Ianua

Ianua is a zero-trust identity and access gateway: it checks who — or what — is behind every request, person or AI agent, and decides whether it's allowed before traffic ever reaches the backend. Every decision is written to a tamper-evident log, so access can be audited after the fact, not just enforced in the moment.

As a co-founder, I own the frontend end to end. On the marketing site, the pricing section pulls live plan data and drives a monthly/annual toggle with an accessible aria-pressed switch; the FAQ is a hand-built two-column accordion — no library — that animates open and closed with a CSS grid-rows trick and tracks a single open item at a time. Scroll-triggered reveals across the site run on a small IntersectionObserver hook I wrote myself, with a prefers-reduced-motion fallback, rather than an animation library.

The hero's door imagery is hand-authored line-art SVG that steps through locked → authenticating → access-granted states as you scroll. But the clearest expression of "verified, denied, allowed" actually lives inside the dashboard: I built a live access-check tool that mints a token and fires a real probe through the gateway, then renders whether it was allowed or refused, the status code, latency, and reason. Elsewhere in the dashboard I've shipped permission-gated UI resolved from a react-query-fetched permission set, mutations that cascade into audit-log invalidation, and forms backed by around thirty Zod schemas — including one with cross-field validation that changes which fields are required depending on the routing policy selected.

Being a co-founder rather than a contractor changes the job: frontend decisions here aren't separate from product ones — what a visitor sees first, how much technical detail belongs on the homepage versus the docs, how the pricing tiers should be framed. That overlap has been the biggest difference from client work.