Hardened Agentic Stack

Static write-only telemetry endpoints are an attack runway. Replace them with an ephemeral JWT gate in front of your collector.

PublishedEphemeral Proxy — client requests a short-lived token; the worker validates signature and expiry before forwarding telemetry.

ENV dumps on developer machines are easy. Bootstrap once, then exchange for short-lived Vault or Cloudflare session credentials.

PublishedSecret-as-a-Service — the agent holds a ticket, not a permanent secret.

Admin tokens for troubleshooting turn a minor compromise into a takeover. Map agent tasks to tight JWT scopes and IAM roles.

Draft outlineRole-Based Agent Scoping — map tasks (DiagnoseService, QueryMetrics, PerformRollback) to IAM/JWT scopes.

When a compromised agent spawns npx or curl, user-space policy is too late. Enforce exec allowlists in the kernel with Tetragon.

Draft outlineKernel-Level Kill-Switch — move enforcement from user-space to kernel-space.

Blocking binaries is not enough. Seccomp allowlists shrink the system vocabulary so common exploits fail closed.

Draft outlineSyscall Allowlisting — restrict the agent’s system-level vocabulary.

Define filesystem no-go zones (.env, SSH keys, kubeconfig) and block agent reads at the host policy layer.

Draft outlineImmutable Host Boundary — filesystem no-go zones enforced on the host.

Unsafe tools should never run on the agent host. Dispatch them to ephemeral throwaway sidecars and destroy the workspace after.

Draft outlineEphemeral Execution Sidecar — agent dispatches; container dies after the task.

A killed process without the prompt that caused it is just noise. Propagate TraceIDs from Langfuse into kernel and tool logs.

Draft outlineFull-Stack Trace Correlation — Prompt → Reasoning → Syscall in one view.

Baseline normal tool frequency, then auto-block and page when a read-only agent suddenly looks like an admin.

Draft outlineStatistical Behavioral Analysis — security as deviation from the norm.

If machines cannot group events, they cannot alert on them. Normalize at the collector so log spam collapses into fingerprints.

Draft outlineData Normalization for Machine Consumption.

Edge-mode agents need mTLS control planes and tightly scoped object storage — not flat networks and shared buckets.

Draft outlineHardened Communication Plane — signed, encrypted tunnels; no ambient network trust.

Unsigned pulls make every downstream control irrelevant. Require Cosign/Kyverno provenance before anything runs.

Draft outlineSupply Chain Verification — only proven provenance may run.

Long-term memory on disk is a knowledge-base exfil cache. Encrypt at rest and treat memory writes as classification events.

Draft outlineData-at-Rest Protection for agent memory.

Infrastructure cannot save you if the model treats untrusted text as instructions. Sanitize and dual-model extract before reason.

Draft outlineSanitized Input Layer — external data is untrusted until extracted as data, not instructions.

Wipe-and-redeploy loses the lesson. Snapshot memory, revoke ephemeral JWTs, isolate the node — then investigate.

Draft outlineForensic-Ready Infrastructure — recover without erasing the root cause.