Grab Builds Secure Agentic AI Workload Platform
Grab's cybersecurity and platform engineering teams built Palana, a Kubernetes-native secure execution platform for running autonomous AI agents safely. Unlike deterministic software, model-driven agents pose unique risks including prompt injection, logic hijacking, and hallucinations. Palana addresses these through isolated Kubernetes namespaces with strict RBAC, proxy-mediated secrets management backed by HashiCorp Vault (so raw credentials never reach agent containers), and Envoy-based egress routing with Open Policy Agent rules for real-time traffic inspection and audit trails. Out-of-process control planes handle kill switches and idle shutdowns since compromised agents cannot be trusted to self-terminate. Each agent is modeled as a Kubernetes custom resource managed by a custom operator, enabling platform teams to manage hundreds of concurrent agent workloads using standard infrastructure-as-code practices.