Module 15: AI Infrastructure Security

Learning Objectives

• Understand AI infrastructure threat landscape
• Implement workload identity for AI agents
• Secure MCP servers and vector databases with mTLS
• Design identity-aware AI access control policies

Why This Matters

AI infrastructure is the next frontier for security engineering. As AI agents become more autonomous, the blast radius of a compromised agent grows. Engineers who understand workload identity for AI systems today are positioning themselves for the most in-demand security roles of tomorrow.

Lesson Content

AI infrastructure introduces new attack surfaces. AI agents make autonomous decisions and call external tools. LLM endpoints are expensive — unauthorized access costs real money. Vector databases contain sensitive embeddings. MCP servers expose powerful capabilities. All of these need the same workload identity and authorization that traditional microservices require.

The AI Security Problem

Most AI infrastructure today uses shared API keys. One key for all agents accessing the LLM. One key for the vector database. No distinction between a customer support agent and a code review agent. If one key leaks, all AI capabilities are compromised.

SPIFFE for AI Agents

Each AI agent gets its own SPIFFE ID. OPA policies control which agents can access which models, tools, and databases. Every interaction is authenticated and auditable.

# AI Agent SPIFFE IDs:
spiffe://ai.company.org/agent/customer-support/v2
spiffe://ai.company.org/agent/code-review/v1
spiffe://ai.company.org/pipeline/training/job-abc

# OPA Policy: customer-support can query LLM but not train models
allow {
  input.source == "spiffe://ai.company.org/agent/customer-support/v2"
  input.target == "spiffe://ai.company.org/service/llm-proxy"
  input.method == "POST"
  input.path == "/v1/chat/completions"
}

Securing MCP Servers

Model Context Protocol (MCP) servers give AI agents access to tools — file systems, databases, APIs. Without identity, any process can call MCP tools. With SPIFFE, only verified agents can access specific MCP servers based on their identity and OPA policies.

Vector Database Access Control

Vector databases store embeddings of sensitive documents. mTLS with SPIFFE ensures only authorized services can query or write to the vector database. OPA policies can further restrict: read-only for query agents, write access only for training pipelines.

Real-World Use Cases

• AI agent identity for autonomous systems
• Securing MCP server access with workload identity
• Vector database access control with mTLS
• LLM endpoint cost protection via identity-based rate limiting

Production Story

A company running 20 AI agents with a single shared API key discovered that a compromised agent was making 10,000 LLM calls per hour — costing $500/day. After deploying SPIFFE with per-agent identity and OPA rate limiting, the rogue agent was blocked within seconds.

Career Relevance

AI infrastructure security is an emerging discipline with very few practitioners. Engineers who understand both workload identity and AI systems are uniquely positioned for the next wave of platform engineering roles.

Key Terms

MCP

Model Context Protocol — standard for AI agents to access tools and data

Vector Database

Database optimized for storing and searching high-dimensional embeddings

LLM

Large Language Model — AI model for text generation and reasoning

AI Agent

Autonomous AI system that makes decisions and takes actions

Hands-On Labs

1. Secure AI Agent Communication

   Deploy AI agents with SPIFFE identities and OPA policies.

   35 min - Advanced

   • Deploy simulated AI agent with SPIFFE identity
   • Deploy LLM mock service with SPIFFE identity
   • Configure mTLS between agent and LLM
   • Add OPA policy: only authorized agents can invoke the LLM

   View lab files on GitHub

2. Identity-Aware AI API Access

   Restrict AI service access based on agent identity.

   30 min - Advanced

   • Register multiple AI agents with different SPIFFE IDs
   • Create OPA policies: support agent = read-only, training pipeline = full access
   • Test enforcement with different agent identities
   • Audit access logs with verified SPIFFE IDs

   View lab files on GitHub

Key Takeaways

• AI agents are workloads — they need cryptographic identity, not shared API keys
• SPIFFE secures agent-to-LLM, agent-to-tool, and agent-to-database communication
• MCP servers should verify agent identity before granting tool access
• OPA policies enable fine-grained AI access control (read vs write, model access by agent role)
• The zero trust skills from earlier modules apply directly to AI infrastructure