AI agents are evolving from passive assistants into active participants in enterprise IT operations -analyzing logs, investigating incidents, assessing system health, and recommending next steps. While this can accelerate troubleshooting and reduce operational toil, enterprise adoption requires answering a critical question beyond improving productivity: How can an AI agent interact with infrastructure without creating new security, compliance, or governance risks? This blog explores how to leverage HashiCorp Boundary’s zero trust access model to provide AI agents with secure, governed access to infrastructure resources.
To explore this challenge in practice, we used IBM technologies and services to create an AI agent capable of investigating infrastructure incidents through natural-language requests. For example, a platform engineer can ask the agent to analyze a performance issue, gather diagnostic data from a target system, and summarize the findings. The key objective was not only to build an AI agent but to ensure that every infrastructure interaction remained secure, controlled, and auditable.
»The solution overview
The AI agent enables a platform engineer to describe an operational goal in natural language: A sample prompt can be:
“Investigate memory pressure on app-server-01 and summarize the findings.”
The following diagram shows the architecture and workflow for an AI agent built with IBM Bob.
The AI agent uses watsonx and Granite models to interpret an operational request, develop an investigation plan, execute the required diagnostic actions, analyze the results, and produce a concise summary for the platform engineer. When infrastructure access is required, the AI agent initiates a login to Boundary, and the platform engineer completes the authentication on behalf of the agent. The AI agent then opens a Boundary-proxied session to the authorized Linux target to perform the investigation. Session activity is recorded, and audit logs capture authentication events, access decisions, grants, policy changes, and administrative actions. This creates a human-authorized workflow for an AI-assisted operation without relying on fully unattended infrastructure access.
»The zero trust layer
As shown in the architecture diagram, Boundary provides the secure access layer between the AI agent and the target infrastructure. Rather than granting the agent direct access to systems, Boundary evaluates the authenticated user's identity, permissions, and target access policies before establishing a connection. This separation of access control from AI reasoning ensures that infrastructure access remains governed by enterprise security policies.
Secure access with Boundary
In this model, Boundary enables five essential controls:
Identity-based authentication: Boundary delegates authentication to IBM Verify through an OIDC authentication method and applies access policies to the verified identity.
Zero trust connectivity: The agent reaches the target only through an active Boundary session, without requiring the agent host to have a direct network route or VPN access to the target’s private network. Boundary workers proxy the connection to the target.
Target grants: Least-privilege grants restrict network access to only the Linux targets required for the agent’s operational task.
Secrets management: Vault stores or generates target credentials, including short-lived dynamic credentials. Boundary retrieves and injects the credentials when it establishes the session, without returning them to the agent or platform engineer. This ensures credentials are shared, leaked, stolen, or insecurely stored.
Administrative control: Authorized administrators can cancel an active session, providing a kill switch for infrastructure access.
Auditability and session recording
Boundary captures the agent’s infrastructure activity within the same governed access layer used for human operators. Session recordings provide visibility into session interactions and the associated target, user, host, and connection metadata. Boundary also emits audit events for authenticated requests, session activity, and administrative operations.
Together, session recording and audit events provide centralized evidence for incident reviews, security investigations, and compliance validation, helping organizations treat the AI agent as a controlled and auditable participant in enterprise operations.
»Demo
The video demonstrates how an AI agent uses a Platform Engineer’s verified identity and permissions to access enterprise resources through Boundary with governance and auditability.
»Final thoughts
As AI agents move from analysis to infrastructure action, enterprises must embed security, governance, and accountability directly into the workflow. Automation alone is not enough; organizations also need controls that govern identity, access, credentials, sessions, and evidence.
In this example, we used watsonx.ai to support the agent’s reasoning, planning, and summarization; Boundary to authorize and proxy infrastructure access; Verify to authenticate the platform engineer; and Vault to manage and inject target credentials. Together, these technologies create a secure, governed model for agent-assisted enterprise operations. The agent can help perform infrastructure tasks while operating within the identity, access, session, and audit controls expected from human operators.
»Building the AI agent
You can try testing this workflow out in your environment. There are several possible approaches, but you can build your AI agent and enable secure access to your resources using Boundary by setting up the services and accounts as described below:
IBM Cloud and watsonx.ai: Create an IBM Cloud account and use watsonx.ai python SDK to build the agent. IBM watsonx.ai provides access to the foundation models and tools that an AI agent can use for reasoning, planning, and summarization. You can also use IBM Bob, an agentic development partner, to design and implement the AI agent through natural-language prompts. Alternatively, you can use the AI agentic frameworks of your choice to develop your AI agent.
Linux host or cloud VM: Create a Linux host in your cloud environment or infrastructure for the agent to inspect.
IBM Verify: Sign -up for an Identity Provider (IdP) like IBM Verify. Configure OpenID Connect (OIDC) and create a user account. A platform engineer will use this account to authenticate Boundary before the agent opens a session. You can also use other IdPs of your choice.
HashiCorp Cloud Platform (HCP) account: Create a free HCP account, deploy Boundary and Vault clusters and complete the following configurations:
Configure the Linux host as a Boundary target. Enable session recording for the target and configure an Amazon S3 or supported S3-compatible storage bucket and the applicable storage policies.
Store the host credentials in a Boundary static credential store, or, preferably, configure a Vault credential library. Bind the credential source to the SSH target as an injected application credential. Credential injection removes the need for the agent to receive the target credential.
Configure Verify as an OIDC authentication provider in Boundary and set the OIDC method as the primary method.
Configure Boundary roles and grants to give the authenticated identity least-privilege access to the required target.
Local development environment: Install Python and the Boundary CLI on your development machine. The AI agent developed calls watsonx.ai python APIs and connects to the target through a Boundary-proxied session after the platform engineer authenticates.
Help us shape our agentic AI roadmap
Are you interested in helping us secure AI agents and shape our AI agentic capabilities and roadmap? Please respond to a short survey to help us understand your enterprise agentic AI use cases, security requirements, and challenges.
