AI Infrastructure Security

AI infrastructure introduces new attack surfaces. AI agents make autonomous decisions and call external tools. LLM endpoints are expensive — unauthorized access costs real money. Vector databases contain sensitive embeddings. MCP servers expose powerful capabilities. All of these need the same workload identity and authorization that traditional microservices require.

The AI Security Problem

Most AI infrastructure today uses shared API keys. One key for all agents accessing the LLM. One key for the vector database. No distinction between a customer support agent and a code review agent. If one key leaks, all AI capabilities are compromised.

SPIFFE for AI Agents

Each AI agent gets its own SPIFFE ID. OPA policies control which agents can access which models, tools, and databases. Every interaction is authenticated and auditable.

# AI Agent SPIFFE IDs:
spiffe://ai.company.org/agent/customer-support/v2
spiffe://ai.company.org/agent/code-review/v1
spiffe://ai.company.org/pipeline/training/job-abc

# OPA Policy: customer-support can query LLM but not train models
allow {
  input.source == "spiffe://ai.company.org/agent/customer-support/v2"
  input.target == "spiffe://ai.company.org/service/llm-proxy"
  input.method == "POST"
  input.path == "/v1/chat/completions"
}

Securing MCP Servers

Model Context Protocol (MCP) servers give AI agents access to tools — file systems, databases, APIs. Without identity, any process can call MCP tools. With SPIFFE, only verified agents can access specific MCP servers based on their identity and OPA policies.

Vector Database Access Control

Vector databases store embeddings of sensitive documents. mTLS with SPIFFE ensures only authorized services can query or write to the vector database. OPA policies can further restrict: read-only for query agents, write access only for training pipelines.