# Hammad Academy > AI, Identity & Enterprise Systems — explained visually. Interactive lessons on how modern systems work, connect, scale, secure access, and fail in production. Home: https://hammadabbasi.com/academy Knowledge map: https://hammadabbasi.com/academy/map Roadmaps: https://hammadabbasi.com/academy/roadmaps Method: every lesson answers what it is, how it works inside, what it depends on, what trade-off it makes, and how it fails in production. ## Roadmaps ### AI Architect (AI Architect) https://hammadabbasi.com/academy/roadmaps/ai-architect — From how a model turns tokens into text, through retrieval and agents, to the runtimes and platforms that put them in production. ### Enterprise Architect (Enterprise Architect) https://hammadabbasi.com/academy/roadmaps/enterprise-architect — Distributed systems, data and consistency, messaging, and the patterns and failure modes that decide whether an architecture survives contact with production. ### AI Engineer (AI Engineer) https://hammadabbasi.com/academy/roadmaps/ai-engineer — The hands-on path: tokenization, inference behavior, retrieval, context engineering, tool use, and evaluating what you shipped. ### IAM Engineer (IAM Engineer) https://hammadabbasi.com/academy/roadmaps/iam-engineer — The identity path end to end: principals and credentials, sessions and tokens, JWT, OAuth, OIDC, SAML, SCIM, and delegated authority. ### Platform Engineer (Platform Engineer) https://hammadabbasi.com/academy/roadmaps/platform-engineer — Workload identity, APIs and messaging, caching, observability, and the resilience patterns that make a platform safe to build on. ### Security Architect (Security Architect) https://hammadabbasi.com/academy/roadmaps/security-architect — Authorization, tokens and their abuse, workload and agent identity, policy enforcement, and the failure modes attackers rely on. ## Domains & Lessons ### AI & Agent Systems https://hammadabbasi.com/academy/ai — How language models actually work — from tokens and attention to inference, RAG, and the agent runtimes that wrap them. Start at intuition, end at production behavior. - How LLMs Work — Complete Guide (Foundation): https://hammadabbasi.com/academy/ai/how-llms-work The whole pipeline, from characters to generated text, in one visual walk-through. - Neural Networks (Foundation): https://hammadabbasi.com/academy/ai/neural-networks Weights, activations, and how a network turns numbers into decisions. - Tokenization (Foundation): https://hammadabbasi.com/academy/ai/tokenization How text becomes the integer tokens a model can actually read. - Embeddings (Foundation): https://hammadabbasi.com/academy/ai/embeddings Turning tokens into vectors where distance means similarity of meaning. - Attention (Intermediate): https://hammadabbasi.com/academy/ai/attention Query, key, value — how tokens decide which other tokens matter. - Transformers (Intermediate): https://hammadabbasi.com/academy/ai/transformers Positional encodings, residual streams, and the block you stack to build a model. - Loss & Gradient Descent (Intermediate): https://hammadabbasi.com/academy/ai/loss-and-gradient-descent How a model measures error and walks downhill to reduce it. - Probability & Sampling (Intermediate): https://hammadabbasi.com/academy/ai/probability-and-sampling Temperature, top-p, and how the next token is actually chosen. - Training Pipeline (Advanced): https://hammadabbasi.com/academy/ai/training Pretraining, fine-tuning, and alignment — how raw weights become a useful model. - Data & Annotation (Advanced): https://hammadabbasi.com/academy/ai/data-and-annotation The datasets, cleaning, and labeling that quietly decide model quality. - Inference Pipeline (Advanced): https://hammadabbasi.com/academy/ai/inference Prefill, decode, KV cache, and batching — serving a model in production. - Context Engineering (Advanced): https://hammadabbasi.com/academy/ai/context-engineering Designing the prompt, retrieved context, and tools the model actually sees. - Building Enterprise AI Agents (Advanced): https://hammadabbasi.com/academy/ai/enterprise-agents Planners, tools, memory, and the guardrails an agent needs in production. - Trip Planner Agent (Intermediate): https://hammadabbasi.com/academy/ai/trip-planner-agent A worked example: an agent that plans a trip end to end with real tools. - Retrieval-Augmented Generation (RAG) (Advanced): https://hammadabbasi.com/academy/ai/rag Ground the model in your data by retrieving relevant context at query time. - Agents & Orchestration (Advanced): https://hammadabbasi.com/academy/ai/agents-orchestration Give a model a goal, tools, and a loop — then coordinate several toward an outcome. - Agent Runtimes & State (Advanced): https://hammadabbasi.com/academy/ai/agent-runtimes The engine that runs the loop, persists state, and lets an agent pause, resume, and recover. - Memory & State (Advanced): https://hammadabbasi.com/academy/ai/memory-state Short-term context, long-term memory, and how agents remember across sessions. - Tools & MCP (Advanced): https://hammadabbasi.com/academy/ai/tools-mcp How agents call the outside world — and how MCP standardizes that interface. - AI Platforms & Infrastructure (Advanced): https://hammadabbasi.com/academy/ai/ai-platforms Serving, scaling, evaluating, and governing models as production infrastructure. ### Identity & Security https://hammadabbasi.com/academy/identity — Principals, credentials, sessions, tokens, and the protocols that carry them — JWT, OAuth, OIDC, SAML, SCIM — through to workload identity, delegated authority, and agent identity. - What Is Identity? (Foundation): https://hammadabbasi.com/academy/identity/what-is-identity Before tokens and protocols: what a system actually means by 'who'. - Principals & Credentials (Foundation): https://hammadabbasi.com/academy/identity/principals-credentials The entities that act, and the secrets that prove who they are. - Authentication vs. Authorization (Foundation): https://hammadabbasi.com/academy/identity/authentication-vs-authorization AuthN proves who you are. AuthZ decides what you may do. Conflating them is a classic bug. - Users, Services & Workloads (Foundation): https://hammadabbasi.com/academy/identity/users-services-workloads Humans aren't the only principals. Services and workloads need identity too. - Sessions & Tokens (Intermediate): https://hammadabbasi.com/academy/identity/sessions-tokens How proof-of-identity is carried across requests — server memory vs. self-contained tokens. - JWT / JWS / JWE (Intermediate): https://hammadabbasi.com/academy/identity/jwt The self-contained token format: signed claims anyone with the public key can verify. - OAuth 2.x (Intermediate): https://hammadabbasi.com/academy/identity/oauth Delegated authorization: let an app act on a resource without ever seeing your password. - OpenID Connect (Intermediate): https://hammadabbasi.com/academy/identity/openid-connect The authentication layer OAuth was missing — a verifiable ID token for 'who is the user'. - SAML 2.0 (Intermediate): https://hammadabbasi.com/academy/identity/saml The XML-based federation standard that still runs most enterprise SSO. - SCIM (Intermediate): https://hammadabbasi.com/academy/identity/scim The provisioning protocol: create, update, and deprovision accounts across systems automatically. - PKI & Certificates (Intermediate): https://hammadabbasi.com/academy/identity/pki-certificates How asymmetric keys and a chain of trust let strangers prove identity. - Workload Identity (Advanced): https://hammadabbasi.com/academy/identity/workload-identity Giving ephemeral services a strong, short-lived, platform-attested identity — no secrets in config. - Delegated Authorization (Advanced): https://hammadabbasi.com/academy/identity/delegated-authorization Acting on behalf of someone else — on-behalf-of, token exchange, and the confused deputy. - Policy Enforcement (Advanced): https://hammadabbasi.com/academy/identity/policy-enforcement Where the yes/no decision is made — PEP, PDP, and models like RBAC, ABAC, and ReBAC. - Agent Identity (Advanced): https://hammadabbasi.com/academy/identity/agent-identity When an AI agent acts for a user with tools and credentials, whose authority is it using? ### Enterprise Systems https://hammadabbasi.com/academy/systems — Distributed systems, caching, messaging, consistency, APIs, data architecture, and the observability that tells you whether any of it is working. - Distributed Systems (Foundation): https://hammadabbasi.com/academy/systems/distributed-systems The moment your system spans more than one machine, new laws apply. - Consistency Models (Intermediate): https://hammadabbasi.com/academy/systems/consistency Strong, eventual, causal — 'consistent' means very different things, each with a price. - Caching (Intermediate): https://hammadabbasi.com/academy/systems/caching The fastest query is the one you never make — but stale data and stampedes await. - Messaging & Queues (Intermediate): https://hammadabbasi.com/academy/systems/messaging Decouple producers from consumers with a buffer that absorbs bursts and survives failures. - Event-Driven Architecture (Advanced): https://hammadabbasi.com/academy/systems/event-driven Build systems around facts that happened, not commands you issue. - APIs & Integration (Intermediate): https://hammadabbasi.com/academy/systems/apis-integration The contracts between services — REST, gRPC, GraphQL — and how to evolve them without breaking callers. - Data Architecture (Advanced): https://hammadabbasi.com/academy/systems/data-architecture Pick the right store for each job — and own the data per service. - Observability & Reliability (Intermediate): https://hammadabbasi.com/academy/systems/observability-reliability You can't operate what you can't see — logs, metrics, traces, and SLOs. ### Architecture & Design Patterns https://hammadabbasi.com/academy/patterns — Circuit breakers, sagas, the outbox, bulkheads, idempotency, CQRS, and the other patterns you reach for when the diagram meets production. - Circuit Breaker (Intermediate): https://hammadabbasi.com/academy/patterns/circuit-breaker Stop calling a failing dependency so it can recover and you fail fast. - Bulkhead (Intermediate): https://hammadabbasi.com/academy/patterns/bulkhead Isolate resources so one overloaded dependency can't sink the whole ship. - Backpressure (Intermediate): https://hammadabbasi.com/academy/patterns/backpressure When you can't keep up, tell upstream to slow down instead of collapsing. - Rate Limiting (Intermediate): https://hammadabbasi.com/academy/patterns/rate-limiting Bound how much each caller can do, protecting shared resources and enforcing fairness. - Retry with Backoff (Intermediate): https://hammadabbasi.com/academy/patterns/retry-backoff Retry transient failures — but with backoff, jitter, and a budget, or you build a retry storm. - Idempotency (Intermediate): https://hammadabbasi.com/academy/patterns/idempotency Make an operation safe to repeat, so retries and duplicates don't cause damage. - Transactional Outbox (Advanced): https://hammadabbasi.com/academy/patterns/outbox Write your data and your event in one transaction, then publish reliably — no dual write. - Saga (Advanced): https://hammadabbasi.com/academy/patterns/saga Coordinate a multi-service transaction with compensations instead of a distributed lock. - CQRS (Advanced): https://hammadabbasi.com/academy/patterns/cqrs Separate the write model from the read model when their needs diverge. - Strangler Fig (Intermediate): https://hammadabbasi.com/academy/patterns/strangler-fig Replace a legacy system incrementally, routing traffic to the new one piece by piece. - Sidecar (Intermediate): https://hammadabbasi.com/academy/patterns/sidecar Deploy cross-cutting concerns beside a service instead of inside it. - Leader Election (Advanced): https://hammadabbasi.com/academy/patterns/leader-election Pick exactly one instance to hold a role — and make sure only one ever does. ### Failure Modes https://hammadabbasi.com/academy/failure-modes — The ways systems actually fail: cascading failure, retry storms, cache stampedes, split brain, token replay, stale authorization. What triggers them, how they present, and how to contain the blast radius. - Cascading Failure (Intermediate): https://hammadabbasi.com/academy/failure-modes/cascading-failure One slow dependency takes down everything that depends on it — and everything that depends on them. - Retry Storms (Intermediate): https://hammadabbasi.com/academy/failure-modes/retry-storm A struggling service gets hammered by everyone's retries and can never recover. - Thundering Herd (Intermediate): https://hammadabbasi.com/academy/failure-modes/thundering-herd Many clients wake up and hit the same resource at the same instant. - Cache Stampede (Intermediate): https://hammadabbasi.com/academy/failure-modes/cache-stampede A hot key expires and every request stampedes the database to recompute it at once. - Split Brain (Advanced): https://hammadabbasi.com/academy/failure-modes/split-brain A network partition leaves two halves of a cluster each believing it's in charge. - Queue Backlog (Intermediate): https://hammadabbasi.com/academy/failure-modes/queue-backlog Producers outpace consumers and the queue grows without bound. - Poison Messages (Intermediate): https://hammadabbasi.com/academy/failure-modes/poison-messages A message that always fails processing blocks or endlessly re-queues. - Partial Failure (Advanced): https://hammadabbasi.com/academy/failure-modes/partial-failure In distributed systems, 'it worked' and 'it failed' aren't the only outcomes. - Token Replay (Intermediate): https://hammadabbasi.com/academy/failure-modes/token-replay A captured bearer token is reused by an attacker — because possession is proof. - Privilege Escalation (Advanced): https://hammadabbasi.com/academy/failure-modes/privilege-escalation Turning limited access into more — vertically to admin, or horizontally to another user's data. - Stale Authorization (Intermediate): https://hammadabbasi.com/academy/failure-modes/stale-authorization Access that should be gone is still honored, because a token or cache hasn't caught up. - Dependency Exhaustion (Intermediate): https://hammadabbasi.com/academy/failure-modes/dependency-exhaustion Running out of a finite shared resource — connections, threads, file handles — under load. - Clock Skew (Advanced): https://hammadabbasi.com/academy/failure-modes/clock-skew When machines disagree about the time, tokens, ordering, and caches break subtly. - Data Inconsistency (Advanced): https://hammadabbasi.com/academy/failure-modes/data-inconsistency Copies of the same data disagree — from replication lag, dual writes, or conflicting updates. ## Reference - Decision Guides: https://hammadabbasi.com/academy/decisions - Reference Architectures: https://hammadabbasi.com/academy/reference-architectures - Protocols & Standards: https://hammadabbasi.com/academy/protocols - Case Studies: https://hammadabbasi.com/academy/case-studies - Enterprise AI Dictionary: https://hammadabbasi.com/academy/dictionary Total published lessons: 69