MODULE 8  ·  DAY 2

Securing & Governing AI Workloads

Harden and ship the crew — the open-source way

signed · scanned · sandboxed · governed

Gourav Shah  ·  School of DevOps & AI  ·  Hands-on

M8·01

What you'll learn

Six controls that make a containerized agent safe to ship to production.

12 34 56 Build a supply chain: SBOM → scan → sign with Syft, Grype, Cosign Sandbox tool and generated code in ephemeral, isolated containers Harden the agent image: least privilege, read-only, capped, secrets out Add input / output guardrails and human-in-the-loop review Run lightweight evals and tracing to catch regressions in CI Govern the agent without a vendor — a policy the pipeline enforces
M8·02

An agent is a security surface

It runs tools, executes code, reads secrets, calls the network.

Agent M7 crew runs MCP tools executes code reads secrets calls the network
M8·03

Three things every shipped product needs

Ship an AI image like a food maker ships a ready-meal: label, check, seal.

Ingredients label Health inspection Tamper seal = SBOM (Syft) = Vuln scan (Grype / Trivy) = Signature (Cosign)
M8·04

The supply-chain pipeline

Every agent, model, or code image passes through this before it deploys.

SourceDockerfile Builddocker build SBOMSyft ScanTrivy + Grype Gate SignCosign RegistryGHCR Verifyon deploy clean ↓ blocked fix & rebuild
M8·05

Two scanners disagree — that's the feature

Different advisory feeds catch different CVEs — triage, don't average.

Agent image 96 packages Trivy 2 Critical · 9 High Grype 5 Critical · 28 High Triage: fixable + severity
M8·06

Cosign: the tamper-evident seal

Key-based locally so you see it; keyless OIDC in CI so no key can leak.

Cosign sign key or keyless Registry image + signature Verify on deploy valid seal → run · else refuse
M8·07

Sandbox: a box with no blast radius

Run untrusted code in an ephemeral, locked-down box — then throw it away.

Host Sandbox generated code runs, returns, is discarded --rm · ephemeral --network none no egress --read-only --cap-drop ALL --pids-limit · --memory · no-new-privileges
M8·08

Hardening the agent image

The agent image still needs a small attack surface of its own.

Least privilege — run as a non-root user (USER appuser) Read-only rootfs — --read-only / ReadOnlyRootFilesystem Drop capabilities — --cap-drop ALL, add back only what's needed No privilege escalation — --security-opt no-new-privileges Resource caps — --memory · --pids-limit · --cpus Secrets out of the image · HEALTHCHECK + probes
M8·09

Guardrails at the model boundary

Supply chain protects the infra; guardrails protect what goes in and comes out.

Inputscreen Modelagent Outputscreen Humanapproves injection · out-of-scope PII · off-brand · bad URLs gate on destructive commands
M8·10

Lightweight eval — smoke test for behavior

A handful of labeled cases in CI catches regressions before production.

Safety Quality Scope refuses injection answers in-scope declines gracefully PASS PASS PASS 3 cases per dimension · runs in CI on every push · tracing records every step
M8·11

Governance without a vendor

Four documented, enforced answers — written in YAML, enforced by open tools.

What may it reach? — egress rules What credentials? — scoped, external Which MCP tools? — ToolHive allowlist Who approved it? — signed image + CI Policy gate OPA · Kyverno permit deny
M8·12

SHIP IT SAFELY

Trust is a pipeline, not a promise

Build Scan Sign Serve GitHub Actions — gates on security before it signs

In the lab: run the tools, prove isolation, wire a guardrail + eval.

Head to Module 8 · Lab.  ·  Gourav Shah · School of DevOps & AI

M8·13