Микросегментация и ядро ОС станут новым стандартом безопасности для автономных ИИ-агентов

Using APIs to enforce policy at the boundary between interacting systems is no longer enough. Application programming interfaces have been successful because they define the limits of permissible exchange, including who may take what action, when, and under what circumstances. Those limitations create a framework for understanding the behavior of distributed systems. And they make it possible to enforce policy at the boundary between interacting systems. What constrains distributed systems isn’t access, but execution. With autonomous data movement and action occurring at machine speeds, where processes unfold sequentially over time rather than as a singular event, APIs no longer provide a sufficient means of enforcing boundaries. The problem is no longer whether a request is valid. It is whether a sequence of actions remains safe. For agentic systems, there needs to be runtime guardrails around what they can read, write, and execute. Microsegmentation, enforced through network and kernel-level policies, defines those guardrails. APIs made systems predictable APIs were successful because they defined very specific interfaces. Clients could only ask for what the API had explicitly defined and only in ways the API defined. By limiting the ways clients could communicate with servers, APIs minimized the amount of unanticipated behavior. The behavior space was small enough to reason about. APIs also decoupled identity from infrastructure. Systems communicated through stable contracts instead of raw network primitives. Most importantly, APIs embedded policy into the interaction model. Authentication, authorization, and validation happened at the moment of request. Only authorized actions could occur within defined parameters. APIs worked because they reduced uncertainty to something controllable. AI is beyond the reach of API contracts AI models have exceeded the fixed boundaries defined in APIs. Traditional APIs were developed within the context of “fixed logic,” where the input into the application would result in one, and only one, predetermined output. Therefore, as long as you could protect the API gateway (interface), then the overall system was secure. With agentic AI, this paradigm of fixed logic has been replaced by a paradigm of probabilistic decision-making. An agent does not follow a pre-written or hard-coded script. Instead, it reads a goal and determines the most likely sequence of actions needed to achieve that goal through dynamic reasoning. The contract is now hidden inside the emergent behaviors of the model, rather than being explicitly spelled out in the API documentation. While the shift toward ephemeral workloads and Kubernetes has already pushed infrastructure beyond the reach of perimeter security, agentic AI introduces an even deeper layer of complexity: unpredictability. If you can’t predict an agent’s next move, then you also can’t use approval ahead of time at the API gateway. Additionally, detection-based tools like logging and alerting won’t help with this problem either, because they provide insight only after the agent’s decision and execution. Run time is the control plane All activity in a system ultimately ends up as kernel events. Processes begin executing. Files are being read and written. Network connections are being opened and closed. Therefore the kernel represents the most accurate location for both observing and enforcing actions. By placing enforcement mechanisms in the kernel, you change the paradigm. Using eBPF allows developers to attach kernel-level hooks into events and thus capture detailed information about process-, file-, and network-level activity in real time. It offers a common view of execution with minimal added latency. Building upon this foundational capability, platforms like Cilium and Tetragon expand enforcement beyond the kernel. Cilium enforces identity-aware policy at the networking layer, assuring that communications between workloads follow pre-established rules regardless of which physical or abstract nodes those workloads reside on. Tetragon correlates file- and process-level activity, enabling the assessment and termination of sequences of behavior prior to their completion. Thus microsegmentation is evolving past simply segmenting networks into zones based on access rights. Microsegmentation now refers to segmenting behavior based on allowable actions. Policies define what a workload can read, write, execute, and connect to. All of these restrictions are enforced in real time at the instant an action is taken. In regards to agentic systems, microsegmentation serves as a new form of agreement or contract between autonomous entities and their intended environment. It constrains agentic systems’ ability to autonomously act while still enabling them to contribute to complex workflows. Control without interfaces Over time APIs were able to establish boundaries within which distributed systems could operate predictably and securely enough to support large-scale adoption. A similar evolution is currently taking place with regard to agentic AI. However, agentic AI operates at an entirely different scale than early web services. While APIs functioned across a relatively finite set of interactions (e.g., client requests), agentic AI is increasingly functioning across ever-expanding sets of behaviors (i.e., autonomous decision-making). Thus while the need for constraint remains constant, the enforcement point must shift. Microsegmentation along with kernel-level policy enforcement becomes that enforcement point. It provides guardrails at run time where actual behavior takes place. It enables monitoring, evaluation and enforcement in real time against agentic systems’ actions and decisions. As AI systems mature from being passive tools toward autonomous agents operating independently of direct human oversight, this model will be essential to providing safety guarantees, predictability, and governance capabilities by focusing on the final frontier of security: execution. — New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to [email protected].