# Palana (Part 2): Architecting isolation, identity, and auditability for AI agents

[Grab](https://yomu.fyi/company/grab) · Kevin Littlejohn · Jun 21, 2026

## Summary

Grab's Palana platform provisions isolated, Kubernetes-native runtime environments for autonomous AI agents using dedicated per-agent namespaces and role-based access controls. The architecture separates network enforcement across layers, applying Layer 3 and Layer 4 containment with Cilium and NetworkPolicy alongside Layer 7 application filtering evaluated by Open Policy Agent. Agent interactions with large language models route through a LiteLLM proxy wrapper that retrieves credentials from HashiCorp Vault based on Kubernetes pod context rather than client headers. Secrets management is divided between directly readable agent paths and proxy-only placeholder paths that prevent raw tokens from residing in runtime filesystems. An automated reaper monitors multi-source activity signals to shut down idle compute resources while preserving persistent storage and configuration state.

## Takeaways

- Palana splits HashiCorp Vault paths into agent-readable secrets and proxy-only secrets with inert placeholders, allowing agents to execute authenticated requests without storing real credentials in memory or filesystems.
- The platform enforces network boundaries in two tiers, using Cilium and Kubernetes NetworkPolicy for Layer 3/4 containment and Open Policy Agent within an egress proxy for Layer 7 application routing.
- An automated reaper tracks activity signals across Git, proxies, Slack, and Prometheus to decommission idle agent workloads while preserving their persistent storage, role-based access control, and namespace state.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [Kubernetes](https://yomu.fyi/topic/kubernetes), [LLMs](https://yomu.fyi/topic/llm), [Observability](https://yomu.fyi/topic/observability)

[Read original post](https://engineering.grab.com/part-2-palana-architecture)