Security Guidelines

1. Zero Trust AI Architecture

iAgentic operates on a zero-trust model. Every request from an AI agent or user to an LLM must be explicitly authorized by a compiled policy.

Identity-Aware Policies

Integrate with your enterprise IdP to ensure policies are context-aware based on user roles and permissions.

Least Privilege Access

Grant AI agents only the minimum necessary permissions to perform their specific tasks.

2. Production Secrets Management

Protecting API keys and credentials for LLM providers and internal systems is critical for maintaining the integrity of the governance layer.

Centralized Secrets Management

Production credentials must be managed via centralized secrets management systems that support access control, rotation, auditability, and environment isolation.

Avoid using environment variables for production secrets.
Implement role-based access control (RBAC) for secret access.
Enable automated rotation and audit logging for all credentials.

Note:Environment variables should only be used for local development and testing purposes.

3. Policy Authoring Best Practices

Write robust and secure policies using the iAgentic DSL.

// Secure Policy Example

IF
  intent == "database_query"
AND
  user.role != "db_admin"
THEN
  ACTION: BLOCK
  REASON: "Unauthorized database access attempt"

Always include clear rejection reasons in your policies to aid in debugging and audit reviews.

4. Incident Response & Auditing

Monitor your AI interactions and respond to potential security threats.

Real-Time Alerting

Configure alerts for high-risk policy violations or unusual spikes in AI traffic.

Audit Log Review

Regularly review the immutable audit store to identify patterns of misuse or policy drift.

Security Support

For security-related questions or to report a vulnerability, please contact our security team at:
Email: security@iagentic.ai
PGP Key: Available on request for encrypted communication.