Maia Iyer
IBM Research
Actions
Maia is an Advisory Software Engineer at IBM Research specializing in platform engineering and cloud-native security. While deeply experienced in zero trust - a dedicated maintainer of SPIFFE's Tornjak project - her research now tackles the infrastructure demands of the AI era. An active and passionate speaker and blogger, Maia now explores the intersection of agentic workloads and Kubernetes, and how cloud-native platforms must evolve to make AI agents run reliably and securely.
Area of Expertise
License to Generate: Securing AI Agents with Keycloak, SPIRE, and Envoy
Your organization may be aware of prompt injection, privilege escalation, and impersonation risks with AI agents. You may even be aware of some theoretical defenses: identity, sandboxes, and guardrails. But how do you actually implement these at enterprise scale?
This session walks through a working vendor-neutral, open-source implementation built on Keycloak, SPIRE, and Envoy that shifts AI security down to the platform layer. We will show how per-request identity becomes the foundation for fine-grained authorization and dynamic guardrails, and explore the critical interface between agent sandboxes and the broader platform. Finally, we will take a concrete scenario and show this platform blocking an attack at various layers, demonstrating defense-in-depth. Attendees will leave with a modular, cloud-native reference architecture to secure their enterprise against unpredictable, manipulatable agentic workloads.
Don’t Lose Your Agent’s Mind: Platform Patterns for Stateful Agents
Agents accumulate context and session history over hours or days, but all of it can vanish in an instant. We deployed multiple agent harnesses like Claude Code and Hermes on Kubernetes and found they all break in similar ways: unrecoverable sessions and silent state loss. Existing harnesses assume stable filesystems and process continuity - assumptions Kubernetes violates. This infrastructure mismatch is a problem no individual harness will fix.
This talk presents platform patterns for managing agent state. We cover where existing primitives stop and what agents actually need from platforms, like durable sessions that survive node failure and state that follows the workload from local development to cloud. We demonstrate crash recovery progressing from “everything is lost” to transparent session resume and outline the future of state governance. Participants will leave with an adoptable Kubernetes-native reference architecture to support state-rich agentic workloads.
Your CI's Mistaken Identity
You wouldn't ask a plumber to sign off on your electrical work. Yet most CI/CD pipelines run under a single identity: one credential for signing SBOMs and reporting vulnerabilities alike. Workload identities encode location, not authorization.
This session shows how to close that gap with Tekton: admission-time verification of signed remote task definitions constrains the SPIFFE/SPIRE identity each task receives. Tasks use that SVID to produce in-toto attestations scoped to their role. Policy engines can then enforce that each claim came from the right kind of task — a vulnerability attestation from a scanner, an SBOM from a build task — not just that a signature exists.
Attendees leave with a working technique and one transferable insight: authorization should follow role, not location — from signing attestations to authenticating against external services.
Advancing Machine to Machine Workflows with the SPIFFE Identity Provider
Traditional approaches of secrets management in enterprise rely on distributing and rotating long-lived credentials, a practice that conflicts with zero-trust principles and increases operational risk. The Secure Production Identity Framework for Everyone (SPIFFE) and its implementation, SPIRE, a graduated CNCF project, solves this by issuing short-lived workload identities as x.509 certificates or JWTs.
In this beginner-friendly session, we will introduce core concepts of SPIFFE and SPIRE and how they replace static credentials with dynamic workload identities. We will then dive into how Keycloak’s new SPIFFE Identity Provider feature enables an integration with SPIRE. We will walk though how to configure SPIRE and Keycloak to allow seamless authentication of workloads using SPIRE-issued JWT SVIDs.
When an Agent Acts on Your Behalf, Who Holds the Keys?
When you prompt an agent to commit code or trigger a workload, who is truly acting? In enterprise environments, ambiguity creates a critical security vulnerability that makes fine-grained authorization and audit impossible. Traditional static API keys simply can’t capture the full context behind an action.
In this session, we will present an architecture that cryptographically binds agent identity with delegated user identity. We will demonstrate how SPIRE’s workload attestation can be extended to create a verifiable agent identity, and how Keycloak, acting as an OAuth 2.0 server, manages delegated user identity while preserving context across long, nested transactions. Finally, we’ll introduce an open-source MCP Gateway that enforces policy and audit controls at a single, trusted point between agents and tools.
Attendees will leave with a clear understanding of how to build agentic systems where every action is traceable to both the code that execute it and the user who approved it.
Who Let the Agents Out? Securing AI Workflows the Right Way
Agentic workflows in cloud-native environments demand robust identity and authorization. This session explores how to move beyond hard-coded credentials by assigning trusted, granular identities to agents acting on behalf of users. We'll dive into strategies for establishing traceability, enforcing least privilege, and enabling auditable decision-making within a zero-trust architecture.
Focusing on shared agents and tool-calling patterns, we'll demonstrate how SPIRE’s workload identity integrates with user identity to support secure delegation and dynamic, context-aware authorization. You’ll learn how to safeguard agent interactions with external tools and data sources through identity propagation and policy enforcement.
Through a real-world case study using Llama Stack and the extended Model Context Protocol (MCP), attendees will gain actionable insights to build secure, identity-aware agentic platforms ready for production use.
Build-a-Bot Workshop: Enabling Trusted Agents with SPIRE + MCP
Agentic platforms are redefining how cloud-native applications interact—but behind every action lies a critical question: who is allowed to do what, and why? Emerging standards such as MCP allow AI agents to easily connect with tools, but organizations looking to support agents must maintain security and transparency. They can do so by combining the power of OAuth 2.0 with strongly attested workload identity from SPIFFE.
In this hands-on workshop, we’ll dive into the mechanics of secure workload identity for agents and tools—no prior experience required. Attendees will work hands-on with a working agentic stack, including MCP for agentic tool-calling, and integrate with cloud-native tools such as SPIRE for workload identity, and Keycloak for user management. These existing technologies are key for enabling granular access control and rich audit trails across the full agentic flow. This workshop lays the foundations to building identity-first, zero-trust agentic platforms.
Demystifying and Enabling Workload Identify Across the Cloud Native Ecosystem
Zero Trust principles represent a departure for how systems traditionally communicate with each other. Instead of long-lived credentials, access is granted based on caller identity to enable elevated security controls. Most public cloud providers and hosted solutions support assigning identities to workloads and has been enabled in many applications and frameworks. However, many end users are unaware of the baseline fundamental concepts.
In this interactive tutorial, attendees will dive into the world of workload identity management, their components, how identities are generated, and where they can be used. By leveraging SPIFFE and SPIRE, CNCF projects providing tools for establishing trust between systems, we'll showcase how workload identities can be used beyond the Public Cloud to secure applications and systems in any environment. Upon completion, participants will have the knowledge, skills, and real world examples to implement these patterns in their own environments.
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top