Palana (Part 2): Architecting isolation, identity, and auditability for AI agents

Summary

Palana is Grab’s Kubernetes-native secure execution platform for autonomous AI agents, designed to provide isolated, attributable, and auditable environments. It provisions per-agent namespaces, service accounts, EFS-backed storage, ingress, policies, and proxy-mediated egress, while admission webhooks inject proxy settings and enforce pod restrictions. Human identity remains authoritative for RBAC, while sanitized identifiers are reserved for object names and Vault paths; secrets are split between agent-readable values and proxy-only credentials, and the LLM wrapper derives agent identity from Kubernetes context. Layer 3/4 controls provide containment, Layer 7 OPA-backed proxy policies govern host and method access, and structured signals support audit and idle shutdown that preserves /data and platform state. The production lessons emphasize platform-level controls, a safe self-service path, namespace boundaries, proxy-mediated authentication, and lifecycle management as prerequisites for useful autonomy.

Takeaways

1. 1

   Each agent receives its own namespace, service account, persistent /data storage, ingress, policies, and credential scope, creating a consistent boundary for RBAC, logging, quotas, network controls, and incident response.

2. 2

   Proxy-only secrets let an agent cause an authenticated request without exposing the real credential to its filesystem, logs, process environment, or prompt context.

3. 3

   The reaper combines gateway and proxy logs, Git activity, Slack-routed messages, and Prometheus network activity to detect idleness, warn users, and stop compute while preserving /data, RBAC, namespace, and Vault state.