Security
At a glance
The challenge
An agent reads untrusted content, calls tools, handles sensitive data and acts on behalf of users. Each of these steps is a chance for injection, leakage or privilege escalation when security depends on the code of each application.
The path of a request
Portal
CSP with nonce, controlled links
APISIX gateway
Coraza WAF, OWASP CRS rules, limits
Cilium network
Default deny, filtered egress
Control Plane
Authentication, RBAC, rate limiting
PostgreSQL
RLS forced on every tenant table
OpenBao
Secrets and transit encryption
The controls
APISIX filters traffic with Coraza and the OWASP Core Rule Set and applies size and rate limits before a request reaches the API.
Every URL supplied by a tenant goes through an egress guard: DNS resolved at connection time against DNS rebinding, redirects never followed, private addresses and cloud metadata blocked.
The tenant of every transaction is set in the database and RLS policies filter every row, even for a connection that owns the tables.
Secrets live in OpenBao. Tools, MCP servers and connectors receive references, never the clear value in a prompt. SDKs and the CLI mask keys.
Detection tunable per tenant, wrapping of untrusted content and an allowlist of links permitted in answers.
Every incoming file is scanned by ClamAV and YARA-X before an agent processes it or it gets indexed.
SPIFFE and SPIRE give every service a verifiable identity; certificates are managed by cert-manager.
Falco and Tetragon watch container and kernel behavior; their alerts feed the SOC.
The proof
Every attack class is linked to a control, its setting, the test that proves it and the residual risk. A startup guard refuses a dangerous production configuration.
Go further
A request to Navin Enterprise AI crosses the portal, the APISIX gateway with Coraza and the OWASP CRS, Cilium policies and then the Control Plane, and no layer assumes that the previous one did its job. This guide reviews each control, from the CSP nonce to PostgreSQL RLS.
Every file sent to the AI is quarantined, scanned by ClamAV and YARA-X and then validated before Docling, OCR or RAG can read it. Fully local, fail closed, logged and highly available.
We walk through the threat model, the controls and their evidence against your own requirements.