- Published on
- 9 min read
AI Tool Gateways: Sandboxing Agent Access in Kubernetes
AI agents have unlimited ambition and undefined access boundaries. You have sandboxed everything else. Here is how to sandbox your agents too.
Shaping the technical direction for Sky AdTech across platform engineering, cloud-native architecture, and Agentic AI systems. I turn strategy into production systems: multi-tenant Kubernetes platforms, secure integration patterns, developer experience, observability, and AI capabilities. My focus is raising the engineering quality bar, setting standards, mentoring engineers, and helping teams make better long-term architecture choices. Still championing the adoption of AI across the organizations, and driving innovation through AI enablement.
Led the design and evolution of a multi-tenant, cloud-native Kubernetes platform for Sky's advertising technology. Drove platform architecture, reliability, security, CI/CD, and observability across GCP, AWS and Azure, enabling teams to ship faster, and AI enablement to driving innovation and championing the adoption of AI in the organization.
Modernised critical AdTech services by moving legacy applications onto cloud-native platforms, improving CI/CD, developer experience, and release confidence. DevEx was rebuilt from the ground up. Deployments went from days to minutes. Mentored engineers across teams, championed best practices.
Co-founded Syntonym, an AI privacy company building hyper-realistic face anonymisation for video and images. Built and led the engineering from day zero, setting the technical direction for generative AI privacy systems across cloud and edge. Delivered GAN(Generative Adversarial Networks) based pipelines on GKE, AWS, Azure and Nvidia Jetson with real-time video processing in Go, C++, Ray multi-cloud GPU infrastructure.
9 months at Pinpointer: Built and improved real-time logistics and tracking systems for bulk handling operations, working across backend, frontend, and cloud infrastructure. geolocation APIs on AWS Fargate, Full stack AWS delivery, lambda, fargate, route53, cloudfront, dynamodb, sns/sqs, and more.
Solution engineer and forward deployed lead across aquaculture, energy, and smart factory clients. Built customer-facing software for aquaculture, energy, and smart factory systems across IoT, ERP, MRP, and real-time operations. Forward deployed: shaped requirements, presented architecture and implementation plans to C-level executives, translating complex client needs into high-performance aquaculture solutions.
Worked as a Software Engineer within the university, developing enterprise solutions using Oracle systems and .NET/Java technologies.
Start with the latest four posts, then head to the full archive for every article, topic, and search.
AI agents have unlimited ambition and undefined access boundaries. You have sandboxed everything else. Here is how to sandbox your agents too.
Network policies in most Kubernetes clusters are cargo cult. Teams write them, Kubernetes accepts them, and nothing changes. Cilium actually enforces them — and shows you the traffic.
Authentication gets easier when you separate login, delegated access, SSO, and workload identity. This guide shows where each one fits.
Seven books that shaped how I build platform products people trust, adopt quickly, and keep using.