Md. Rifat
Alam

There's a hidden layer underneath most of the systems I've built — a set of rules deciding what's allowed, what isn't, and what happens at the edges. In government systems, that meant eligibility and approval logic. In healthcare, it meant privacy constraints and data verification across distributed networks. In fintech, compliance gates that had to be right.

Years of encoding these rules into software taught me something. The rules themselves usually exist — in legislation, in policy documents, sometimes in an email thread from three years ago. What rarely exists is any reliable way to check whether a running system actually follows them. Verification tends to be manual, fragmented, or quietly deferred until something goes wrong.

That gap — between the rule on paper and the behaviour in production — is what keeps pulling me back. My work sits at the intersection of software engineering and regulatory compliance: how obligations defined in law can be translated into something a system can actually check, and how that verification can happen automatically rather than after the fact.

That question is what eventually drew me toward research. After years of building systems that encode rules, I became more interested in the problem underneath: how do we know those systems are actually doing what the law requires? I'm now pursuing that question formally — with the advantage of knowing what these systems look like from the inside.