Cal Poly DxHub → CSUB: Taking a Review Platform to Production

Backend Developer, CSU AI Summer Camp (Jul 2026) · Cloud Infrastructure Student Assistant, CSUB (Sep 2026 – Present)

What I did: I designed the AWS architecture, designed the reviewer-facing frontend, and defined the backend rules and contracts. After the summer camp, I was asked to keep going and launch it into production for CSUB with one other software student from Cal Poly, which is now my job as a Cloud Infrastructure Student Assistant.

Why this one is interesting

Most summer camp projects end at the demo. This one didn't. In July, at Cal Poly's Digital Transformation Hub (DxHub, powered by AWS), I was selected from 1,500 applicants across the CSU system and built the backend of a multi-agent review pipeline. In September CSUB asked me to continue it and help launch it for real, so the prototype has had to grow up: production infrastructure, real reviewers, and rules that hold up when the people using it are accountable for the decision.

What the platform does

Campus departments regularly want to adopt new software and AI tools, and each one needs a security and compliance review before it's approved. That used to take more than two months. The platform takes in a request and the vendor's evidence, has specialist agents analyze it and draft a report where every claim is cited to a source, routes it by risk, and hands it to a human reviewer who makes and records the decision. The review cycle dropped from 2+ months to 3 days.

Vetted reviewer workspace dashboard listing requests that need attention, status counts, risk routes and decisions per week — Reviewer dashboard: what needs attention, what's in analysis, risk routes and decisions per week.

Review queue table with each request's requester, status, risk route and last update — Review queue: every open request with its status, risk route and next action.

The reviewer dashboard in dark mode — The same dashboard in dark mode.

My part

AWS architecture design. A serverless system on AWS CDK (TypeScript): API Gateway and Cognito in front, Lambda for the API and agents, SQS between pipeline stages so long analyses don't block requests, DynamoDB for records, S3 for vendor evidence, KMS encryption, and CloudFront for the frontend. The agents run in Python with LangGraph on Amazon Bedrock, using Claude and Amazon Nova.
Frontend design. The reviewer workspace above: a dashboard that leads with what needs a human, a queue that shows each request's status and risk route at a glance, vendor intake links with expiry, and light and dark themes.
Backend rules and contracts. The explicit contracts between stages and the deterministic rules that decide where a request goes: low, medium or high risk, PCI, or held for human review. Agents can recommend; the rules and the reviewer decide.
Hardening. Protected the agents against prompt injection, SSRF and citation errors with domain allowlists, deterministic policy routing and automated tests, so a vendor document can't talk the system into an approval.

Screenshots show sample requests and placeholder contacts.