# Platform Engineering > Posts on Web of Mike tagged "Platform Engineering". - Canonical URL: https://webofmike.com/tags/platform-engineering/ - Author: Mike Moore (https://webofmike.com/about/) - Curated index for LLMs: https://webofmike.com/llms.txt - Full content of every post: https://webofmike.com/llms-full.txt - Every page is also served as raw markdown at index.md ## Pages - [Securing AI Agents in Production: The Complete Series](https://webofmike.com/agent-security/): Egress allowlists, tool allowlists, AGENTS.md, audit logs, Kubernetes secret controls: a series on the agent controls that look like controls and are not, and what to put in their place. (2026-09-16) - markdown: https://webofmike.com/agent-security/index.md - [Finding the MCP Servers Your Platform Team Doesn't Know About](https://webofmike.com/shadow-mcp-servers/): A read-only scanner that fingerprints MCP on both transports and sorts every endpoint into open, protected, or out of spec. Four postures, one compose file. (2026-09-16) - markdown: https://webofmike.com/shadow-mcp-servers/index.md - [Agent Identity on Kubernetes: The Complete Series](https://webofmike.com/agent-identity/): How an AI agent proves who it is: workload identity federation, SPIFFE SVIDs, OAuth token exchange, RFC 8707 audience binding, and what the MCP spec does and does not cover yet. (2026-09-16) - markdown: https://webofmike.com/agent-identity/index.md - [Conway's Law Is Coming for Your MCP Servers](https://webofmike.com/conways-law-mcp-servers/): Putting every MCP tool behind one federated endpoint rebuilds the ESB and makes agents worse. Why MCP federation should follow business domain boundaries. (2026-09-15) - markdown: https://webofmike.com/conways-law-mcp-servers/index.md - [Your Agent's LLM Key Survives Every Kubernetes Secret Control](https://webofmike.com/agent-llm-key-kubernetes-controls/): RBAC, restricted Pod Security, and automountServiceAccountToken all on, and one file read still hands over an agent's LLM API key. Tested on a live cluster. (2026-09-13) - markdown: https://webofmike.com/agent-llm-key-kubernetes-controls/index.md - [kagent 0.10 Ships Audience-Bound Agent Tokens, Off By Default](https://webofmike.com/kagent-audience-bound-agent-tokens/): kagent v0.10.0 GA can bind an agent's exchanged token to one backend using RFC 8707 resource indicators. Two environment variables, both empty by default. (2026-09-08) - markdown: https://webofmike.com/kagent-audience-bound-agent-tokens/index.md - [agentgateway v1.5.0: Per-Key LLM Budgets That Return 429](https://webofmike.com/agentgateway-per-key-llm-budgets/): agentgateway v1.5.0 caps LLM spend per API key and restricts which models a key may call. A local demo that proves the 429, the price math, and the gotchas. (2026-09-07) - markdown: https://webofmike.com/agentgateway-per-key-llm-budgets/index.md - [Egress Control for AI Agents: Four Bypasses, One Fix](https://webofmike.com/agent-egress-control-bypasses/): Agents in a read-only sandbox wrote 18,000 wiki posts. Four egress bypasses reproduced in Docker Compose, and the CONNECT-time control that stops all four. (2026-09-06) - markdown: https://webofmike.com/agent-egress-control-bypasses/index.md - [MCP Agent Identity: One Spec Shipped, Three Still Open](https://webofmike.com/mcp-agent-identity-gap/): The MCP roadmap names four agent identity workstreams. One has shipped, and it authenticates the employee behind the agent rather than the agent itself. (2026-09-05) - markdown: https://webofmike.com/mcp-agent-identity-gap/index.md - [Your AGENTS.md Is Not a Security Control](https://webofmike.com/agents-md-not-a-security-control/): A prompt-injected agent destroyed every record with an AGENTS.md forbidding it and an approval classifier watching. An MCP allowlist at the gateway stopped it. (2026-09-04) - markdown: https://webofmike.com/agents-md-not-a-security-control/index.md - [Which Controls Would Have Stopped the July 2026 Agent Intrusion?](https://webofmike.com/rogue-agent-kubernetes-controls/): An autonomous agent went from sandbox escape to Kubernetes cluster-admin in under 13 hours. A stage-by-stage map of which controls would have broken the chain. (2026-09-03) - markdown: https://webofmike.com/rogue-agent-kubernetes-controls/index.md - [SPIFFE Workload Identity for AI Agents, End to End](https://webofmike.com/spiffe-identity-for-ai-agents/): An agentgateway v1.5.0 demo where the agent, the gateway, and the model upstream all authenticate with SPIFFE SVIDs and no certificate file exists anywhere. (2026-09-02) - markdown: https://webofmike.com/spiffe-identity-for-ai-agents/index.md - [Your AI Agent Should Not Hold the LLM API Key](https://webofmike.com/secretless-ai-agents/): The LiteLLM PyPI compromise stole exactly where LLM API keys live. A working agentgateway demo: agents that call LLMs holding no provider credential at all. (2026-09-01) - markdown: https://webofmike.com/secretless-ai-agents/index.md - [Substrate Scope: a Live Visualizer for Agent Substrate](https://webofmike.com/substrate-scope/): Substrate Scope is an open source live visualizer for Agent Substrate: worker bays, restore queues, snapshot storage, telemetry, and per-agent activity. (2026-08-28) - markdown: https://webofmike.com/substrate-scope/index.md - [Multi-Tenant MCP Federation with agentgateway](https://webofmike.com/multi-tenant-mcp-federation/): Six MCP servers federated into three business domains on agentgateway, with per-customer tool entitlements, quotas, and chargeback. No auth code in the servers. (2026-08-28) - markdown: https://webofmike.com/multi-tenant-mcp-federation/index.md - [Thousands of AI Agents on Tens of Pods: kagent Agent Substrate](https://webofmike.com/kagent-agent-substrate/): kagent Agent Substrate is built to run thousands of AI agents on tens of pods. I stood it up on kind: snapshot restores, autoscaling, and every gotcha I hit. (2026-08-27) - markdown: https://webofmike.com/kagent-agent-substrate/index.md - [Revenant: A Gateway-Native, Always-On Agent Runtime](https://webofmike.com/revenant-agent-runtime/): Revenant is an always-on agent runtime in Rust where an AI gateway owns every key, budget, and failover, and a hard liveness rule means no turn goes silent. (2026-08-27) - markdown: https://webofmike.com/revenant-agent-runtime/index.md - [Governing an LLM-Driven Robot Fleet with agentgateway](https://webofmike.com/llm-robot-fleet-agentgateway/): An LLM-driven robot fleet where every inference, MCP tool call, and agent message flows through agentgateway: safety, failover, and speed, all open source. (2026-08-27) - markdown: https://webofmike.com/llm-robot-fleet-agentgateway/index.md - [Capping LLM Spend at the AI Gateway: Budgets and Virtual Keys](https://webofmike.com/llm-cost-controls-ai-gateway/): Token counts are not costs. I wired a price catalog, virtual keys, and budgets into agentgateway so LLM spend gets attributed, priced, and capped with a 429. (2026-08-27) - markdown: https://webofmike.com/llm-cost-controls-ai-gateway/index.md - [Beyond the Algorithm: Why Industry Veterans are Still Vital in the Age of AI Consulting](https://webofmike.com/beyond-the-algorithm/): The irreplaceable value of industry veterans in enterprise architecture and technology solutions in the age of AI. (2024-10-29) - markdown: https://webofmike.com/beyond-the-algorithm/index.md - [Revisiting Observability: A Deep Dive Into the State of Monitoring, Costs, and Data Ownership](https://webofmike.com/revisiting-observability/): A deep dive into the current state of observability, covering instrumentation challenges, cost surprises, and data ownership. (2024-05-02) - markdown: https://webofmike.com/revisiting-observability/index.md - [Mastering Kubernetes: Key Metrics for Cluster Monitoring](https://webofmike.com/mastering-kubernetes-key-metrics/): A deep dive into the essential metrics for effective Kubernetes cluster monitoring. (2024-04-14) - markdown: https://webofmike.com/mastering-kubernetes-key-metrics/index.md - [Maximizing DevOps Efficiency: Best Practices, KPIs, and Realtime Feedback](https://webofmike.com/maximizing-devops-efficiency/): How to adopt best practices for DevOps teams using automation, version control, and developer portals for real-time feedback. (2023-03-08) - markdown: https://webofmike.com/maximizing-devops-efficiency/index.md - [Maximizing Your Developer Efficiency: Scaffolding for Faster Time to Market](https://webofmike.com/maximizing-developer-efficiency-scaffolding/): How scaffolding tools help developers work more efficiently and deliver software faster. (2023-02-10) - markdown: https://webofmike.com/maximizing-developer-efficiency-scaffolding/index.md - [Maximizing Developer Onboarding for Improved Retention and Growth: A Comprehensive Guide](https://webofmike.com/maximizing-developer-onboarding/): A comprehensive guide to structuring developer onboarding for improved retention and productivity. (2023-02-06) - markdown: https://webofmike.com/maximizing-developer-onboarding/index.md - [Mastering the Art of Platform Engineering: The Latest Secret to Digital Transformation](https://webofmike.com/platform-engineering/): How platform engineering is the future of technology operations and a key driver of organizational success. (2023-02-02) - markdown: https://webofmike.com/platform-engineering/index.md - [Maximize your ROI with a Developer Portal: How Improving DevOps, DevX, and SRE Can Drive Visibility, Productivity, and Profitability](https://webofmike.com/developer-portal/): How a well-implemented developer portal can impact DevOps processes, developer experience, and overall efficiency. (2023-01-31) - markdown: https://webofmike.com/developer-portal/index.md