BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//sf26-agenda//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
BEGIN:VEVENT
UID:SESS-95@sf26-agenda
DTSTAMP:20261020T151709Z
DTSTART:20261105T173000Z
DTEND:20261105T181500Z
SUMMARY:Least Privilege for Non-Human Identities: Governing an Autonomous K
 afka SRE Agent
LOCATION:Room 2004
DESCRIPTION:Jeremy Frenay\n\nAnyone can build an agent that suggests a fix 
 for a Kafka incident. The hard part is letting it act on production\, wher
 e one bad call can purge a topic or reset consumer offsets and take real d
 ata down with it. This is a tales-from-the-trenches talk about an SRE agen
 t we built to operate Kafka\, and mostly about the part nobody puts in the
  demo: how we permissioned it so that even a fully compromised agent can't
  do catastrophic damage. A Kafka SRE agent is close to a worst case. It re
 ads private telemetry. It ingests content we don't control\, so a single p
 oisoned log line becomes a prompt-injection vector. And it can do things y
 ou can't take back. So we stopped trusting the model to be careful and mov
 ed the authority into the permission layer instead. The model only ever ge
 ts to recommend. The model we landed on\, after a couple of incidents taug
 ht us better\, tiers actions by blast radius. Read-only diagnostics like c
 onsumer lag\, under-replicated partitions\, and broker health run on their
  own. Reversible actions like restarting a connector task or nudging a quo
 ta run too\, but everything gets logged. The destructive stuff (deleting t
 opics\, resetting offsets\, reassigning partitions) always waits for a hum
 an. Under all of it\, the agent has its own least-privilege identity\, sco
 ped per operation with Kafka ACLs instead of borrowing an admin's credenti
 als. Approval gates show the predicted blast radius before you say yes\, w
 e dry-run what we can\, and an append-only log ties every action back to a
  person. We'll also get into what went wrong: an action the agent proposed
  off a signal that turned out to be misleading\, a permission we scoped to
 o wide and had to claw back\, and how fast the non-human identities piled 
 up once we stopped counting. The thing we kept relearning the hard way: be
 ing allowed to connect to a system isn't the same as being allowed to act 
 on it. You'll leave with the actual permission model\, tiered by blast rad
 ius\, and it works for any agent touching production\, not just a Kafka on
 e.
URL:https://sf26.rmoff.net/s/least-privilege-for-non-human-identities-gover
 ning-an-95
END:VEVENT
END:VCALENDAR