Thanks for the time Alex. That's a great point, and actually where my thinking is heading too and i am getting more worry about complexity and over engineering. I wouldn't want another AI agent sitting above the others making authorization decisions. I'm thinking of the policy decision point as deterministic infrastructure, evaluating the agent identity, requested action and current workflow state against explicit rules. Keeping that part simple and explainable is important, especially when trying to understand later why a call was allowed or denied.

@Alex Galea Thanks for the details and quick response. My another bigger concern at the moment is actually agent safety. Since the agent is deciding which actions/tools to execute ( i feel unsafe when i am not writing the logic), I want to be able to see and reproduce misbehaviour if something goes wrong. I've started restricting it at the OS/security level as you see in screenshot, but I'm thinking about adding tool-level policies, tracing the complete action chain. Still very new to this area, so I'm trying to understand what the normal pattern is.

Hi everyone, Glad to be part of the community. I’m a Senior Software Engineer,mainly working with Java, Go and cloud-native technologies. On the side, I’m building KBlock, an open-source AI driven Kubernetes compliance project that creates immutable, cryptographically verifiable audit evidence using blockchain-style techniques.I’m also exploring how Claude Code and agentic AI can help me build and evolve KBlock faster.Looking forward to learning and sharing with everyone here!

@Alex Galea Thanks! I’ve worked with Java for many years, and I’m relatively new to Go. I’m really enjoying Go so far, especially its simplicity, fast build times, and how well it fits cloud-native tooling. For larger enterprise applications, I still really appreciate Java and its mature ecosystem, but for Kubernetes and infrastructure tooling, Go feels very natural and fun to work with. KBlock is still in the early stages, but I’ll definitely share the GitHub link as soon as it’s ready for others to explore and contribute to.