Kubernetes
Check a subagent's OpenShell policy against a boundary
OpenShell's docs call a maximum-access policy a boundary. The prover checks that a subagent's policy allows nothing beyond the parent's. Here is how to run it.
7 min read
Category
Kubernetes
49 posts
Kubernetes
OpenShell credentials and inference routing explained
OpenShell agents hold placeholders, not API keys. The supervisor swaps in the real key only where policy and the profile allow it. Models are called natively.
9 min read
Kubernetes
How to write OpenShell policies
Write an OpenShell sandbox policy in YAML: set filesystem and Landlock rules at startup, scope each network rule to one binary, then verify changes live.
9 min read
Kubernetes
OpenShell vs Agent Substrate vs Kubernetes Agent Sandbox
OpenShell, Agent Substrate and Kubernetes Agent Sandbox solve different parts of running AI agents. Compare what each manages, enforces and requires.
7 min read
Kubernetes
How to find over-privileged AI agents
Find over-privileged AI agents by testing each agent's Kubernetes service account with kubectl auth can-i --as, checking escalation paths and reading audit logs
6 min read
Kubernetes
How to build deterministic AI workflows on Kubernetes
Build AI workflows on Kubernetes that stay deterministic: collect with Jobs, gate with CEL, and give the model one bounded step with only the fields it needs.
6 min read
AI
How to give custom AI agents their own service identity
Give each custom AI agent its own service account or GitHub App identity, narrow its grants, use short-lived tokens, and log the person each agent acted for.
5 min read
Kubernetes
How to give AI agents identity in Kubernetes
Give each AI agent a named Kubernetes service account, a short-lived projected token for one audience, and a SPIFFE ID from SPIRE when it crosses trust domains.
6 min read
Kubernetes
How to audit AI agent actions in Kubernetes
Give each AI agent its own service account, then write an audit policy that names that account. Without a policy file, the API server logs nothing at all.
6 min read
Kubernetes
AI agent threat model for Kubernetes
A threat model for AI agents in Kubernetes maps each path an agent pod can reach to the admission, token, RBAC or network control that blocks it, per agent.
7 min read
AI
Admission control vs runtime enforcement for AI agents
An agent's pods face admission control before they start. Its calls face runtime enforcement after. Here is where each one stops it, and where it doesn't.
5 min read
Kubernetes
RBAC for AI agents in Kubernetes
Give each AI agent its own service account, bind it to a narrow Role, and point its pod at that account. RBAC has no deny rules, so grants are the limit.
5 min read