Skip to content

AI Agent Security in Production: IAM, Secrets, and Isolation for Python Agents

A row of locked glass isolation cells, each holding one glowing agent cube; one cell glows red from a breach that stays fully contained inside its own walls

Every article about AI agent security tells you it's important. Few show you how to do it.

If you're deploying autonomous agents in production, security isn't optional — it's the difference between a tool and a liability. Here's how to secure your Python agents with the same patterns used by production platforms.

The three principles of agent security

Principle What it means What happens without it
Per-agent isolation Each agent gets its own execution role One compromised agent = all agents compromised
Secrets at runtime only API keys never touch disk or image layers A leaked container image = all your keys
Least privilege Agents can only access what they need An agent that can read your entire DB when it only needs one table

Principle 1: One agent, one IAM role

Never reuse execution roles across agents. Agent A and Agent B should have zero shared permissions by default.

# Good: each agent has its own isolated role
# Agent A: can only read from S3 bucket "agent-a-logs"
# Agent B: can only write to DynamoDB table "agent-b-state"
# They share nothing.

# Bad: both agents use the same "ai-agent-role"
# Agent A's bug becomes Agent B's security incident.

On HollowHost, this is automatic. Every AI Job gets a dedicated IAM execution role provisioned at deploy time, scoped to that agent's resources only.

One shared role ⚠ blast radius: all agents Agent A ⚠ Agent B ⚠ Agent C ⚠ shared IAM role ⚠ …with access to everything Per-agent roles (HollowHost) ✓ blast radius: one agent Agent A ⚠ Agent B Agent C role A ⚠ role B role C breach contained — B and C untouched
The blast radius of a compromised agent. With one shared execution role (left), agent A's bug is agents B and C's security incident. With per-agent roles (right), the breach stops at the IAM boundary.

Principle 2: Secrets never touch the build

API keys, database passwords, and tokens should be injected at runtime, not baked into the container image or stored in environment files on disk.

import os
# ✅ Injected at runtime by the platform — never in source code
api_key = os.environ["OPENAI_API_KEY"]

# ❌ Hardcoded in source
# api_key = "sk-..."

# ❌ In a .env file committed to the image
# from dotenv import load_dotenv; load_dotenv()

On HollowHost, secrets are encrypted at rest and injected as environment variables when the agent runs. They never appear in build logs, image layers, or the agent's filesystem.

Principle 3: Least privilege by default

An agent that sends email shouldn't have database access. An agent that reads from a database shouldn't have write access. Start from zero permissions and add only what's needed.

# Agent: daily-email-briefing
# Needs: SMTP credentials, OpenAI API key
# Doesn't need: database access, S3 access, other agents' secrets

# Agent: data-pipeline
# Needs: S3 read, DynamoDB write
# Doesn't need: email, other AWS services

What a secure agent deployment looks like

# 1. Create the agent — zero permissions initially
hollowhost ai-jobs create --repo you/agent --lang python --pm uv --entry-point main.py

# 2. Import secrets — encrypted at rest, injected at runtime
hollowhost ai-jobs env import <id> --file .env

# 3. Deploy — platform provisions dedicated IAM role automatically
hollowhost ai-jobs deploy <id>

At deploy time, the platform:

  1. Builds the container in an isolated environment
  2. Provisions a new, dedicated IAM role scoped to this agent only
  3. Creates a secrets namespace accessible only to this agent
  4. Registers the agent with zero cross-agent access

No shared roles. No shared secrets. No privilege escalation.

Security comparison

Self-hosted (typical) HollowHost
IAM roles One role reused across agents Dedicated per agent
Secrets .env file on disk Encrypted at rest, injected at runtime
GitHub tokens May leak into image layers Short-lived build secret, never in image
Cross-agent access All agents on same VM can read each other's data Per-agent isolation enforced at IAM level
Audit trail DIY Every run logged with identity and status

The bottom line

Production AI agent security comes down to three things: isolate every agent, inject secrets at runtime, and start from zero privilege. These aren't advanced features — they're the baseline. If your deployment model doesn't enforce them by default, you're building the enforcement yourself. And that's a full-time job.

Deploy agents with per-agent isolation, encrypted secrets, and least-privilege IAM — automatically. Start on HollowHost.