The control model breaks at the compliance boundary. Kubernetes can limit traffic, syscalls, and workload permissions, but it cannot directly encode BAA scope, FHIR resource restrictions, or minimum-necessary PHI access. That leaves a gap between technical containment and HIPAA-defensible enforcement, especially when the agent’s runtime behavior changes with context.
Why Kubernetes Primitives Are Not Enough for Healthcare AI Agents
Kubernetes is effective at constraining pods, namespaces, network paths, and runtime privileges, but healthcare governance fails when that containment is mistaken for policy enforcement. The real risk is not just where an agent can run, but what it is allowed to do with PHI, FHIR resources, and downstream tools once it starts chaining actions autonomously. The gap is visible in current agent research: AI Agents: The New Attack Surface report notes that 80% of organisations report agents performing actions beyond intended scope.
That matters because Kubernetes primitives do not understand BAA boundaries, minimum necessary access, or whether a request is clinically justified. A pod can be well isolated and still overreach at the application layer. Healthcare teams also tend to discover the problem after agents have already queried the wrong patient record, shared data to the wrong workflow, or invoked a tool outside approved care context. Guidance from the NIST AI Risk Management Framework and OWASP Agentic AI Top 10 both point to this same pattern: runtime context, not static deployment controls, decides whether the action is safe. In practice, many security teams encounter this only after a harmless-seeming workload has already touched protected data outside the intended clinical workflow.
How Healthcare Controls Need to Move from Pods to Decisions
The practical fix is to treat Kubernetes as the execution substrate, not the policy engine. Container controls still matter for segmentation and blast-radius reduction, but the access decision should be made at runtime with workload identity, context-aware authorisation, and task-scoped credentials. That means the agent proves what it is with a cryptographic workload identity, then requests only the minimum PHI or tool access needed for the current action.
Current guidance suggests three layers working together:
- Use workload identity for the agent, not shared service accounts, so the system can distinguish one clinical workflow from another.
- Issue just-in-time secrets or tokens per task, then revoke them when the task completes or the clinical context changes.
- Apply policy-as-code at request time, so FHIR resource access can be checked against purpose, patient, role, and session context.
This is where healthcare-specific governance matters. A cluster policy can allow egress to an API, but it cannot decide whether an agent may retrieve medication history for a current chart review versus a research summary. For that, practitioners need policy tied to identity and context, not just network paths. The OWASP NHI Top 10 and CSA MAESTRO agentic AI threat modeling framework both reinforce the need to model tool chaining, privilege escalation, and data leakage as first-class risks. These controls tend to break down when multiple agents share one runtime namespace and one service account because the enforcement layer can no longer attribute actions to a specific clinical intent.
Where Kubernetes-Only Governance Breaks Down in Real Deployments
Tighter cluster isolation often increases operational overhead, requiring organisations to balance deployment simplicity against compliance precision. The tradeoff is especially sharp in healthcare environments where agents support multiple departments, handle mixed data classes, or switch between chart summarisation, coding support, and patient messaging. Current guidance is not fully settled on one universal control stack, but best practice is evolving toward layered enforcement that includes identity, policy, and auditability above the orchestration layer.
There are also edge cases that Kubernetes alone cannot absorb. A namespace boundary does not express a BAA scope. A network policy does not distinguish minimum-necessary access from broad clinical access. A service account does not automatically expire when a task is complete. And if an agent is allowed to call external tools, the risk shifts from isolated workload execution to cross-system action chaining, where a single overbroad token can affect EHR, messaging, billing, and analytics systems.
That is why healthcare teams should map agent permissions to policy decisions at the point of use, then log those decisions with enough context for audit and incident response. The most important lesson from The State of Secrets in AppSec is that long-lived credentials and fragmented control nearly always create a delayed detection problem, not an immediate one. In practice, Kubernetes-only governance breaks down fastest when autonomous agents operate across multiple clinical systems under one shared identity, because the platform can contain the container but not the compliance event.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agent tool abuse and scope creep are the core failure mode here. |
| CSA MAESTRO | TRT-02 | MAESTRO models autonomous agent threats beyond cluster isolation. |
| NIST AI RMF | AI RMF addresses governance, accountability, and risk controls for autonomous systems. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | Shared workload credentials create overbroad access and attribution gaps. |
| NIST CSF 2.0 | PR.AA-01 | Healthcare agents need strong identity and access governance, not only runtime containment. |
Replace shared service accounts with unique workload identities and short-lived credentials.
