What We Learned Giving an AI Agent Read Access to Our Whole Kubernetes Fleet
Park Plaza Victoria, London · 8 September 2026 · Amine Raji, Molntek
Read-only is the word that gets agent deployments approved. It tells you what an agent cannot write, and nothing about what it can reach, who it is, or what it costs when it goes sideways. The talk walks four failure classes that need no write at all (confidentiality, attribution, the confused deputy and availability) and the containment ladder that answers them: scoped capability, per-agent identity, egress as a capability, and human gates on writes. Nothing on that ladder is AI security: it is cloud security applied to a new kind of workload, plus one control I have not found anyone shipping, redaction between tool output and the model.
Material from the talk
Four things to do on Monday
If you take nothing else from the session, take these.
- 1
Count how many of your agent's tools can write. Approving a tool list is not the same as counting it.
- 2
Find out what identity it runs as. A shared service account is the usual starting point, and the hardest thing to unwind later.
- 3
Check whether it can reach the internet. Most agents can, by default.
- 4
Find the write path, and who signs for it. If you cannot name the human, you do not have a gate.
Score your own agents, free
The Agent Security Scorecard asks the same questions I use in a paid review and gives you a gap list in the browser. No login, no email, nothing to install. It is the fastest way to find out whether what you just heard applies to you.
Open the Scorecard →References
- Companion notes: the argument, the ladder and the per-class posts
- The Containment Ladder: the full write-up
- What 'Read-Only' Actually Reaches (class 1)
- Agent Identity: What the Standards Fix, and What They Leave Open (class 2)
- Finding the Confused Deputy in Your Own Agent (class 3)
- The Missing Control: a design proposal for tool-output redaction
- Simon Willison: The lethal trifecta
- OWASP Top 10 for Agentic Applications 2026
If you want this run against your own system
That is what I do for a living. The two-day AI Security Sprint is €3,500 and answers one question properly: where the real exposure sits in the system you are least sure about. Prices for everything else are on the services page, and I would rather tell you on a call that you do not need me than sell you something you do not.