Paul Woll

Multitenant case-management platform: a CaseAPI gateway proxies CaseManagement, Configuration, User, Tenant & FileManagement services across PostgreSQL + SQL Server; event messaging over Kafka (assetid.tenantid.objecttype.action); Redis schema caching; NIST/HIPAA-aligned throughout.

Built to explore the trade-offs: the user picks the engine per document — a regex/gazetteer rules parser and a Presidio-style PII recognizer; in-browser ML via Transformers.js (BERT-NER, a DistilBART summarizer, and a zero-shot NLI classifier — DeBERTa); and local backends — IBM Docling (Python) with a server-side Python BERT-NER FastAPI service, LlamaSharp (.NET LLM), and Ollama / NuExtract for schema-driven structured extraction. Classification method is decoupled from the engine via a pluggable ML / LLM / rules chooser, with model warm-up, browser cache-status, and an /api/tags-driven Ollama model selector. Every run emits an OpenTelemetry span tree (exportable as OTLP/JSON) feeding a model-comparison dashboard — each result honestly labeled real vs rules-fallback. Prototyped and evaluated on real Oklahoma Health Care Authority Medicaid-eligibility RFIs/RFPs.

The deployed path renders data to DOCX in Python (python-docx) via Scriban templates, scoped to the user's security context. As a proof of concept for later integration, a local LLM (Claude) generates the Scriban templates themselves and parses natural-language intent into a multi-service data fetch — deterministic + conversational generation, with prompt-injection defense and deliberate token-cost control.

A stdlib-only Python HTTP service (no Flask/FastAPI — deliberate attack-surface minimization) that shells out to ImageMagick / poppler / headless LibreOffice as the sole parser of untrusted uploads, rasterizing images/PDF/Office to inert PNGs. Hardened to NIST/HIPAA posture: non-root, read-only FS, all Linux caps dropped, no network egress, resource/PID caps, no shell. Idempotent, replay-safe Kafka pipeline with per-tenant Row-Level Security.

SaffronBlazor.Components — production UI (data tables, steppers, searchable combo-boxes, form controls, file upload) with a live samples app and tests. Fapg.RulesEvaluator — compiled + cached JSONPath-style rule evaluation, thread-safe multi-tenant isolation, workflow orchestration for ABAC/policy. Both published as NuGet for any TR .NET team.

In the FDAAS 4.0 rewrite I replaced Neo4j with SQL Server Graph (SQL Graph) for the Network Analyzer — markedly more performant and pulling data through stored procedures instead of graph data embedded in JSON, which sharply reduced PII exposure and compliance risk. I rebuilt search on Solr.NET, fully leveraging the Lucene query syntax and stack for advanced, relevance-ranked search, and designed the IDRA identity-analytics dashboards for ID Analytics — plus complex, drill-down UI/UX across multiple program verticals.

A framework-agnostic TypeScript/PixiJS WebGL library rendering 10,000+ node network graphs (organic/radial/hierarchical layouts, PNG/SVG/PDF export, timeline, state serialization), built to replace the commercial KeyLines library. Shipped with parallel React (Vite) and Blazor/.NET reference integrations so either stack can consume it, plus a sample ASP.NET Core State API demonstrating JWT auth, role-based access control, field-level PII encryption, RBAC masking & audit logging — a reusable secure wrapper for any SDK consumer.

Pluggable, engine-routed analytics adapter that recommends the best-fit visualization for each view — analyzing every result set's shape and data types to suggest the right chart automatically. Benchmarked pg_search (ParadeDB/BM25) relevance against native Postgres full-text search and deliberately deferred pgvector (ANN/embedding similarity) as a clean seam for future semantic search — rather than forcing it onto structured OLAP aggregation.

Self-driven exploration taken to working artifacts: ClearSign — blockchain + post-quantum-crypto + Model Context Protocol compliance ledger; an LLM RFP-qualification pipeline (normalizes scopes, live validation via Playwright, encrypted audit trail); Aegis — an audit-evidence platform.

As chief developer and software architect on the CHP ITS project, I worked across Oracle Forms, Reports, Discoverer, Office applications, ASP.NET MVC, SSRS, and SSIS to modernize workflows and data.

Developed the application from scratch using C#, ASP.NET MVC, AngularJS, Telerik, and JavaScript/AJAX. The source résumé describes approximately 5,000 users.

The work covered a distributed CORBA-to-.NET transition, user interface and middle-tier architecture, load testing, SOX controls, and business/engineering coordination.

The .NET and C# system used Excel-authored definitions, formulas, compiled assemblies, and a configurable interface to support multi-country printer business deals.

The source résumé names Aaris and other insurance clients, including applications for claims state management, audit history, Excel export, and user-facing data review.