AI
How to give custom AI agents their own service identity
Give each custom AI agent its own service account or GitHub App identity, narrow its grants, use short-lived tokens, and log the person each agent acted for.
5 min read
Blog
504 posts · Page 2 of 42
Kubernetes
How to give AI agents identity in Kubernetes
Give each AI agent a named Kubernetes service account, a short-lived projected token for one audience, and a SPIFFE ID from SPIRE when it crosses trust domains.
6 min read
Kubernetes
How to audit AI agent actions in Kubernetes
Give each AI agent its own service account, then write an audit policy that names that account. Without a policy file, the API server logs nothing at all.
6 min read
Kubernetes
AI agent threat model for Kubernetes
A threat model for AI agents in Kubernetes maps each path an agent pod can reach to the admission, token, RBAC or network control that blocks it, per agent.
7 min read
AI
Admission control vs runtime enforcement for AI agents
An agent's pods face admission control before they start. Its calls face runtime enforcement after. Here is where each one stops it, and where it doesn't.
5 min read
Kubernetes
RBAC for AI agents in Kubernetes
Give each AI agent its own service account, bind it to a narrow Role, and point its pod at that account. RBAC has no deny rules, so grants are the limit.
5 min read
Kubernetes
How to sandbox AI agents on Kubernetes
Run each AI agent in its own Pod with a hardened security context, default-deny egress and a RuntimeClass, with lifecycle managed by Agent Sandbox CRD.
6 min read
AI
How to map AI agents and humans to one identity model with OIDC
Put AI agents and people behind one OIDC issuer, register each agent as its own client, and map claims to the username your Kubernetes API server records for delegated…
7 min read
AI
What is agent identity?
Agent identity gives each AI agent its own auditable principal. A Kubernetes service account names a workload, but cannot show which agent acted or for whom.
5 min read
Kyverno
Kyverno policies for AI agents
Kyverno policies for AI agents: enforce Pod Security Restricted controls on agent pods at admission with a ValidatingPolicy, then test the policy with the CLI.
6 min read
Kubernetes
How to collect Kubernetes compliance evidence for auditors
Pair Kyverno policy reports, which show current state, with the API server audit log, which shows history. Reports alone are not an audit trail by themselves.
6 min read
AI
How to allowlist MCP servers in Cursor
Allowlist MCP servers in Cursor by command or URL pattern in the team dashboard, then limit tools and network access for each server. Enterprise plans only.
6 min read
Stay up-to-date with the latest in AI, governance, and infrastructure
Subscribe to our free monthly newsletter to get industry news, DevOps tips, and articles right to your inbox on Kyverno, containerization, Kubernetes deployment & management and more.