Kubernetes
OpenShell credentials and inference routing explained
OpenShell agents hold placeholders, not API keys. The supervisor swaps in the real key only where policy and the profile allow it. Models are called natively.
9 min read
Category
AI
69 posts
Kubernetes
How to write OpenShell policies
Write an OpenShell sandbox policy in YAML: set filesystem and Landlock rules at startup, scope each network rule to one binary, then verify changes live.
9 min read
Kubernetes
OpenShell vs Agent Substrate vs Kubernetes Agent Sandbox
OpenShell, Agent Substrate and Kubernetes Agent Sandbox solve different parts of running AI agents. Compare what each manages, enforces and requires.
7 min read
Kubernetes
How to find over-privileged AI agents
Find over-privileged AI agents by testing each agent's Kubernetes service account with kubectl auth can-i --as, checking escalation paths and reading audit logs
6 min read
Kubernetes
How to build deterministic AI workflows on Kubernetes
Build AI workflows on Kubernetes that stay deterministic: collect with Jobs, gate with CEL, and give the model one bounded step with only the fields it needs.
6 min read
AI
What is Cross App Access (XAA) for MCP?
Cross App Access (XAA) lets your identity provider decide which MCP clients reach which MCP servers, via a signed ID-JAG exchanged for an access token.
4 min read
AI
How to give custom AI agents their own service identity
Give each custom AI agent its own service account or GitHub App identity, narrow its grants, use short-lived tokens, and log the person each agent acted for.
5 min read
Kubernetes
How to give AI agents identity in Kubernetes
Give each AI agent a named Kubernetes service account, a short-lived projected token for one audience, and a SPIFFE ID from SPIRE when it crosses trust domains.
6 min read
Kubernetes
How to audit AI agent actions in Kubernetes
Give each AI agent its own service account, then write an audit policy that names that account. Without a policy file, the API server logs nothing at all.
6 min read
Kubernetes
AI agent threat model for Kubernetes
A threat model for AI agents in Kubernetes maps each path an agent pod can reach to the admission, token, RBAC or network control that blocks it, per agent.
7 min read
AI
Admission control vs runtime enforcement for AI agents
An agent's pods face admission control before they start. Its calls face runtime enforcement after. Here is where each one stops it, and where it doesn't.
5 min read
AI
AI Thinks. Humans Decide.
AI can think through a decision but can't own it. Why people set the limits for AI agents, four real incidents, and how to enforce them before an action runs.
9 min read