Software Engineer: Payments & AI · Nairobi, Kenya

Software Engineer building full-stack, payment, and AI systems.

I design and build production-grade web applications, backend services, payment integrations, and AI-powered features. My work spans the full software lifecycle, from frontend and APIs to databases, third-party integrations, automation, and deployment.

See selected work Get in touch

design to live card payments: 6 weeks
UAT cases passed: 9/9
of main-branch commits on a 9-person team: 61%
tests written: 1,900+

About Me

I care about the parts that can't be wrong.

I'm a software engineer in Nairobi, Kenya. I work where mistakes are expensive: verifying payments, fulfilling them exactly once, reconciling what came in, and deciding what an AI agent is allowed to do.

The through-line is failing closed. If a payment doesn't verify, it isn't fulfilled. If an agent's action hasn't been approved, it doesn't run. If an LLM's output fails validation, a person reviews it.

Before Gnovation and Kuuka, I automated sales and operations workflows at The Tann Mann Gaadi and built APIs and Angular micro-frontends as an intern at Ardagh Group.

Payments: Hosted card checkout, HMAC verification, exactly-once fulfilment, M-Pesa reconciliation.
AI platforms: Review queues, grounding and fact validation, model routing, MCP tool gateways.
Backend: .NET 8 and Python services, multi-tenant isolation, tests against real databases.

Software Engineer

Payments & AI · Nairobi, Kenya

Selected Work

Two production systems, up close

Employer code stays private, so these are written up rather than linked: the problem, what I built, and how it turned out.

Gnovation · 2026

Multi-tenant card payment gateway

Lets client businesses accept cards through KenswitchPay Hosted Checkout without card data ever touching their systems. First client: a Kenyan parking operator.

Hosted Checkout
Verify signature · order ref · amount · currency
Fulfil exactly once

design to production: 6 weeks
UAT cases passed: 9/9
concurrency tests on real MySQL: 24-way

Problem

Client businesses needed to accept cards without ever handling card data. Every payment had to be verified before it was trusted, and fulfilled exactly once, even under duplicate or concurrent requests.

Outcome

▸In production, verified with live card transactions.
▸A High-severity upstream amount-tampering flaw found in SIT was contained by the verification pipeline.

What I built

▸A multi-tenant integration with KenswitchPay Hosted Checkout, so card data never touches client systems.
▸A fail-closed verification pipeline: HMAC-SHA256 signing with constant-time signature, order-reference, amount and currency checks.
▸Exactly-once fulfilment with a single conditional SQL UPDATE and duplicate-reference detection.

C#.NET 8ASP.NET CoreDapperMySQLxUnitKenswitchPayHMAC-SHA256

Kuuka · 2026 · Contract

Guardrails for a multi-tenant AI agent platform

The governance, security and routing layers that decide what AI agents may do for UK food businesses, and keep a tamper-evident record of what they did.

Agent action
Prepare
Approve: auto or human
Execute
Hash-chained audit log

review-queue states: 11
LLM providers behind one router: 7
hash-chained audit log per tenant: SHA-256

Problem

Agents on the platform could take consequential actions for real businesses. Those actions needed review before they ran, any agent had to be revocable at once, and answers had to stay grounded in real data, whichever LLM provider served them.

Outcome

▸No consequential agent action executes without being prepared and approved first.
▸Tampering with a tenant's audit trail is detectable.
▸Any agent can be cut off in one step.

What I built

▸An 11-state review-queue state machine enforcing prepare → approve → execute, with prompt-injection and PII detection, confidence-scored auto-approval and a CI gate.
▸A per-tenant SHA-256 hash-chained audit log that detects tampering.
▸RBAC permission validation, agent service tokens, Redis-backed token revocation, capability checks, and a kill switch that revokes an agent's Redis and database grants at once.
▸Grounding enforcement and fact validation on agent outputs, plus a data arbiter for conflicting sources.
▸A model router with circuit breakers across seven LLM providers (Anthropic, OpenAI, Gemini, Groq; Kimi, Qwen and DeepSeek via LiteLLM), each tenant-configurable and audited.

PythonFastAPIPostgreSQLRedisLiteLLM

Work Experience

Software Engineer

Gnovation Ltd·Nairobi, Kenya

May 2026 – Present

▸Built a .NET 8 findings engine: 8 rule-based revenue-leakage and operations detectors on a 15-minute Hangfire schedule, with de-duplicating upserts, live SignalR updates and a tenant-scoped REST API.
▸Built M-Pesa payment reconciliation: scores unmatched payments (account match, Jaro-Winkler name similarity) and applies matches idempotently, keyed on the M-Pesa transaction ID, so none is credited twice.
▸Hardened the ASP.NET Core API: fixed JWT role-claim mapping so role checks actually took effect, extended authorisation across 41 controllers, added EF Core global tenant filters and closed a cross-tenant IDOR.

Read the card payment gateway case study

C#.NET 8ASP.NET CoreEF CoreMySQLHangfireSignalRM-Pesa

Software Engineer (AI/ML)

Kuuka·Contract·Remote (UK)

Feb 2026 – May 2026

▸Top contributor (61% of main-branch commits) on a 9-person team building a multi-tenant AI agent platform for UK food businesses (Python, FastAPI, PostgreSQL, Redis).
▸Designed and built an MCP tool gateway in five phases (50+ agent tools) and wrote 19 provider adapters (NetSuite, QuickBooks, SAP, Salesforce, Jira, Notion, Outlook and more), with OAuth2 token management, human-in-the-loop gates on risky tools, auto-discovery and per-call audit.
▸Became the main developer of the orchestrator agent (tool-calling chat grounded in live tenant data, a planning layer with guardrail pre-checks and version pinning) and built the workflow sandbox (LangGraph builder, per-node simulation, live WebSocket run updates, go-live gates).
▸Protected billing integrity (a renewal never marks an invoice paid without a confirmed Stripe charge), enforced per-tier plan limits, made migrations idempotent, gated CI image publishing on tests, and wrote 1,900+ tests.

Read the AI agent guardrails case study

PythonFastAPIPostgreSQLRedisMCPLangGraphLiteLLMOAuth2StripeWebSockets

Automation & Operations Engineer

The Tann Mann Gaadi·Remote

Oct 2024 – Jan 2026

▸Built event-driven integration workflows (n8n, Make, Zapier) linking CRM, Google Workspace, Notion, ClickUp and Asana via REST APIs and webhooks, replacing manual hand-offs across sales and operations.
▸Engineered CRM pipelines for lead capture, deal-stage tracking and real-time reporting, with data-integrity checks across systems.
▸Integrated LLM, transcription and summarisation services into internal workflows to speed up documentation, reporting and decisions.

n8nMakeZapierGoogle WorkspaceNotionClickUpAsanaREST APIsWebhooks

Software Engineer Intern

Ardagh Group·Nairobi, Kenya

Dec 2023 – Jul 2024

▸Built RESTful APIs with Node.js and Next.js API routes for web and mobile clients, focused on secure data handling and efficient database queries.
▸Developed Angular apps in an Nx monorepo against GraphQL APIs and modernised legacy Angular codebases.
▸Built micro-frontends (Module and Native Federation) and reviewed code across frontend and mobile teams.

Node.jsNext.jsAngularNxGraphQLModule FederationNative Federation

Projects

Built in the open

Personal projects with public code. Each card links to its repository.

mahianyuallan/digital-postcard-agentic-pipeline

validate
LLM triage
route
persist

Support Ticket Triage Pipeline

2026

A step-based pipeline in which an LLM classifies support tickets, scores urgency and confidence, extracts fields and drafts replies.

▸Every LLM output is gated by deterministic Pydantic schema and rule checks that fail closed to manual review.
▸Outcomes persisted with SQLAlchemy, structured JSON logs, and pytest coverage of both the happy and manual-review paths.

PythonFastAPIPydanticSQLAlchemypytest

Code Walkthrough

mahianyuallan/alx-project-nexus

JWT auth
role permissions
rate throttle
filter
PostgreSQL

Project Nexus: Job Board API

2025

A REST API for the full job-application lifecycle: four Django apps (accounts, jobs, applications, notifications), three roles (admin, employer, job seeker), JWT auth and role-based permissions.

▸Custom rate throttling, filtering and Swagger/OpenAPI docs.
▸PostgreSQL configured through environment settings; containerised with Docker and gunicorn.

PythonDjango REST FrameworkPostgreSQLJWTDocker

Code

Skills

Tech stack

What I use to build and test payment and AI systems.

Languages

C#
Python
TypeScript
JavaScript
SQL
Java
Bash

Backend

.NET 8 (ASP.NET Core, EF Core)
Dapper
FastAPI
SQLAlchemy
Pydantic
Django REST Framework
Node.js
Express
Next.js
Spring Boot
Hangfire
SignalR

Payments & Security

Hosted card checkout
HMAC signing
OAuth2
JWT/RBAC
AES-256-GCM
Idempotency
Reconciliation
Hash-chained audit logs
M-Pesa
Stripe
SIT/UAT

Data

MySQL/MariaDB
PostgreSQL (pgvector)
SQL Server
Redis
OracleDB
MongoDB
SQLite
Pinecone

AI/LLM

Tool calling
MCP
LangGraph
LiteLLM
OpenAI
Anthropic
Gemini
Grounding
Fact validation
Human-in-the-loop

APIs & DevOps

REST
GraphQL
gRPC
Webhooks
OpenAPI
Linux
systemd
Docker
Kubernetes
Helm
GitHub Actions
Jenkins
Nginx
Apache
GCP

Testing

xUnit
pytest
Vitest
Jest

.NET

Python

TypeScript

JavaScript

FastAPI

Django

Node.js

Express

Next.js

Spring Boot

MySQL

PostgreSQL

Redis

MongoDB

SQLite

Stripe

Anthropic

Gemini

LangGraph

MCP

Pydantic

SQLAlchemy

Docker

Kubernetes

Helm

GitHub Actions

Jenkins

Nginx

Google Cloud

Linux

GraphQL

OpenAPI

pytest

Vitest

Jest