Palana: Isolation and Identity Management for AI Agents
Grab's secure execution environment design for AI agents.
1What is Palana?
Palana is a Kubernetes-native secure execution platform developed by Grab. It provides isolated environments for AI agents, with core design principles including isolation, identity management, and network access control.
2Architecture Overview
Palana's architecture consists of components such as user and agent namespaces, service accounts, storage, and network policies. Agents run in an isolated environment, and all network access is controlled by the platform.
3Agent Lifecycle
Users can create and run agents through Palana CLI or portal. Each agent is provided with an isolated execution environment, including storage, network access, and identity management components.
4Identity Management
Palana integrates user identities with Kubernetes RBAC. Raw identity credentials are used for authorization, while safe strings are used for Kubernetes objects and Vault paths.
5Secrets Management
Palana provides a least-privilege-based secrets management on Vault. Secrets accessible by agents and those usable only through the proxy are stored in separate paths.
6LLM Access
LLM calls are managed through a wrapper in front of LiteLLM and GrabGPT. This wrapper derives agent identity from Kubernetes context and forwards requests using credentials fetched from Vault.
7Network Access Control
Palana controls network access in a two-layered structure. Kubernetes NetworkPolicy and Cilium determine which pods can access which namespaces and services. Proxy policies control HTTP and HTTPS destinations.
8Observability
Palana sends logs, policy decisions, and activity signals to observability systems. This is critical for monitoring the platform's performance and security.
9Conclusion and Importance
Palana provides a secure and isolated execution environment for AI agents, enabling Grab to manage AI-based services securely. This serves as an example for similar systems in the industry.
Original article: Grab Tech — Palana: AI Ajanlar için İzolasyon ve Kimlik Yönetimi