Deploying autonomous AI agents in cloud-native environments introduces key security risks, including excessive API privileges, prompt injections, and unmonitored C2 callbacks, which traditional perimeter defenses cannot handle.

This session presents an open-source architecture for edge-level agent governance. We cover decoupling authentication and authorization via Envoy Proxy, Authorino (PEP), and Keycloak SSO. At the network boundary, combining eBPF kernel probes with local, air-gapped SLMs (such as Nimble 9B via Ollama) provides deterministic risk evaluation in under 50 ms per request, preventing data leaks to external APIs and avoiding token costs.

Attendees will receive actionable blueprints for zero-trust agent governance, eBPF network filtering, and air-gapped SLM routing.