Thierno DIALLO

As AI coding agents became part of our daily work at CGM, their rapid adoption exposed inconsistent quality, duplicated effort, unreliable outputs, and the absence of common standards. In my role as a Software Engineer with Senior Developer seniority, I responded by leading the creation of a shared framework for the team.

I authored a governance model covering ownership, contribution and review lifecycles, independent testing, preview rollouts, composability, non-overlapping activation rules, and recommended quality thresholds. To make evaluation repeatable, I designed a weighted scoring rubric and implemented a deterministic Python tool that evaluates skills and workflows, reports critical issues, and ranks improvements by impact.

I also built reusable agent skills for safe Kubernetes diagnostics, Jira issue management, GitLab pipelines and merge requests, local Git operations, feature-environment resolution, and automated quality evaluation. Two orchestration workflows combine these capabilities into structured troubleshooting and evaluation processes, with explicit contracts, reusable dependencies, safety guardrails, and failure handling.

These assets are used broadly across the team. I continue to review contributions, help colleagues create and debug their own workflows, support them when they encounter AI-agent or tool-integration issues, and evolve the framework based on practical feedback.

Company-wide Single Sign-On was the next step for a multi-tenant healthcare SaaS platform used in France and Italy. As a Software Engineer with Senior Developer seniority at CGM, I designed and implemented the enterprise identity-provider integration end to end.

The key architectural boundary was to delegate authentication while keeping roles, permissions, and organizational access under the platform’s control, without removing the existing username-and-password login.

I owned the architecture, stakeholder coordination, Java/Quarkus implementation, security model, and technical documentation. The integration uses the OIDC Authorization Code Flow with PKCE, Pushed Authorization Requests, state, and nonce validation.

I designed server-side management of authentication state and external tokens, including refresh and session-coupled cleanup, as well as a provider-agnostic identity-mapping model that rejects ambiguous account matches. I also solved callback routing for dynamic test environments without weakening redirect validation.

The integration is now in production and actively used by healthcare professionals, providing secure federated authentication while preserving internal authorization boundaries.

Third-party integrations did not all use the same connection settings: endpoints varied by deployment environment and user profile, while the relevant configuration was scattered across files and application code. As a Software Engineer with Senior Developer seniority at CGM, I took ownership of replacing that fragmented model with a centralized configuration-resolution system.

Routing a test or pilot user to a non-production endpoint while healthcare professionals continued using the production endpoint often required a code change and redeployment, with no simple way to create an isolated exception for one user.

I replaced this with a three-tier resolution model evaluated for each user and integration: an explicit user override takes priority, an integration-specific strategy applies routing rules, and a database-managed default provides the fallback. This made routine endpoint changes and individual overrides configurable without redeploying the application.

I used Strategy and Factory patterns to keep custom routing logic isolated and extensible. I also designed the JPA data model, implemented the Java/Quarkus service and API, and documented the architecture through a formal RFC and technical diagrams. The system is actively used in production.