# Securing AI Agents in Production: The Complete Series

> Egress allowlists, tool allowlists, AGENTS.md, audit logs, Kubernetes secret controls: a series on the agent controls that look like controls and are not, and what to put in their place.

- Canonical URL: https://webofmike.com/agent-security/
- Author: Mike Moore (https://webofmike.com/about/)
- Published: 2026-09-16
- Last modified: 2026-09-16
- Tags: AI Agents, Security, MCP, Platform Engineering, Kubernetes
- Cite as: Mike Moore, "Securing AI Agents in Production: The Complete Series", Web of Mike (webofmike.com), 2026-09-16. https://webofmike.com/agent-security/


Almost everything in this series started the same way: a control that everybody agrees is the right control, applied to an agent, quietly not doing the thing its name implies.

The pattern is consistent enough to be a design rule. Controls built for human operators assume a session, an intent, and a bounded set of actions. An agent has none of those. It has a tool surface, a credential, and a loop — and the loop will find the edge of every boundary you drew for a person.

## The thread running through these

**Advisory is not enforcement.** `AGENTS.md` is a file the model may read. A tool name allowlist pins a string, not behavior. Neither survives contact with a model that has a reason to go around it.

**Permitted is not safe.** The hardest destination to defend is the one you are required to allow. The artifact registry has to be reachable because builds need it, and that single exception is enough to run data out and coordination back in.

**The record is written by the suspect.** If the agent can influence the transcript, the transcript is testimony, not evidence. This is the one that most surprises people, and it has a real number behind it.

**The credential outlives the control.** Kubernetes secret hygiene covers the things Kubernetes issues. The provider API key the agent actually holds is usually not one of them.

## Where to start

If you are trying to convince someone this matters, start with [which controls would have stopped the July 2026 intrusion](/rogue-agent-kubernetes-controls/) — it works backward from a real incident.

If you are already convinced and want the sharpest single finding, start with [the audit log your agent wrote](/agent-audit-log-integrity/).

If you run a platform and want to know what is already deployed without your knowledge, start with [finding the MCP servers your platform team doesn't know about](/shadow-mcp-servers/).

The related work on how an agent proves who it is — SPIFFE, token exchange, audience binding, and what MCP does and does not specify — is collected separately in [the agent identity series](/agent-identity/).