Trust Chains for AI: Scaling Cross-Enterprise MCP Workflows Safely Case Study

Identity and authorization brokerage across trust domains continues to be a challenging problem. When agents interact, we see an evolution of prior models where service accounts or users in one domain assume roles in another to execute tasks and APIs. With the rise of autonomous agents, this model extends to agents invoking other agents or MCP servers across domains using a brokered trust framework.

In this case study, we demonstrate a cross-domain, multi-agent architecture enabling secure delegation, dynamic identity propagation, and fine-grained authorization. Using emerging standards such as XAA and verifiable credentials, we show how agents exchange tokens across identity providers, enforce policy-based access control, and maintain auditable delegation chains.

Participants will gain practical insights into building zero-trust agent systems that operate securely across enterprise boundaries, with governance, provenance, and dynamic scoping built in.

MCP and agents - Global, protected, secure collab from Desktop to Data center

Teams are diverse, geographically distributed and developers, testers, users operate at different layers of abstraction. Collaboration is challenging. The common perception is that Kubernetes is hard! What if we made it easy and secure and protected with all the controls of a production grade deployment from desktop to data center. Well we took a few projects from LF (Envoy, Envoy, AI gateway, agntcy.org) and other open source contributors (iroh and Datum) and built exactly that. We demo this with autonomous agents accessing MCP servers with authentication, authorization policy enforcement and governance across domains using emerging standards such as XAA, KYA, VC/DID

Securing Cross‑Enterprise AI Agents: An open source Identity and Governance case study

Identity and authorization brokerage across trust domains continues to be a challenging problem. When agents interact, we see an evolution of prior models where service accounts or users in one domain assume roles in another to execute tasks and APIs. With the rise of autonomous agents, this model extends to agents invoking other agents or MCP servers across domains using a brokered trust framework.

In this case study, we demonstrate a cross-domain, multi-agent architecture enabling secure delegation, dynamic identity propagation, and fine-grained authorization. Using emerging standards such as XAA and verifiable credentials, we show how agents exchange tokens across identity providers, enforce policy-based access control, and maintain auditable delegation chains.

Participants will gain practical insights into building zero-trust agent systems that operate securely across enterprise boundaries, with governance, provenance, and dynamic scoping built in.

An Identity Architect, Security Engineer & Agent Walk Into a Bar: The Agent Asks "Who Allowed That?"

Autonomous agents are here, and enterprises are scrambling to secure them. Identity systems built for humans and services don’t support agents that reason, delegate, and act across trust boundaries. The question shifts from “who are you?” to “who authorized this action, why, and how is it proven?” This creates 4 challenges:

1 Bring Your Own Protocol Nightmare
Lack of standard protocols for agent identity and discovery fragments the ecosystem and limits cross-domain interoperability (DID vs. IAM).

2 Multi-Hop Token Challenge
Cross-domain authorization is required to establish trusted agent identity and enable scalable enterprise TBAC.

3 Context is Everything
Use trusted verifiable credentials (VCs) to enable context-aware authorization, embedding user context in agent tokens for compliance.

4 Digital Forensics Guide to Autonomous Accountability
Standardize audit logs for autonomous agents, capturing intent, delegation, and metadata for transparency, accountability, and forensics.

Autonomous Agents, Bounded Privileges : OpenClaw Reference Architecture for Kubernetes Config Audit

Autonomous agents that act on a user’s behalf introduce identity and authorization risks the cloud native stack cannot adequately mitigate: data exfiltration from overprivileged or compromised agents, lost delegation context as agents cross domains and trust boundaries, and intent drift beyond authorized scope.

This talk presents a reference architecture to mitigate these risks. We use OpenClaw, an open source personal agent scoped with four added identity primitives: AGNTCY Identity Service-issued crypto-attested badges, ID-JAG tokens, declarative policy for fine-grained authorization at trust boundaries, and an end-to-end delegation chain for governance and auditing, in a Kubernetes-native stack.

Case Study: A SecDevOps engineer delegates OpenClaw to run a Kyverno config audit against a KinD workload. OpenClaw detects violations, spawns a scoped sub-agent, exchanges tokens across Keycloak realms, and posts findings to Slack after Cedar/OPA approval through Envoy AI Gateway.

Building a Community AI Platform Engineering on Kubernetes using agentgateway and kagent

This hands-on tutorial guides attendees through building a Community AI Platform Engineering (CAIPE), an open-source, Multi-Agentic AI System on Kubernetes. CAIPE serves as a supervisor “deep-agent,” orchestrating sub-agents that can be either kagent-managed or self-provided.

Participants will deploy CAIPE on a Kubernetes cluster alongside kagent, connect it to MCP tools via agentgateway (including multiplexing multiple MCP servers behind a single endpoint), and assemble end-to-end workflows for platform operations such as CI/CD and SRE use cases.

The workshop will demonstrate integration and authentication with Keycloak and developer tooling like Backstage using the agentforge plugin. Attendees will also explore connecting agents via A2A, enabling long-running, cross-agent workflows. By the end, participants will leave with a reference blueprint, manifests, and security and observability patterns to bootstrap their own community AI platform.

caipe.io: Multi-Agent Systems for AI-Driven Platform Engineering

Platform engineering teams are increasingly exploring how AI can automate operational workflows across infrastructure, deployments, and developer support. Many real-world scenarios, however, require multiple specialized agents collaborating together, rather than a single AI assistant.

This session introduces caipe.io, an open platform that applies multi-agent systems to automate platform engineering operations. We will demonstrate how agents collaborate across tools such as Git, Kubernetes, CI/CD pipelines, and incident management systems to support tasks like troubleshooting, deployments, and infrastructure management.

This hands-on technical session will walk through the architecture and design patterns behind building AI-driven platform engineering systems using coordinated agents, with practical examples from real engineering workflows.

CAIPE: Open Source Agentic AI for Platform Engineering

Platform engineering teams manage increasingly complex cloud-native stacks, where everyday tasks like deploying an application, finding the right operational information, answering “what changed?”, and triaging failures often require jumping across tools, Kubernetes state, GitOps configuration, CI/CD history, tickets, and fragmented documentation.

CAIPE is a production-grade, open-source “deep agent” platform: it combines coding-capable agents with a supervisory multi-agent architecture that can securely access platform systems (Kubernetes, GitOps, source control, tickets, and docs) under appropriate RBAC and policy controls. It grounds decisions in unified knowledge bases, including RAG, GraphRAG, and data agents, so it can orchestrate complex, multi-step platform workflows with traceability.

In this session, we’ll show how CAIPE orchestrates workflows across the platform toolchain (Kubernetes, GitOps, source control, tickets, and knowledge) using open standards such as MCP and A2A to deliver concrete outcomes: faster self-service and onboarding, reliable retrieval of the right platform context, accelerated triage and root-cause analysis, PR-ready remediation (code and configuration changes), and policy-aware execution with traceability and approvals.

We’ll also cover how teams can use CAIPE as composable building blocks to create their own production-grade, extensible agentic platform engineering system, and how it can be operationalized on Kubernetes using Helm charts and standard cloud-native delivery practices. The session will include a demonstration of how CAIPE can be consumed through an IDP (for example, Backstage via the Agent Forge plugin) or used through a dedicated web UI or CLI, enabling teams to define new capabilities as Agent Skills and assemble repeatable, task-configured workflows that convert platform intent into reliable execution.

Revolutionizing Argo Integration with Model Context Protocol: An AI-Driven Approach

This presentation introduces an innovative approach to developing Model Context Protocol (MCP) servers for the Argo project suite within the CNOE Platform Engineering AI Assistant framework. We demonstrate an automated, AI-powered solution that generates MCP servers for Argo CD, Workflows, and Rollouts. Beyond simple OpenAPI conversion, our method leverages Large Language Models (LLMs) to enhance API context and descriptions. The solution features automated maintenance through GitHub Actions, enabling Argo maintainers to effortlessly keep their APIs updated. This low-touch approach represents a significant advancement in AI agent plugin frameworks, specifically tailored for CNCF tool integration. At CISCO we are using this process to generate MCP servers for Argo for our internal developer platform Assistant Jarvis.

Building the community’s AI Platform Engineer

We have embarked on the journey of developing an open-source platform engineering multi-agent system (MAS) that serves the broader cloud-native community as part of the CNOE (Cloud Native Operational Excellence) community.

Check it out at https://github.com/cnoe-io/agentic-ai/blob/main/README.md

We'll explore the details of both the technologies behind this multi-agent system and our successes at Outshift by Cisco, as outlined here: https://blog.langchain.dev/cisco-outshift/

We envision empowering everyone in the community with a personalized multi-agent system featuring potentially hundreds of tools and sub-agents to meet their unique platform engineering needs, providing a delightful user experience that includes ArgoCD, Backstage, JIRA, PagerDuty, Slack, cloud services, Kubernetes, and many more.

Let’s drive Agentic innovation to automate daily toil, enhancing the work-life quality for platform engineers worldwide.

Fully automated developer environments for incubation teams (batteries included)

Incubation teams strive for agility and autonomy in their development lifecycle. From rapid coding to application deployment, these incubation teams are thinly staffed and short-lived, but they have similar application deployment needs as typical product teams. They lack the context or skills to fully comprehend the complexities of securely deploying applications. SRE teams struggle to engage with incubation teams to deploy and manage their services in a timely manner. Fortunately, advancements in Kubernetes operators allow developers to consume secrets management, certificate management, ingress management, dns management, observability etc. while still maintaining autonomy and minimal intervention from SRE teams. Presenters will discuss how their SRE team leverages these operators to create "batteries included" developer environments to support multiple incubation teams. Presenters will also describe strategies for automating an end-to-end CI/CD system that simplifies application deployment for developers while minimizing impact to their autonomy and application security.

Dynamic Secrets injection in a multi-tenant environment while preserving self-service capabilities.

Outshift Platform team at Cisco supports many incubation projects that are at various stages of development life cycle. We implemented a multi-tenant Kubernetes environment with a standard namespace isolation for applications to run.

One of our core goals in this multi-tenant environment is to dynamically inject application secrets from an external secrets management system like HashiCorp Vault into Kubernetes secrets, while preserving self-service capabilities of the developers to manage their projects independently. An individual team application should only be allowed access to secrets that belong to their team.

Forementioned requirements posed a unique challenge in securely injecting secrets into various namespaces without compromising the least privilege requirement across team boundaries. Also, such a system must be consumed by developers in an understandable and automated way.

This talk will demonstrate how the platform team overcame this challenge by leveraging a combination of the External Secrets Operator, HashiCorp Vault Kubernetes authentication and Vault policies. It will also demonstrate how the developers are able to easily specify custom resources with secrets paths scoped to their team that will be injected into target Kubernetes secrets. These custom resources are bundled along with application helm charts and deployed via standard gitops methods.

Secrets injection from external secret managers in multi-tenant Kubernetes has become a common practice in many organizations. The mechanics of how this is achieved across organizations is not standardized. On one extreme, the developers manually deploy application secrets and avoid setting up proper automation. Some implementations often allow application teams wide access to secrets than they are supposed to have.

Tools used for secrets injects are opaque to developers which leads to more confusion and frustration. In summary, self-service and automation of secrets injection is lacking in many organizations.

This talk will a methodology that has achieved clarity in automation, good developer success and is currently in practice in a large organization serving various independent projects. This is methodology is offered a as a model for implementing secrets injection to other organizations with similar needs.

Secrets management done right in CI/CD

Secrets Management in CI/CD pipeline when done right is very secure, less intimidating and developer friendly. In this session we will talk about various design principals on how to secure CI/CD secrets with proper RBAC controls, while making it accessible and self-serviceable to the developers. Share best practices to store, distribute secrets in developer community. We will walk thru practical example of how this is done Cisco's Emerging Tech and Incubation SRE team in a multi-tenanted environment.