Zero trust identity and access for AI agents

Requests authorized one by one against CEL rules in the HTTP, LLM and Kubernetes modes

• HTTP: the HTTP Service billing is configured as follows.
• kind: Service
• metadata:
• name: billing
• spec:
• mode: HTTP
• config:
• authorization:
• inlinePolicies:
• - spec:
• rules:
• - effect: ALLOW
• condition:
• all:
• of:
• - match: '"finance" in ctx.user.spec.groups'
• - match: ctx.request.http.method == "GET"
• - match: ctx.request.http.path.startsWith("/invoices")
• jane, a member of the finance Group, runs curl -i billing/invoices/42 and gets HTTP/1.1 200 OK Content-Type: application/json {"id":42,"status":"paid","total":1290}. The access log records ALLOWED GET /invoices/42 with POLICY_MATCH.
• jane, a member of the finance Group, runs curl -i -X DELETE billing/invoices/42 and gets HTTP/1.1 403 Forbidden X-Octelium-Unauthorized: true Content-Length: 0. The access log records DENIED DELETE /invoices/42 with NO_POLICY_MATCH.
• LLM: the LLM Service openai is configured as follows.
• kind: Service
• metadata:
• name: openai
• spec:
• mode: LLM
• config:
• authorization:
• inlinePolicies:
• - spec:
• rules:
• - effect: ALLOW
• condition:
• any:
• of:
• - match: '"ai-admins" in ctx.user.spec.groups'
• - all:
• of:
• - match: '"ai-agents" in ctx.user.spec.groups'
• - match: ctx.request.llm.operation == "GENERATE"
• - match: ctx.request.llm.model == "gpt-5-mini"
• support-bot, a member of the ai-agents Group, runs curl openai/v1/responses --json '{"model":"gpt-5-mini","input":"Hello"}' and gets { "id": "resp_68e8e1f0c4d0", "object": "response", "created_at": 1791628935, "status": "completed", "model": "gpt-5-mini-2025-08-07",. The access log records ALLOWED RESPONSES gpt-5-mini with POLICY_MATCH.
• support-bot, a member of the ai-agents Group, runs curl openai/v1/responses --json '{"model":"gpt-5","input":"Hello"}' and gets {"error":{"message":"Octelium: unauthorized request","type":"permission_error","param":null,"code":"octelium_unauthorized"}}. The access log records DENIED RESPONSES gpt-5 with NO_POLICY_MATCH.
• Kubernetes: the KUBERNETES Service k8s-prod is configured as follows.
• kind: Service
• metadata:
• name: k8s-prod
• spec:
• mode: KUBERNETES
• config:
• authorization:
• inlinePolicies:
• - spec:
• rules:
• - effect: ALLOW
• condition:
• all:
• of:
• - match: '"sre-agents" in ctx.user.spec.groups'
• - match: ctx.request.kubernetes.verb in ["get", "list"]
• - match: ctx.request.kubernetes.namespace == "production"
• - not: ctx.request.kubernetes.resource == "secrets"
• ops-agent, a member of the sre-agents Group, runs kubectl get configmaps -n production and gets NAME DATA AGE app-config 4 12d feature-flags 2 3d kube-root-ca.crt 1 12d. The access log records ALLOWED list configmaps · production with POLICY_MATCH.
• ops-agent, a member of the sre-agents Group, runs kubectl get secrets -n production and gets Error from server (Forbidden): Octelium: Unauthorized request. The access log records DENIED list secrets · production with NO_POLICY_MATCH.

Signing in with a passkey and opening the Portal

• The sign-in page of the Cluster at acme.com/login offers login with Okta, with GitHub, or with a passkey.
• jane@acme.com chooses Login with a Passkey and verifies it with a biometric on the device through native WebAuthn.
• The browser is redirected to the Portal at portal.acme.com/services, which lists the Services the User can access:
• grafana.monitoring: Grafana dashboards, Web App, Namespace monitoring.
• aws-postgres.production: Amazon RDS for PostgreSQL, PostgreSQL, Namespace production.
• k8s-prod: Production EKS cluster, Kubernetes, Namespace default.
• bastion.production: SSH bastion host, SSH, Namespace production.
• github-mcp: GitHub MCP server, MCP, Namespace default.
• openai: OpenAI API, AI / LLM, Namespace default.

Cluster resources applied declaratively from YAML with octeliumctl and managed programmatically with the Go, TypeScript, Python and Rust SDKs

• GitOps: cluster.yaml in the main branch of the ~/octelium repository describes the desired state of the Cluster. Its diff reads as follows, with + for added, ~ for changed and - for removed lines.
• + kind: Group
• + metadata:
• + name: payments
• + spec: {}
• + ---
• + kind: User
• + metadata:
• + name: alice
• + spec:
• + type: HUMAN
• + email: alice@acme.com
• + groups: ["payments"]
• ---
• kind: User
• metadata:
• name: bob
• spec:
• type: HUMAN
• ~ groups: ["payments"]
• ---
• kind: Service
• metadata:
• name: billing
• spec:
• mode: HTTP
• config:
• upstream:
• ~ url: http://10.0.3.24:8080
• - ---
• - kind: Service
• - metadata:
• - name: billing-legacy
• - spec: ⋯
• - ---
• - kind: User
• - metadata:
• - name: john
• - spec: ⋯
• ~/octelium ❯ octeliumctl apply --prune .
• Group: payments Created
• User: alice Created
• User: bob Updated
• Service: billing.default Updated
• Service: billing-legacy.default Deleted
• User: john Deleted
• Cluster Core resources successfully applied
• 2 resources created
• 2 resources updated
• 2 resources deleted
• Go: main.go uses the octelium-go SDK to list the Users of the Cluster and update the email and Policies of linus.
• client, err := octelium.New(ctx)
• if err != nil {⋯}
• conn, err := client.Conn(ctx)
• if err != nil {⋯}
• api := corev1.NewMainServiceClient(conn)
• users, err := api.ListUser(ctx, &corev1.ListUserOptions{})
• if err != nil {⋯}
• for _, u := range users.Items {
• fmt.Println(u.Metadata.Name)
• }
• user, err := api.GetUser(ctx, &metav1.GetOptions{Name: "linus"})
• if err != nil {⋯}
• user.Spec.Email = "linus@acme.com"
• user.Spec.Authorization = &corev1.User_Spec_Authorization{
• Policies: []string{"db-readonly"},
• }
• if _, err := api.UpdateUser(ctx, user); err != nil {⋯}
• fmt.Println("updated", user.Metadata.Name)
• ~/app ❯ go run .
• alice
• bob
• linus
• updated linus
• TypeScript: main.ts uses the @octelium/sdk SDK to list the Users of the Cluster and update the email and Policies of linus.
• const client = await OcteliumClient.create({
• domain: "acme.com",
• auth: {⋯},
• });
• const users = await client.coreV1.listUser(ListUserOptions.create());
• for (const u of users.response.items) {
• console.log(u.metadata?.name);
• }
• const { response: user } = await client.coreV1.getUser(
• GetOptions.create({ name: "linus" }),
• );
• user.spec!.email = "linus@acme.com";
• user.spec!.authorization = User_Spec_Authorization.create({
• policies: ["db-readonly"],
• });
• await client.coreV1.updateUser(user);
• console.log("updated", user.metadata?.name);
• await client.close();
• ~/app ❯ npx tsx main.ts
• alice
• bob
• linus
• updated linus
• Python: main.py uses the octelium-sdk SDK to list the Users of the Cluster and update the email and Policies of linus.
• async with await OcteliumClient.create() as client:
• users = await client.core_v1.list_user(ListUserOptions())
• for u in users.items:
• print(u.metadata.name)
• user = await client.core_v1.get_user(GetOptions(name="linus"))
• user.spec.email = "linus@acme.com"
• user.spec.authorization.policies = ["db-readonly"]
• await client.core_v1.update_user(user)
• print("updated", user.metadata.name)
• ~/app ❯ python main.py
• alice
• bob
• linus
• updated linus
• Rust: main.rs uses the octelium SDK to list the Users of the Cluster and update the email and Policies of linus.
• let client = Client::from_env().await?;
• let mut api = client.core_v1();
• let users = api.list_user(ListUserOptions::default()).await?;
• for u in users.into_inner().items {
• println!("{}", u.metadata.unwrap_or_default().name);
• }
• let options = GetOptions {
• name: "linus".into(),
• ..Default::default()
• };
• let mut user = api.get_user(options).await?.into_inner();
• let spec = user.spec.get_or_insert_default();
• spec.email = "linus@acme.com".into();
• spec.authorization.get_or_insert_default().policies = vec!["db-readonly".into()];
• let user = api.update_user(user).await?.into_inner();
• println!("updated {}", user.metadata.unwrap_or_default().name);
• ~/app ❯ cargo run -q
• alice
• bob
• linus
• updated linus