An internal AI platform supporting program production at a major Japanese broadcaster (built a multi-service foundation and auth hub)

[Self-built OIDC auth hub (BFF)] Starting from Google Workspace SSO, the BFF issues audience-scoped short-lived JWTs to each tool (10-minute access token, 1-hour ID token). The authorization flow requires PKCE S256, and token hand-off uses an auto-POSTed HTML form (not the URL) + an HMAC signature over the originating origin to prevent MITM. A per-device session ID carries sidGeneration and entitlementsVersion, enabling per-device revocation and detection of permission changes.

[Back-channel logout and permission sync] Built a mechanism to asynchronously deliver logout and permission changes to each tool. Events are HMAC-SHA256-signed, retried up to 3 times with exponential backoff (1s/5s/30s), and deduplicated/replay-protected by a (eventId, toolId) unique constraint. Tools stay loosely coupled while company-wide logout propagates reliably.

[PII encryption and audit logs] External users' email, phone, and name are stored encrypted with AES-256-GCM, and search uses HMAC-SHA-256 tokens for partial matching without decryption. Secret comparison uses constant-time comparison (timingSafeEqual) to prevent timing attacks. Session creation, revocation, and renewal are recorded in audit logs to provide internal-control evidence.

[Caption typo-detection pipeline] Captions are extracted from video, local OCR detects caption "transitions," and LLM OCR is applied only to the set of unique captions (not every frame). In parallel, speech recognition transcribes the audio and is cross-checked against the OCR results to detect typos, NG words, and proper-noun mismatches. Running OCR and speech recognition in parallel on Cloud Workflows cut processing time by ~30% (sequential 18 min → parallel 13 min).

[Idempotent, resumable long jobs] Each segment is assigned a global caption ID = segment_index × stride + local_id, so IDs stay stable through downstream merge under parallelism and are idempotent on re-run. Progress is delivered to the UI near-real-time via a Firestore snapshot subscription + SSE, with resolve_monotonic_progress_percent preventing progress from going backward. Uploads use chunked parallel signed URLs (up to 8 concurrent) for large assets.

[Broadcast-quality speech synthesis] Two TTS systems (ElevenLabs / Google Chirp3) are unified behind a provider abstraction, with output as MP3 44.1kHz/192kbps and FFmpeg fade normalization. It supports pronunciation dictionaries and text preprocessing (kanji conversion, whitespace removal), and scripts use optimistic locking (a version column) to detect concurrent-edit conflicts. dummyMode tests the synthesis path without hitting real APIs, and usage logs (voice ID, character count, status) are fully recorded to make cost observable.

[Asset malware scanning (zero-trust entry)] Uploaded assets are passed to ClamAV (Cloud Run) via Eventarc/GCS events, streaming-scanned up to 10GiB (without buffering, to avoid memory exhaustion) and routed to clean/quarantine buckets. Intermediate chunks of a GCS composite upload are skipped by regex; zero-length, in-progress, and deleted files are safely ignored. The atomicity of File.move makes it idempotent under retries, and scan results are emitted to Cloud Monitoring via OpenTelemetry.

[IaC, security, CI/CD] The whole of GCP is codified in ~71 Terraform modules. Multi-layered defense with Cloud Armor (OWASP CRS 3.3 + adaptive DDoS protection + rate limiting), Cloud SQL (IAM auth, required TLS, private IP), Identity Platform (SMS MFA, reCAPTCHA Enterprise), Secret Manager (latest-version only), and least-privilege service accounts. CI/CD authenticates keylessly via Workload Identity Federation (OIDC), with the WAF fully enabled in stg to eliminate false positives before production.