# Palana (Part 2): Architecting isolation, identity, and auditability for AI agents

DevFeed: [Palana (Part 2): Architecting isolation, identity, and auditability for AI agents](<https://devfeed.tech/articles/palana-part-2-architecting-isolation-identity-and-auditability-for-ai-agents-1253.md>)

Original publisher: [Read original article](<https://engineering.grab.com/part-2-palana-architecture>)

Author: Kevin Littlejohn

Published: 2026-06-21T00:00:00Z

Content type: article

Language: en

Sources: [Grab Tech](<https://devfeed.tech/sources/grab-tech.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [systems](<https://devfeed.tech/topics/systems.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Network](<https://devfeed.tech/topics/network.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [autonomous](<https://devfeed.tech/tags/autonomous.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [http](<https://devfeed.tech/tags/http.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [llm](<https://devfeed.tech/tags/llm.md>), [network](<https://devfeed.tech/tags/network.md>), [observability](<https://devfeed.tech/tags/observability.md>), [platform](<https://devfeed.tech/tags/platform.md>), [policy](<https://devfeed.tech/tags/policy.md>), [production](<https://devfeed.tech/tags/production.md>), [resource](<https://devfeed.tech/tags/resource.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [systems](<https://devfeed.tech/tags/systems.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

Palana Part 2 explains the architecture of Grab's Kubernetes-native secure execution platform for autonomous AI agents. It describes isolated user-and-agent namespaces, default-deny networking, proxy-mediated traffic, Vault-based secret separation, operator-managed resources, admission controls, persistent storage, observability signals, and identity handling.

## Source excerpt

Introduction In Part 1, we introduced Palana, Grab's Kubernetes-native secure execution platform for autonomous AI agents. We discussed the underlying need for isolated environments and covered its core design principles: treating isolation as the unit of trust, keeping credentials out of agent hands, and mediating all network access. In this second part, we'll dive under the hood into Palana's architecture, look at the agent lifecycle, and share the key lessons we learned from putting this system into production. Architecture overview The core request path looks like this: Figure 1. Palana architecture overview. The agent pod runs in a namespace owned by one user and one agent. It gets default-deny style network policy, domain name system (DNS), access to required platform services, and a persistent /data volume. Browser traffic enters through Traefik. LLM traffic goes to the LiteLLM wrapper in the gateway namespace. General Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS) egress goes through the proxy namespace. Secrets are read from Vault only by the component authorized to use them. The operator is responsible for turning a user request into the concrete Kubernetes shape: The user creates an agent through pcli (Palana command-line interface) or the portal. Palana writes a UserAgent or Agent custom resource with the raw user identity. The operator creates the user and agent namespaces, service accounts, role bindings, storage, network policies, and ingress. The user runs a template or container image. Admission webhooks inject proxy environment variables and enforce pod-level restrictions. Logs, policy decisions, and activity signals are emitted to observability systems. Agent lifecycle From a user's perspective, the basic workflow is intentionally small: ./pcli login ./pcli create demo ./pcli secrets add demo GRABGPT_API_KEY token=<token> ./pcli run demo --template claudecodeui Behind those commands, Palana provisions an isolated