13 posts
Foundry IQ's pitch is that your agents get one endpoint for grounded, cited, multi-source context instead of a hand-rolled retrieval stack. !banner What doesn'...
Run untrusted agent-generated code in Kubernetes with a layered sandbox: gVisor runtime isolation, restricted Pod Security, default-deny networking, quotas and admission policy that enforces all of it.
Once your multi-agent system (Parts 6-8) is functionally solid, the question that comes up in every enterprise security review is the same: how do you know an a...
Instrument LLM agents with OpenTelemetry GenAI conventions, send traces and metrics to Grafana, and build dashboards and alerts for cost, latency, guardrail blocks and tool failures across AWS Bedrock, GCP Vertex AI and Microsoft Foundry.
The default Azure Databricks workspace is more open than most security teams are comfortable with. Control plane traffic goes over the public internet, secrets ...
Run MCP servers as isolated containers behind the Docker MCP Gateway, keep secrets out of config files, harden your own tool servers, and build an agent in Compose that can only reach the tools you approved.
The hardest part of scaling a data platform isn't the compute. It's knowing who can access what, proving it to auditors, and not breaking everything when someon...
Great system design combines theory with practical experience from real-world implementations. In this piece, we'll dive into secure multi-tenant saas (auth, isolation, limits), revealing the trade-of...
For over a decade, the traditional security paradigm relied on the "castle-and-moat" strategy: a hardened network perimeter protecting internal assets. However, as Google discovered following the "Ope...
In the modern cloud landscape, the concept of a "perimeter" has shifted from the network to the identity. As organizations scale from a single AWS account to hundreds or thousands under AWS Organizati...
In the traditional cloud security model, the standard mechanism for authenticating external workloads to Google Cloud Platform (GCP) was the service account key. These long-lived JSON files were a per...
Identity and Access Management (IAM) is the foundational security layer of the AWS ecosystem. In a cloud-native environment, the traditional network perimeter has effectively dissolved, replaced by id...
Add vulnerability gating, SBOM and provenance attestations, and keyless signing to a GitHub Actions pipeline using Docker Scout, BuildKit and Cosign, with policies that fail the build only when it matters.