How much trouble can an end user really cause with an AI-powered chatbot? What guardrails do you need before a customer touches an AI tool on your cluster?

In this tutorial, you get your very own burrito-ordering chatbot, powered by kagent, on a full internal developer platform. You work in a browser terminal, and your cluster has everything an operator could ever want.

That is, everything except guardrails.

Your first job is to misbehave. Can you coax the chatbot into exploring the file system? Can you implore it to deploy a malicious image? Can you sweet-talk your helpful burrito friend into leaking PII into its trace data?

After each successful attack, you enact the block. Some predate AI, like network policies, Kyverno admission policies, and runtime policies from Falco/KubeArmor. Others are AI-specific, like input and output scanning, classifier models, and tool allow-lists.

Come for the burrito crimes. Leave knowing how to secure a customer-facing AI tool on Kubernetes.