When Agents Go Rogue: Building a Zero-Trust Agent Mesh

One line summary

AI agents behave like distributed systems but lack consistent runtime network controls, creating a security gap in which prompt injection can lead to data exfiltration. This session explores building an “Agent Mesh” to intercept, observe, and govern outbound agent traffic without modifying the underlying application code.

What problem are you addressing?

Once autonomous execution begins, AI agents can create unpredictable runtime data paths. An agent might ingest malicious instructions from untrusted content, chain otherwise safe actions into a dangerous sequence, or silently exfiltrate sensitive data to an unauthorized endpoint.

The core engineering challenge is containing this behavior at the network layer. Platform teams need a unified way to intercept and govern agent egress without hardcoding security checks into every individual agent or tool.

Who is the intended audience?

Platform engineers, security engineers, SRE and DevOps professionals, MLOps engineers, and developers building agentic or MCP-style workflows.

Level

Intermediate to advanced.

List one or two practical takeaways.

1. How to treat autonomous AI agents as untrusted workloads and contain unsafe behavior using egress policies, workload identity, and execution tracing.

2. A reference architecture for implementing zero-trust network controls through an Agent Mesh to reduce the risk of data exfiltration.

What will you share?

I will share:

1. The threat model for indirect prompt injection and agent-driven data exfiltration.
2. YAML-based policies for approved destinations, sensitive-data indicators, and rate limits.
3. Policy decisions, audit events, and execution tracing.
4. A live before-and-after demonstration:
   In the demo, an agent will process untrusted content, access simulated sensitive data, and attempt to send it to an external endpoint. I will first run the workflow without enforcement.I will then enable Agent Mesh and show the request being intercepted, denied, and traced without changing the agent’s code or prompts.

What is your experience with this problem?

Experiment or prototype
Research and investigation

Agent Mesh is an open-source, experimental implementation developed to explore runtime policy enforcement and observability for autonomous AI workloads.

What approaches failed, disappointed, or created unexpected problems?

Relying solely on application-level IAM and prompt engineering did not provide sufficient security guarantees. IAM was insufficient because it primarily governed access to resources but did not control the unpredictable flow of data during agent execution.

Modifying every agent or tool integration to implement custom egress checks also created operational overhead that was difficult to scale and maintain across different agent frameworks. Application-level checks could also be applied inconsistently or bypassed when autonomous workflows invoked tools through unexpected execution paths.

What will you do differently today?

Instead of trusting an agent’s internal reasoning or relying only on application-level controls, we treat the agent as an untrusted workload.

By moving enforcement to an infrastructure layer, Agent Mesh can intercept outbound traffic independently of the agent’s prompts or application code and apply zero-trust principles during runtime. This approach complements, rather than replaces, IAM, least-privilege access, secure tool design, and application-level authorization.

What trade-offs did you consider?

Network layer versus application layer: We chose infrastructure-level enforcement to provide consistent controls across different agent frameworks, knowing that the network layer has less semantic and application-level context.
Performance versus security: Evaluating API and tool requests against destination and sensitive-data policies introduces latency. We had to balance this performance overhead against the need for runtime inspection and enforcement.
Availability versus containment: Fail-closed enforcement provides stronger containment but may disrupt legitimate workflows when policy infrastructure is unavailable. Fail-open enforcement improves availability but increases security risk.

How can this help other practitioners?

1. A design approach: Applying service-mesh and zero-trust patterns to autonomous AI workloads.
2. A way to evaluate competing approaches: Understanding what network-level controls can and cannot protect against in agentic systems.
3. A set of operational practices: Implementing destination policies, workload identity, audit logging, and distributed tracing for agent egress.

Current state:

Experimental/prototype

#agents #security #zerotrust #platformengineering #observability #governance