Talk
zero-trust agents - agentic AI defense patterns
Agentic frameworks allow for creating autonomous workflows that integrate with production systems via tools that access live databases, internal APIs, and runtime environments. When an agent is granted credentials to perform state-mutating actions—such as processing financial transactions, modifying database records, or executing arbitrary code—it introduces significant security risks. The core challenge lies in the agent's operational model: an LLM determines its own tool-use sequence and execution path based on non-deterministic, natural-language inputs. Traditional security models, like perimeter security and static ACLs, can authenticate the agent itself but lack the capability to inspect or enforce policies on the specific, runtime-generated actions the agent decides to execute internally. This creates a critical visibility gap and a new attack surface within your security boundary. In this session we introduce defense patterns for agentic AI systems build with ADK - we explore 3 different but complimentary patterns : 1. Cryptographic write signatures: Assign each agent a hardware-backed key to sign every database mutation, ensuring non-repudiation and tamper detection. 2. Kernel-level code isolation: Execute all dynamically generated code inside a gVisor user-space sandbox with zero network egress and strict resource limits. 3. Deterministic semantic gateways: Proxy model inputs and outputs through deterministic validation rules enforced by automated CI/CD test suites.
