MODULE 8  ·  DAY 2

Securing & Governing AI Workloads

Harden and ship the crew, the open source way

signed · scanned · sandboxed · governed

Gourav Shah  ·  School of DevOps & AI  ·  Hands-on

M8·01

What you'll learn

Six controls that make the agent safe to ship.

12 34 56 Build a supply chain: SBOM → scan → sign with Syft, Grype, Cosign Sandbox tool and generated code in ephemeral, isolated containers Harden the agent image: least privilege, read-only, capped, secrets out Add input / output guardrails and human-in-the-loop review Run lightweight evals and tracing to catch regressions in CI Govern the agent without a vendor: a policy the pipeline enforces
M8·02

An agent is a security surface

Four unguarded exposures, untrusted by default.

Agent M7 crew runs MCP tools executes code reads secrets calls the network
M8·03

1 · The analogy: ingredients label, health inspection, tamper seal

M8·04

Three things every shipped product needs

Ship AI like a ready meal: label, check, seal.

Ingredients label Health inspection Tamper seal = SBOM (Syft) = Vuln scan (Grype / Trivy) = Signature (Cosign)
M8·05

2 · The supply chain pipeline

M8·06

3 · The SBOM: ingredients label for your image

M8·07

The supply-chain pipeline

Every image passes through this before it deploys.

SourceDockerfile Builddocker build SBOMSyft ScanTrivy + Grype Gate SignCosign RegistryGHCR Verifyon deploy clean ↓ blocked fix & rebuild
M8·08

4 · Vulnerability scanning: two scanners disagree — that is a feature

M8·09

Two scanners disagree, that's the point

Different feeds, different CVEs: triage, don't average.

Agent image 96 packages Trivy 2 Critical · 9 High Grype 5 Critical · 28 High Triage: fixable + severity
M8·10

5 · Signing: the tamper-evident seal

M8·11

Cosign: the tamper-evident seal

Key-based locally, keyless OIDC in CI.

Cosign sign key or keyless Registry image + signature Verify on deploy valid seal → run · else refuse
M8·12

6 · Sandboxing agent, tool, and generated code

M8·13

Sandbox: a box with no blast radius

Run untrusted code once, then throw the box away.

Host Sandbox generated code runs, returns, is discarded --rm · ephemeral --network none no egress --read-only --cap-drop ALL --pids-limit · --memory · no-new-privileges
M8·14

7 · Hardening the container image

M8·15

Hardening the agent image

The agent image needs a small attack surface too.

Least privilege: run as a non-root user (USER appuser) Read-only rootfs: --read-only / ReadOnlyRootFilesystem Drop capabilities: --cap-drop ALL, add back only what's needed No privilege escalation: --security-opt no-new-privileges Resource caps: --memory · --pids-limit · --cpus Secrets out of the image · HEALTHCHECK + probes
M8·16

8 · Guardrails and evaluation

M8·17

Guardrails at the model boundary

Guardrails protect what goes in and comes out.

Inputscreen Modelagent Outputscreen Humanapproves injection · out-of-scope PII · off-brand · bad URLs gate on destructive commands
M8·18

A lightweight eval proves the guardrails work

A few labeled cases in CI catch regressions.

Safety Quality Scope refuses injection answers in-scope declines gracefully PASS PASS PASS 3 cases per dimension · runs in CI on every push · tracing records every step
M8·19

9 · Governance without a vendor

M8·20

Governance without a vendor

Four documented answers, enforced in YAML.

What may it reach: egress rules What credentials: scoped, external Which MCP tools: ToolHive allowlist Who approved it: signed image + CI Policy gate OPA · Kyverno permit deny
M8·21

SHIP IT SAFELY

Trust is a pipeline, not a promise

Build Scan Sign Serve GitHub Actions: gates on security before it signs

In the lab: run the tools, prove isolation.

Head to Module 8 · Lab.  ·  Gourav Shah · School of DevOps & AI

M8·22