Hardened Agentic Stack

Static write-only telemetry endpoints are an attack runway. Replace them with an ephemeral JWT gate in front of your collector.

PublishedEphemeral Proxy — client requests a short-lived token; the worker validates signature and expiry before forwarding telemetry.

ENV dumps on developer machines are easy. Bootstrap once, then exchange for short-lived Vault or Cloudflare session credentials.

PublishedSecret-as-a-Service — the agent holds a ticket, not a permanent secret.

Admin tokens for troubleshooting turn a minor compromise into a takeover. Map agent tasks to tight JWT scopes and IAM roles.

PublishedRole-Based Agent Scoping — map tasks (DiagnoseService, QueryMetrics, PerformRollback) to IAM/JWT scopes.

When a compromised agent spawns npx or curl, user-space policy is too late. Enforce exec allowlists in the kernel with Tetragon.

PublishedKernel-Level Kill-Switch — move enforcement from user-space to kernel-space.

Blocking binaries is not enough. Seccomp allowlists shrink the system vocabulary so common exploits fail closed.

PublishedSyscall Allowlisting — restrict the agent’s system-level vocabulary.

Define filesystem no-go zones (.env, SSH keys, kubeconfig) and block agent reads at the host policy layer.

PublishedImmutable Host Boundary — filesystem no-go zones enforced on the host.

Unsafe tools should never run on the agent host. Dispatch them to ephemeral throwaway sidecars and destroy the workspace after.

PublishedEphemeral Execution Sidecar — agent dispatches; container dies after the task.

A killed process without the prompt that caused it is just noise. Propagate TraceIDs from Langfuse into kernel and tool logs.

PublishedFull-Stack Trace Correlation — Prompt → Reasoning → Syscall in one view.

Baseline normal tool frequency, then auto-block and page when a read-only agent suddenly looks like an admin.

PublishedStatistical Behavioral Analysis — security as deviation from the norm.

If machines cannot group events, they cannot alert on them. Normalize at the collector so log spam collapses into fingerprints.

PublishedData Normalization for Machine Consumption.

Edge-mode agents need mTLS control planes and tightly scoped object storage — not flat networks and shared buckets.

PublishedHardened Communication Plane — signed, encrypted tunnels; no ambient network trust.

Unsigned pulls make every downstream control irrelevant. Require Cosign/Kyverno provenance before anything runs.

PublishedSupply Chain Verification — only proven provenance may run.

Long-term memory on disk is a knowledge-base exfil cache. Encrypt at rest and treat memory writes as classification events.

PublishedData-at-Rest Protection for agent memory.

Infrastructure cannot save you if the model treats untrusted text as instructions. Sanitize and dual-model extract before reason.

PublishedSanitized Input Layer — external data is untrusted until extracted as data, not instructions.

Wipe-and-redeploy loses the lesson. Snapshot memory, revoke ephemeral JWTs, isolate the node — then investigate.

PublishedForensic-Ready Infrastructure — recover without erasing the root cause.