Three moving parts. That is the whole thing.
No agent framework to adopt, no library to import, nothing for an application team to remember.
You label a namespace
One line of YAML on the namespace your AI workloads run in. That is the entire integration, and it is done by the platform team, once.
Every pod gets a sidecar
A Kubernetes admission webhook adds it as pods are created. Teams do not opt in, do not change code, and cannot forget. Pods deployed next year are covered too.
Every call is decided
The agent asks the sidecar, not the model or the database. Allowed calls go through and are signed. Refused calls never leave the pod.
Every one of these used valid credentials.
Not stolen keys. Not broken TLS. Legitimate identities doing things nobody had decided they were allowed to do. Authentication answered the question it was asked, and it was the wrong question.
Hugging Face Spaces
Roughly 17,600 actions performed with valid Kubernetes certificates. The identity was genuine throughout. Nothing in the path was deciding whether those actions were permitted.
Microsoft Copilot, EchoLeak
Zero-click exfiltration of tenant data through an AI assistant acting entirely within its granted permissions.
Replit agent
An AI agent deleted a production database. It held credentials that allowed it, and no gate stood between the intent and the DROP.
LiteLLM
A vulnerability in a widely deployed AI gateway exposed roughly 2,500 organisations. The gateway authenticated. It did not authorise.
Sysdig container escape
Workload breakout in which the escaping process carried a legitimate service identity out of its blast radius with it.
One mesh. Every call an agent can make.
An LLM gateway protects one hop. An agent that can reach a model can usually also reach a database, an internal API, a queue and a filesystem, and those are the hops that lose you money. AgentPass Mesh sits in front of all of them and denies by default.
LLM gate
Trust level against what the model requires, plus a digest of the weights that answer to its name.
Database gate
Statement, table and column, not just the connection. PII reads and financial writes are separate decisions.
API gate
Method, route and scope. An agent that may read an account cannot move money from it.
File and queue gate
Path and operation, so exfiltration is a policy decision rather than an afterthought.
How much do you actually know about the caller?
A trust level is not a permission. It says how strongly the identity was established, and the policy decides what that buys. Two agents with the same permissions and different levels are not the same risk, and no role based system can express that.
Pick a caller. Pick a call. Watch it decide.
The same ordering that runs in the sidecar, in the page.
Your agents hold zero credentials.
The hardest question in agent architecture is who holds the database password. If the answer is the agent, then prompt injection is credential theft, and every incident above becomes reachable from a text box.
Injection stops being theft
An agent talked into asking for something it should not have is refused at the gate. There is no long-lived secret in its process to exfiltrate.
Leases, not passwords
Credentials live for seconds and are scoped to the statement that was authorised, so a leak has a short and narrow blast radius.
Rotation is free
Nothing has a password baked into it, so rotating one is a Vault policy change rather than a redeployment across every agent you run.
SPIFFE gives your agent identity. It still needs enforcement.
An SVID proves which workload is calling. It has no opinion on whether the call should happen. AgentPass Mesh accepts the SVIDs you already issue and adds the decision, controlling every agent with zero friction and at scale. Nothing to rip out, no application to rewrite.
Answers who
- Issues and rotates cryptographic identity
- Removes long-lived static secrets
- Attests the workload at issuance
- Tells you a call came from a known workload
- Has no opinion on whether the call is permitted
- Produces no record a third party can verify
- Cannot stop a substituted model being served
Answers whether
- Accepts SPIRE issued SVIDs unchanged
- Maps SPIFFE IDs to trust levels by policy
- Refuses before the call reaches the target
- Decides per statement, per route, per model
- Attests the weights that answer, not just the name
- Signs a hash chained record of every decision
- Kills an agent or a model everywhere at once
{
"spiffe://corp.example/ns/prod/*": 3,
"spiffe://corp.example/ns/prod/payments/*": 4,
"spiffe://corp.example/ns/dev/*": 1
}
# longest prefix wins, so a specific rule is never shadowed by a general one
# an unmapped identity gets no level and is refused, never defaulted
Nothing to rip out
SPIRE keeps issuing. Your attestation, your rotation, your trust domain. AgentPass Mesh is added in front, not swapped in.
Valid X509-SVIDs both ways
Certificates AgentPass Mesh issues carry a spiffe:// URI SAN and validate as SVIDs, so they drop into SPIFFE tooling unchanged.
Already integrated with EJBCA
Issuance goes through a CSR, so any CA that signs a CSR can issue the same profile. Your enterprise CA, a public CA, or ours. No lock-in to our issuer, and nothing about the profile changes.
What the agent may do.
A trust level is not a permission. It states how strongly an identity was established, and the policy says what that buys. The decision, the level it was taken at and the weights that answered are all bound into a receipt, so what an agent was permitted to do is checkable long after it did it.
- agent
- svc-payments · admitted at L4
- model
- clinical-notes · required L4
- weights
- prompt
- output
- signature
- chained to
The output is bound to the decision
A signature over an answer proves a producer produced it. This binds the answer to the requester, the trust level it was admitted at, and the digest of the weights that generated it. Entitlement becomes checkable after the fact, not just authenticity.
Per message, not per session
Signing is at the message, following the ladder in our own transport draft. A session token says an agent logged in once. A per-message signature says this exact call, with this exact content, was made by this exact identity.
Nobody has to remember
The sidecar signs because it is in the path. There is no library to import and no call to make, so coverage does not depend on whether a team read the internal wiki.
Logs you wrote are not evidence.
In a dispute the reader is a regulator, an insurer, an auditor or a court, and every one of them assumes the party holding the log has an interest in what it says. AgentPass Mesh produces a record that does not require trusting us, or you.
Verifiable by someone who was not there
Every decision, including the refusals, hash chained and signed. A receipt verifies offline with nothing but a public key: no network, no service, no shared secret. The chain is rebuilt on restart, because one that resets to genesis after every deploy proves nothing about what happened before it.
A kill switch that leaves the building
One signed object, direction taken from the subject. Kill an agent and it is refused everywhere. Kill a model and every agent is refused at it, whatever its level. Published as a signed, sequence numbered feed, so deployments that have never met each other honour it within seconds and a stale snapshot cannot be replayed to un-revoke anything.
One helm install. Every AI pod enforced.
A mutating admission webhook injects the sidecar into every pod carrying the label. Nobody rewrites an application, nobody imports a library, and a team that forgets is covered anyway, which is the only kind of control that survives contact with an organisation.
# install cert-manager (one time) $ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml # install agentmesh $ helm install agentmesh oci://ghcr.io/razashariff/agentmesh \ --set certManager.enabled=true # enforce a namespace $ kubectl label namespace prod agentmesh.io/inject=enabled ok admission webhook registered ok sidecar injected into 34 pods ok certificates issued, 34 workloads ok policy loaded, default deny # an application nobody changed, refused anyway [DENY] ns/prod/reporting -> postgres: UPDATE on ledger_entries requires L4, identity is L2. Statement never sent.
Nothing to integrate
No SDK, no client library, no code change. The sidecar is in the path because the platform put it there.
Airgapped and sovereign
Self-hosted issuance, self-hosted kill switch, no outbound dependency. Runs in environments that will never call a SaaS.
Or standalone
Outside Kubernetes it is a single process in front of your runtime. pip install agentmesh and change one base URL.
The evidence a regulator actually asks for.
Each of these regimes requires records that are attributable, tamper evident and reviewable by someone outside the organisation. None of them accepts an application log as sufficient.
Article 12 record keeping
High-risk systems must log automatically across their lifetime, with traceability of the events that produced an outcome. AgentPass Mesh records the decision, the identity, the target and the digest of the model that answered, signed and chained.
FDA 21 CFR Part 11
Audit trails must be computer generated, time stamped and independently reviewable, recording both the action and the operator. The evidence ledger was built to that shape before it was ever pointed at AI.
IEC 62443
Certificate-based identity is required at the higher security levels, but the standard has no agent enforcement model. AgentPass Mesh supplies the enforcement, using the same certificate profile.
NERC CIP
Access to critical cyber assets must be authorised, logged and revocable at speed. Bilateral revocation over a signed feed answers the revocation requirement across sites, not just within one.
What actually stops happening.
Each of these is a real failure mode with a real control against it, not a capability looking for a use. Where a control is partial we say so.
Injection stops being credential theft
An agent talked into asking for something it should not have is still just an agent making a request, and the request is refused at the gate.
A swapped model is refused, not discovered later
A model served under a familiar name can be replaced by a quantised copy, a fine tune, or a poisoned checkpoint, and every ordinary signature still verifies because nothing ever looked at the bytes.
Connection level access becomes call level
A connection string is one decision, taken at startup, by somebody who has left the room. After that the agent can run anything the account allows.
Agents nobody registered are covered anyway
Every SDK rollout lands near sixty percent, and the teams you miss are the ones that shipped fastest. That is where the incident happens.
No trust level can drop a table
An agent with schema rights is one confused reasoning step away from an unrecoverable afternoon.
One signed object stops it everywhere
Finding out a model is poisoned is only half the problem. Stopping it in forty clusters you do not personally operate is the other half.
Rotation stops being a project
Secrets in environment variables end up in heap dumps, log lines, crash reports and images, and rotating them means redeploying everything.
The argument ends with a signature
After the fact, everyone reads the same application log and reaches a different conclusion, and the party holding it wrote it.
Open standards, published first.
Not a proprietary scheme with a specification written afterwards. The protocol was published at the IETF in March 2026, the arc is registered with IANA, and the implementation practises the drafts it cites.
Thirteen drafts
AgentPass Mesh implements the whole family, not one specification: identity, transport, audit, inference and the vertical profiles. Published from March 2026, before the field had a name.
draft-sharif-mcps-secure-mcp
draft-sharif-x509-agent-identity-profile
draft-sharif-agent-audit-trail
draft-sharif-attp
draft-sharif-apki-agent-pki
draft-sharif-attp-industrial-control-systems
draft-sharif-ai-model-lifecycle-attestation
and six more
PEN 66339
Assigned to CyberSecAI Ltd, 22 July 2026. Certificate policies, extensions, extended key usage, attribute types, protocol identifiers and jurisdictional bindings under one registered arc, so a relying party anywhere can resolve what an extension means.
31 filings
Covering trust scoring, identity certificates, per-message signing, inference enforcement and bilateral revocation, plus vertical filings for industrial control, healthcare, smart grid and autonomous vehicles. Two PCT applications carry the core internationally.
Free where it should be free.
Limits are on scale and on what an enterprise needs anyway, never on the security properties. Enforcement, attestation, the signed ledger and the kill switch work at every tier, because a control that is degraded until you pay is a liability rather than a product.
For anyone running their own models.
- Unlimited agents
- Full enforcement and default deny
- Weights attestation and pinning
- Signed evidence ledger
- Local certificate issuance
Shared state across instances.
- Everything in free
- Multi instance shared state
- Unlimited ledger retention
- Kill switch subscriber
- Vault integration
Regulated, sovereign, airgapped.
- Kill switch publisher
- HSM backed issuance
- Your CA, or ours
- Self hosted and airgapped
- Compliance evidence packs