Palana (Part 1): Why Grab built a secure platform for autonomous AI Agents

Summary

Palana is Grab’s Kubernetes-native platform for running autonomous and semi-autonomous agents with isolation, controlled access, and operational oversight. The post describes why laptop-based tools and simply running agents in containers do not adequately address persistent state, identity, credentials, network access, auditability, and emergency control. Its architecture gives each agent a namespace, service account, storage, network policy, and Vault scope, while Envoy, ext-authz, and OPA mediate and log HTTP(S) egress; proxy-only secrets keep underlying credentials out of agent processes. A portal and pcli manage lifecycle, and external kill switches and idle shutdown provide controls outside the agent. Palana is used for development environments, Slack automation, framework testing, and long-running internal workloads, with deeper architecture details reserved for Part 2.

Takeaways

1. 1

   Each agent receives an isolated namespace, service account, storage, network policy, and Vault scope; inter-agent communication requires explicit peering rules.

2. 2

   Proxy-only secrets let agents use placeholders while the egress proxy retrieves real credentials from Vault and injects them into outbound requests.

3. 3

   Palana’s kill switch removes the agent’s network path externally, rather than relying on the agent process to stop cooperatively.