The Agent Needs a Passport, Not a Set of Keys

We obsess over what AI agents can do. We almost never audit what they are allowed to touch. That asymmetry is where the next enterprise incident is hiding.

The CNCF’s OpenKruise Agents project just shipped v0.6.0 – 283 merged pull requests – adding two data-plane components (traffic-control-plane, traffic-proxy) that pull sandbox egress out of the Pod and into a governed, inspectable path, alongside proxy-side credential injection, MCP tool-level ACLs, checkpoint-restore upgrades for paused fleets, and warm-pool autoscaling.

The sandbox is becoming a security boundary, not just a runtime. The design uses a two-stage takeover: kernel-space L4 capture in the pod, centralised L7 inspection at the gateway. I find the ordering discipline instructive – an L4 denial happens before traffic ever reaches the gateway, and L7 can never override it. For architects, this is the familiar latency-versus-visibility trade: filter cheaply at the edge, inspect expensively in the centre. But it has a cost that the release notes state honestly – the egress gateway is now on the critical path, and those throughput numbers are theoretical upper bounds, not SLAs. Size it as a control plane with a capacity plan, not a sidecar you forgot to tune.

The highest-value idea here is credential separation. API keys live in Kubernetes Secrets; the proxy resolves them per request and rewrites the outbound header; the Agent only ever holds a placeholder. Rotating a secret takes effect without restarting a sandbox. I would push this further than the authors do: any workload executing prompt-injectable code should never hold upstream credentials, because prompt injection is not a defect you patch – it is an input you must design around. Domain allowlists are too coarse a defence when a model can be talked into calling a tool it shouldn’t; matching on params.name inside JSON-RPC tools/call is the right granularity.

And then there is the unglamorous half – the bill. CheckpointRestore preserves the writable rootfs through upgrades; a state filter lets the controller wake paused instances, upgrade, and re-pause them so the fleet ends in the shape it started. That is an architectural ethic worth copying: an upgrade must never silently convert hibernation into spend. The asymmetry in autoscaling – fast scale-up, slow scale-down – matches how humans actually experience scarcity. Nobody notices a slow shrink; everybody notices an empty pool.

One caveat the authors get right and too many readers will skip: this covers gateway-routed traffic only. Root containers with NET_ADMIN bypass in-pod ACLs entirely. Defence in depth, not a wall.

The Bharat parallel is not decorative. Aadhaar eKYC and card tokenisation already taught our public infrastructure a principle the West is only now relearning for AI: the citizen’s secret should never travel to the application. As state departments and MSMEs in the Northeast begin piloting agents against DPI data – DigiLocker, ONDC, land records – this proxy-held-credential model is precisely the sovereignty control they will need. And the auto-pause-plus-small-warm-pool pattern is frugal computing in the truest sense: capacity that sleeps when the citizen does.

Three takeaways for CTOs:

• Treat the agent sandbox as a policy enforcement point in your architecture diagram, not a deployment detail.
• Move secrets out of the workload and into the request path – rotation speed becomes a security metric.
• Budget for idle, or idle will budget for you.

An autonomous system is only as trustworthy as the boundary you can draw around it – and the discipline to keep drawing it after launch.

---

About the Author: Sanjeev Sarma is the Founder Director and Chief Software Architect at Webx Technologies. With a core focus on Generative AI integration, Cloud-Native Scalability, and Enterprise Software Architecture, he has spent over two decades driving digital transformation across Northeast India and beyond. Beyond his corporate leadership, Sanjeev is deeply invested in shaping the future of the IT industry. He serves as an Industry Expert on the Board of Studies for Assam Don Bosco University’s School of Technology, advises state technology committees, and actively mentors emerging tech startups at STPI. He brings a unique, dual perspective of high-level enterprise execution and future-ready academic curriculum development.