Cloud Native Computing Foundation (CNCF)’s Post

The biggest challenge with AI agents in enterprise environments isn't capability — it's governance. I've been exploring how OpenClaw combined with OpenShell sandboxing solves this problem elegantly. The key insight: a simple policy file that defines exactly what network and file access your AI agent has. Think about it: → Explicit control over which APIs the agent can call (Anthropic, Perplexity, YouTube, Telegram) → Granular file system permissions → Complete audit trail of agent actions → Enterprise-grade security without sacrificing AI capabilities This is Infrastructure as Code applied to AI governance. The same DevOps principles that transformed how we deploy software are now transforming how we deploy AI agents. Microsoft's Agent Governance Toolkit and NVIDIA's OpenShell are leading this shift — addressing all 10 OWASP Agentic Top 10 concerns. The companies that figure out AI governance early will have a significant competitive advantage. The rest will be stuck choosing between innovation and compliance. What governance challenges are you facing with AI agents in your organization? Relevant resources: https://lnkd.in/gURt6qha https://lnkd.in/gFKrZCBN #AIGovernance #EnterpriseAI #DevOps

Shadow IT isn't just a compliance headache; with AI, it's an IP time bomb. We recently faced this head-on: our engineering team was leveraging public AI tools for code refactoring and debugging. While the intent was productivity, the execution was a critical security blunder. Proprietary code was being fed into third-party models, creating an unacceptable risk of intellectual property leakage and potential data breaches. The short-term productivity boost was completely overshadowed by the long-term liability. We couldn't ban AI; we had to secure it. Our solution was direct: deploy a private, self-hosted 'Team AI' instance. Leveraging Docker and AWS, we built an isolated environment where code stays within our network perimeter. All interactions are logged and encrypted, giving us full data governance. This setup supports various LLMs, ensuring engineers get the assistance they need without compromising our assets. This move transformed a significant risk into a strategic advantage. Providing a secure AI sandbox fosters innovation responsibly. Your data privacy and intellectual property demand a controlled AI environment, not a public free-for-all. #AI #Automation #DevOps #Security #CloudSecurity #Infrastructure #SoftwareEngineering #Backend #Docker #AWS #DataPrivacy #LLMs #AIinProduction #TechStack #CTO #Founders #TechLeadership #StartupLife #ScalingTech #BusinessStrategy #DigitalTransformation #EngineeringLeadership #FutureofWork #Innovation #TechSolutions #Cybersecurity

 Why Your AI Agents Need a Supervisor Microsoft is betting the house on "Copilots for everyone." But as we scale AI-generated code, we’re seeing a new bottleneck: The Trust Paradox. The faster AI writes code, the faster "Agentic Debt" (security and architecture drift) piles up. CISOs are starting to block Copilot expansions because they can't audit the "background worker" at scale. The Solution: Opsera acts as the Governance Safety Switch for the Microsoft Agentic 365 ecosystem. By running orchestration "inside the boundary," Opsera provides the automated policy gates that ensure AI-generated code meets corporate standards before it ships. We aren't just accelerating code; we are orchestrating the trust required to scale it. For my MSFT partners: This is how you unblock the GHE/GHAS seat-buys that are currently stalled in the Security Review. #GitHubCopilot #AIAgents #Governance #DevOps #DigitalTransformation #Opsera

Scaling Kubernetes with automated guardrails? KyvernoCon at KubeCon + CloudNativeCon EU focuses on policy as code in production, covering governance, security standards, and operational consistency for platform engineering in the era of AI. Read the deep dive from co-chairs Cortney Nickerson & Shuting Zhao: https://lnkd.in/etDYh679 #KubeCon #CloudNative #Kyverno #Kubernetes #OpenSource

Most AI systems today are built fast… but not built securely. At NorthPoint, I’m focusing on something different: We are building AI-driven platforms with DevSecOps + Security-first architecture from day one. That means: Every API is protected with proper access control AWS infrastructure is designed with IAM least privilege VPCs are isolated and monitored in real-time Threat detection is integrated using GuardDuty + logging pipelines CI/CD pipelines are fully automated but security-validated AI is powerful. But insecure AI systems are dangerous. My goal is simple: 👉 Build AI systems that are not only smart 👉 But also secure, scalable, and production-ready We are still early — but the foundation is being built the right way. #DevSecOps #AI #CloudSecurity #AWS #SystemArchitecture #NorthPoint

Your server went down at 2 AM. You didn't get paged. You didn't lose sleep. ClawdAgent already handled it. Here's what happened behind the scenes: → Monitoring agent detected the anomaly → Diagnosis agent identified root cause in seconds → Recovery agent executed the fix autonomously → Memory system logged the incident for future prevention No human in the loop. No downtime spiral. Just silent, autonomous infrastructure management working while you sleep. This is Server Management inside ClawdAgent — not just alerts, but actual resolution. The difference between a tool that tells you something broke and one that fixes it before you even know. Solopreneurs running lean ops can't afford a 24/7 DevOps team. Now they don't need one. Would you trust an AI agent to manage your servers autonomously — or is that a bridge too far? 👇 https://lnkd.in/dDW-qeci #AIAgents #ClawdAgent #AutonomousAI #FutureOfWork #DevTools

Only 5% of organizations currently allow AI agents in production. That number from KubeCon Amsterdam 2026 is both striking and completely understandable. The question isn't whether AI agents will run on Kubernetes. They already do. The question is: do your guardrails exist yet? Three key takeaways from KubeCon Amsterdam 2026: 1. Kubernetes Agent Sandbox is now a real thing. The CNCF community shipped a first-class way to run sandboxed AI agents on Kubernetes, limiting blast radius when LLM-generated code does something unexpected. Security-first by design. 2. Dynamic Resource Allocation (DRA) is graduating to beta. GenAI workloads (training, fine-tuning, inference) need GPU access at scheduling time, not as an afterthought. DRA makes this native to Kubernetes without hacking around resource policies. 3. Platform teams are treating AI-generated code as untrusted input. Security and compliance gates are becoming the frontline defense in internal developer platforms, not a post-deployment concern. At CaeliCode Solutions, we help teams design the infrastructure guardrails that make AI adoption safe and scalable: from cluster hardening to agent sandbox patterns and policy-as-code pipelines. Is your team running AI agents in production yet? What does your isolation strategy look like? #CaeliCode #CloudEngineering #Kubernetes #PlatformEngineering #AIAgents #KubeCon #DevOps #CloudNative #CNCF #GenAI #InfrastructureSecurity #AIInfrastructure

Here's the problem: The attack surface is expanding faster than the security model. AI security conversations fixate on model weights and training data. But the easiest place to compromise isn’t the model - it’s the infrastructure wrapped around it. Labeling pipelines with privileged access. Model‑ops systems pushing updates on trust. Plugins and RAG connectors that inherit permissions they never earned. AI infrastructure inherits the sins of DevOps. Speed over scrutiny. Automation over verification. Pipelines that assume integrity instead of proving it. Attackers love systems built on trust, and they don’t fight the castle walls. They compromise the contractors who built the drawbridge. If you’re not threat‑modeling your AI supply chain, you’re not securing anything. #auguryit #supplychains

The infrastructure layer for AI agents is quietly becoming the most important engineering decision you'll make this year. Vercel just dropped their "Agentic Infrastructure" framing and it clicked something for me. We've moved from servers → cloud APIs → serverless, and now AI agents need their own runtime primitives. Sandboxes, snapshots, isolated execution — this isn't just DX polish, it's foundational. If you're building agentic features without thinking about this layer, you're going to hit walls fast. The Zero Data Retention on AI Gateway update hits different when you work in healthcare. Managing fragmented data policies across multiple model providers is genuinely painful, and in a HIPAA environment it's not just annoying — it's a compliance risk. A single gateway with zero retention by default changes the calculus for what AI features we can ship without legal back-and-forth. 🔒 GitHub's Code Security Risk Assessment being free and one-click is also worth 20 minutes of your week. I've seen teams deprioritize security scanning because setup friction is real. Removing that excuse matters, especially as agentic code generation introduces new attack surfaces that most teams aren't auditing yet. 🧠 The pattern I'm seeing: the best dev tools right now are quietly solving enterprise and compliance problems, not just developer experience ones. For those building AI features in regulated industries — what's your current approach to data retention across model providers? #FullStackDevelopment #AIEngineering #HealthcareTech #DevTools #SoftwareLeadership

I launched OpenSRE last week — an open-source AI SRE that investigates production incidents. The DMs that came in were mostly some version of: "Looks interesting, but I'm not spinning up a local stack just to try it." So I built a live demo. No Docker, no API keys, no config. demo.opensre.in has three scenarios you can trigger — a payment service throwing 500s, an auth gateway latency spike, an order queue backing up with 45k message lag. Pick one, hit investigate, and watch 4 subagents work through it across Kubernetes, logs, metrics, and traces. --- OpenSRE is open-source. Self-hosted. Your data stays in your infra. Give it a minute. You'll see exactly what it does. (Links in the comments) #SRE #DevOps #OpenSource #IncidentManagement #AIAgents #PlatformEngineering #OpenSRE