AI. I ran a workshop on cloud AI for client companies and learned to say “it depends” with confidence.
• A small AI startup, 2023 to 2025, as a founding member. I built AmaSpeak, an AI English coach, as its full-stack engineer, and ran marketing for AMA Interview, an AI interview coach. Yes, I helped build a tool for practicing interviews while I was interviewing.
• Penn, M.S. in Computer Science, 2025. Computers, unlike philosophers, will tell you right away when you are wrong.
• Amazon, intern, summer 2025. I automated ticket triage for a gateway routing service and helped build parity testing for a proxy migration by mirroring production traffic. They let me come back, so it went fine.
• Character.AI, early 2026. See the Merchant.

If you would like to buy a charm, turn to page 3.

If you would rather skip to the gates, turn to page 4.

“Charms! Charms for the weary traveler! Earn them by questing, spend them on wonders, and return tomorrow. You will return tomorrow. Everyone returns tomorrow.”

For one winter I was a software engineering intern on the monetization team at Character.AI, working on Charms: a way to earn premium perks through daily check-ins and quests instead of a long subscription.

I implemented it on the iOS and Android apps.

If you would like to see what I guard now, turn to page 4.

If you have already spent all your charms, turn to page 402.

“HALT. None shall pass without a token, a role, and their name written in the proper document. I stood here before the deploy. I will stand here after the rollback.”

In Cloud Connectivity I work on gateways and authorization: the gates in front of a large share of the requests Ring apps and devices make, the service that answers “may this person do this?”, and the service that remembers who was allowed what.

An unordered, incomplete list of things a gate gets blamed for:

• Your request failing.
• Your request succeeding when it should have failed.
• Latency.
• Somebody else's latency.
• DNS. (It was DNS.)
• Tuesday.¹

¹ In fairness, sometimes it is the gate.

If you hold a valid token, turn to page 5.

If you hold no token, but a very good reason, turn to page 401.

“I am the one who walks behind you. I say everything you say, a moment later, and no one listens. That is the cruelty of my existence, and the safety of yours.”

Search Party asks neighbors' outdoor cameras to help look for a lost dog, and Ring says it has reunited more than a dog a day since launch. Before any camera joins a search, something has to decide whether that camera is allowed to. That something is my part.

For a long time the answer came from a list somebody kept by hand. Lovingly. By hand. I wrote the design and led the work to move that decision into a dedicated eligibility service, called from inside the authorization check itself, so supporting a new device no longer means editing a list inside the gate.

• First the new path ran as a shadow, deciding side by side with the old one until the two agreed. I checked that the agreement was real, not just quiet (see Moral II).
• I drilled the kill switch in both directions before cutover. The new path is now enforcing in production. The kill switch remains unpulled and slightly disappointed.
• I also wrote the team's reference on how Search Party consent works.

If you smell smoke, turn to page 6.

If you would rather skip the shadow and enforce on day one, turn to page 500.

“The hills are burning! And you, YOU, would make the people tap seven times to hear of it? One tap. ONE.”

Fire Watch helps neighbors spot wildfires and share real-time updates. I was the point of contact for the gateway and authorization side of its one-click activation, which turns on sharing for a free trial. One click for the customer. Several teams for everyone else.

• I mapped the whole path across the gateway, the device service and the permissions service, and helped settle which team owns which door. This took longer than the code, as is tradition.
• I added the new operation in every environment, checked each stage end to end, and rolled it out region by region through configuration instead of a deploy, because nobody wants to redeploy anything near a wildfire.

If you would like to know what happens after something goes wrong, turn to page 7.

If you would like to settle which team owns the endpoint, turn to page 409.

“Tell me what happened. No. Not what you remember. Not what the channel said at midnight. What HAPPENED. Bring me the timestamps.”

I have written two post-incident reviews. The first was in my second month, which is a very efficient way to meet everyone.

• I rebuilt the timelines from primary sources and corrected figures the earlier drafts had wrong, including time to detect, which is an awkward number to get wrong in a document about detecting things.
• I took one through several rounds with senior reviewers to publication. I own the follow-ups. They know where to find me.

If you would like a key, turn to page 8.

If you would like to find out whose fault it was, turn to page 404.

“I open one door, for one traveler, for one hour. Then I forget their face. I hold no grudges and no credentials. I am, frankly, at peace.”

I made the gateway obtain short-lived delegated tokens, so a service further down can act on behalf of a user without ever holding the user's own credential. Least privilege, one trust boundary at a time.

• I wrote down what the switch does and what it does not: handing someone a key is not the same as checking who they are. Now the next person does not have to find out the interesting way.
• I found a failure where a missing permission definition still produces a perfectly successful, perfectly empty key. It returns 200. It is very proud of itself.

If you hear quacking, turn to page 9.

If you would like a key that never expires, turn to page 403.

“We used to just listen. Then we started talking back. Now we would very much like to run rm -rf. The gate says no. The gate always says no.”

Engineers have always explained their code to a rubber duck. Mine finally talk back. I built a workspace where many AI coding agents, my rubber ducks, work side by side, each on exactly one problem, with a guard between them and anything that matters. It became an accepted talk on AI-assisted incident investigation at an internal developer conference in Seattle. The ducks were not invited.

• Default-deny permission boundaries for every agent: each one may write only inside its own folder, outward actions like publishing or deleting are denied in-process, and every decision lands in an audit log. It has blocked me, personally, more than once. Correctly.
• I red-team it myself. Once, a single ssh hop walked straight past every rule. A guard is only as good as the bypasses you went looking for.
• A best-of-N harness, and a history of every closed session, because the ducks do not remember yesterday.
• Checkers that hunt for claims which have outlived their evidence, and for checks that can no longer fail. Those are the most relaxed checks in the building.

Squeeze a duck.

If you have learned nothing yet, turn to page 10.

If you would like to give a duck production access, turn to page 200.

Every fable has one. This one has five, each learned by first doing the opposite.

If you would like to know where the engineer goes next, turn to page 11.

“Every fable ends with a new road. This one runs straight into the woods, where the agents live.”

My next quest is AI agent security: how to let an AI agent act for someone without letting it do everything that someone can.

It turns out to be the question I already answer at work, with a new kind of traveler at the gate.

I am now researching how tool-use guards for AI coding agents get bypassed, and what a guard that survives looks like. Findings will go on the shelves on page 12, once they reproduce.

If you would like to read the field notes, turn to page 12.

If you would like to talk to the engineer, send a raven (or a LinkedIn message).

“Shh. This is a library. There is one shelf so far, which makes it the quietest library in the kingdom.”

Field notes from the quest. Each one will say what I tested, what got through, and how I know. Nothing goes on a shelf until it reproduces.

If you would like to see how this fable ends, for now, turn to the last page.