Dan Rohan

HashiCorp Boundary

I own product strategy for Boundary and lead its 8-person PM team, aligning work across Vault, IBM Verify and Radar to secure the access path, credentials and audit trail.

• Shipped SCIM provisioning, and expanded RDP support to Entra ID in Q3 2026.
• Driving agentic access: OIDC/JWT auth for AI agents, credential injection, session logging, and a LangChain/LangGraph SDK.
• Led the market analysis behind RDP credential injection and session recording, opening $20M in new use cases.
• Led usability research behind the RBAC and Resultant Set of Policy editors, cutting support load 15% within a year.
• Carried 2x+ bookings growth, hired 4 PMs and coached 3 from junior to senior.

An MCP server for Boundary

Lets an AI assistant work a Boundary cluster in plain language: 35 tools covering targets, sessions, roles, credential stores and session recordings, plus session authorization and local proxies. Tokens never leave the user's machine.

Agents doing real ops work through Boundary

• RDP computer use. An agent connects to a Windows host through Boundary with brokered credentials, installs IIS, creates a user, publishes and edits a page, then pulls the session recording and exports it as video for the audit trail.
• Certificate rotation. An agent rotates TLS certificates on three Linux hosts over SSH through Boundary.
• Router config. An agent configures BGP peering on a ring of three FRR routers through Boundary.

Talks and posts

• Invisible by design: seamless and secure remote access with Boundary, HashiConf 2025
• Faster threat detection with Boundary session recording + Auditbeat, April 2026
• Boundary 0.21 improves remote access security and UX for RDP, December 2025
• Public beta of RDP credential injection in Boundary 0.20, September 2025

Consul service mesh

Owned Consul across HCP cloud and self-managed on-prem, a ~$58M annual bookings business, before moving to Boundary. My focus was observability: helping teams see how their services actually talk to each other.

• Wrote the PRDs for Consul's observability work: service topology, service-to-service metrics, eBPF-based telemetry, and log export and analysis.
• Brought the same "see the real traffic" lens I'd used on network observability at Kentik up a layer, to the services running on the network.

AIDisruption.fyi

I spend a lot of my free time researching and thinking about the future of AI, AI Safety and AI Policy/governance. I maintain the site AIDisruption.fyi to provide analysis of the impact of AI on jobs and local economies. Built using real-time data and methodical, statistical and scientific modeling. Look up your job or where you live and see how much of the work AI already does, what the local job market is doing, and where things could go over the next 10 years.

Screenshots from November 2026.

Cole, my agent

Cole is the orchestrator of a multi-agent system I run on Hermes. I run nine Hermes profiles managing different elements of my life, each with a unique SOUL.md, and Cole routes work to specialist agents: a researcher, staff and senior engineers, a writer, and security and quality engineers. He also ships code across my repos, answers the phone, and remembers my meetings.

Code. GitHub issues in, pull requests out, auto-deploy on merge. Issue labels decide what he may merge on his own.

Each merge decision is made from fresh GitHub state and writes a one-line audit record. Deploys batch after a burst of merges, and a deploy that fails verification rolls back to the last good commit.

Phone and text. You can call or text Cole, and he can call or text me. Callers have to pass a passphrase, a voiceprint match and an anti-spoofing check, and every attempt is logged. In October a text-to-speech voice reading the passphrase got through, so I hardened the auth.

Memory. About 4,000 of my Bear notes, mostly meeting notes and 1:1s, sync into a self-hosted Honcho every 10 minutes, filed by the people they mention, so my agents can reason over years of work context.

Personal. Cole isn't just for work. He shops for me and helps me track down my cats when they go missing.

Studio, the orchestrator inside Cole

Describe what you want built, review the plan, come back to a pull request. Studio is what drives Cole internally: it plans the work, reviews it before anything runs, executes it in isolated workers, and checks the result.

• Every worker gets a typed capability manifest for files, network hosts and executables, enforced on every operation instead of suggested to the model.
• Work is scored for complexity and risk, then routed to one of five approval tiers, from auto-approve to human review with a cooldown.
• Workers run in bubblewrap, Docker, Kubernetes or Firecracker. Anything that needs eBPF capabilities gets its own Firecracker microVM.
• After every job, estimates are compared with actuals. Drift over 50% triggers an automatic post-mortem.

It's the same problem I work on at IBM: how much access to give an agent, and when a human has to sign off.

Plot

Started as a planner for my family's garden on Bainbridge and turned into a product. Lay out beds on a square-foot grid, get a month-by-month planting calendar for your zone, look up companion plants and Pacific Northwest pests, and ask an AI about anything growing in your garden. Plot Text does it over SMS, including texting a photo of a sick plant to get a diagnosis back.

Screenshots from a local build with no garden data loaded.

An escape room in a website

Built for my kid's birthday party, disguised as a county public-health alert about a fungal outbreak on Bainbridge Island. Players type their way into a hidden CDC intranet, verify swab samples against field lab notes as they drop in, then solve a logic puzzle to work out the order the six infected will turn. Property values are holding steady.

Elastic Cloud Defend

Envisioned and built the team behind Cloud Defend, a BPF-LSM runtime security agent for Linux and Kubernetes with drift protection and fine-grained allow/deny controls. Wrote the vision and strategy, built the go-to-market plan with revenue leadership, and recruited the early-access design partners.

In 2026 I built this demo kit with Hermes to show Cloud Defend to my team at HashiCorp. It's one script: it stands up a VM running k3s and shows the kernel blocking commands inside a container. Edit the YAML policy to protect /etc/passwd, reload it into the BPF maps without a restart, and the same rm that worked a minute earlier is denied.

Network observability, from container to cloud

• Took the Kentik Cloud suite from idea to launch: cloud sales up 440%, pipeline up 400%.
• Led discovery, specs and design for the industry's first network map spanning data center fabrics, backbones, cloud VPCs and Kubernetes clusters.
• Led a UI update focused on ease of use that doubled trial activations and lifted NPS from the mid-50s to the low 70s.
• Shipped the Kentik Edge suite: Network Explorer, Traffic Engineering, Cost Analytics, and Peering and Interconnection.
• PM for kappa, Kentik's open-source eBPF host and sensor probe, as lead PM for the Cloud, Data Center and eBPF portfolios.
• Founding member of Customer Success, which grew from one person to 8 CSMs and CSEs.

Screenshots from Kentik's demo environment in 2026. The product has kept evolving since I left in 2022.