The transition to production-grade agentic AI introduces critical security and governance challenges due to agent autonomy. This session details a multi-tier, cloud-native architecture combining the Kubernetes AI Gateway and OpenShell to establish defense-in-depth for autonomous AI workflows.

At the network and payload layer, the Kubernetes AI Gateway handles protocol translation (MCP/A2A), token rate-limiting, and payload inspection. At the execution layer, OpenShell provides kernel-level container sandboxing via eBPF, seccomp, and Landlock, paired with in-process OPA policy enforcement to prevent unauthorized syscalls and data access.

Building on CNCF cloud-native agentic standards and a 6-layer defense in depth framework for AI agents, we demonstrate how leveraging Kubernetes RBAC, SPIFFE workload identities, and isolated agent execution planes provides a scalable, enterprise-grade control plane for agentic AI.