Journey: Securing Enterprise Database Autonomous AI Agents

Phase 1 (One-Time Enterprise Foundation)

Enterprise Foundation: Tenant & SCIM 2.0 Ingress

Configure your organization's cryptographic root and human directory integration.

Atoms: atom-tenant-crypto + atom-scim-directory

⚛️ Tenant Partition & Crypto Root

Step 1.1

Organization Name * Legal entity identifier used in multi-tenant policy isolation.

🏥 UK NHS Healthcare Organization

Check this box if this organization is a UK NHS Trust, Health Board, or ICB requiring an ODS code.

Primary Cloud Region

Cryptographic Root of Trust Root CA for signing Teleport database client certificates and token chains.

Lead DBA Supervisor Group Maps to dba_lead ReBAC role

SecOps Compliance Group Maps to compliance_certifier

All fields are editable. Values carry through automatically into live policy checks.

Phase 1 Checkpoint • Ingress Verification Gate

Have you completed the SCIM sync?

Verify that your enterprise Identity Provider has connected to AuthHub and completed its initial directory push before binding human sponsors.

Atom: atom-scim-directory-ingress (Sync Gate)

Target Identity Provider

Microsoft Entra ID (Azure AD)

RFC 7644 Active

Configured SCIM Ingress URL

https://api.authhub.cloud/api/v1/scim/...

IdP Tenant Provisioning URL

Secret Bearer Token

scim_live_••••••••••••••••

Authenticated Provisioning Secret

AuthHub Connector Registration: ✓ Connection UUID Validated

Live Gateway Ingress Status ✓ Connection Active & Ingested

Handshake Probe

HTTP 200 OK (GET /ServiceProviderConfig)

Directory Users Synced

2,945 Identities Indexed

Security Groups Ingested

25 Mapped Roles & Groups

Directory Ingestion Baseline 100% (2,945 / 2,945 Users)

Yes, I have completed the SCIM sync in our Identity Provider

The SCIM Base URL and Secret Bearer Token have been configured in Microsoft Entra ID, provisioning has been started, and initial directory sync of users and groups has completed.

🛡️ Unlocks verified human identity selection for Business Owner, Technical Owner, Escalation Desk, and Quorum Deputies.

⚠️ Please check the confirmation box above to certify directory sync completion before proceeding to Phase 2.

Phase 2 (Per-Agent Setup)

Universal Agent Identity, Human Sponsorship & Autonomy

Bind the AI agent to a non-human identity (NHI) and an accountable human sponsor.

Atoms: atom-nhi-identity + atom-human-sponsor + atom-autonomy-gate

🤖 Agent NHI Identity

Step 2.1

Agent Identifier (Slug) * Unique subject in SpiceDB: agent:[id]

Primary AI Model

Agent Purpose & Scope

👥 Human Sponsorship & Quorum Governance

Step 2.2 • ISO 42001

Eliminates Single Points of Failure (SPOF). Binds business purpose, technical custody, and failover quorum to verified SCIM directory identities.

SCIM 2.0 Directory Ingress Active: Sourced from connection n9

2,945 Identities Synced

💼 Business Owner * ✓ SCIM Directory DSPT / Business Purpose

Dr. Alistair Finch ✓ Verified SCIM

alistair.finch@enterprise.com

Clinical Director • Medicine

🛠️ Technical Owner (Lead DBA / SRE) * ✓ SCIM Directory AST & Invariants

Marcus Vance ✓ Verified SCIM

marcus.vance@enterprise.com

Lead Database Administrator • Infrastructure

🚨 24/7 Security Escalation Contact * ✓ SCIM Directory Sub-50ms CAEP Trip

SOC

SecOps SOC Incident Desk ✓ Verified SCIM

secops-oncall@enterprise.com

24/7 Security Operations Centre

🛡️ Designated Deputy 1 (Quorum Lead) * ✓ SCIM Directory SPOF Elimination

Elena Rostova ✓ Verified SCIM

elena.rostova@enterprise.com

Senior Site Reliability Engineer

🛡️ Designated Deputy 2 (Secondary Quorum) * ✓ SCIM Directory Failover Signer

David Kim ✓ Verified SCIM

david.kim@enterprise.com

Principal Data Engineer

⚖️ Autonomy & Guardrails

Step 2.3

Autonomy Level

Destructive DDL Veto: In-path AST block on DROP, ALTER, TRUNCATE (<2ms). Dynamic PII Redaction: Replace classified columns with HMAC pseudonyms. Short-Lived mTLS: 1-hour certificates issued via Teleport CA. Sub-Agent Spawning: Allow spawning secondary child agents (Default: Disabled).

Phase 3 (Workload Cartridge)

Database Workload Cartridge: Teleport & Table-Level ReBAC

Atom: atom-database-teleport-access

🛡️ Database Connection & Teleport Gateway

Step 3.1

Database Gateway Connection Name * Human-readable connection name shown across the Connections list, audit log, and gateway metrics.

Database Engine

Database Name *

Database Host & Port * Live test connection: pg-authhub1-authhub-poc1.f.aivencloud.com:10952

Teleport Service Proxy Host Teleport Auth/Proxy service terminates agent mTLS connection.

🔐 Ephemeral mTLS Certificate (Preview) ACTIVE

Subject: nhi:clinical-triage-agent-01

Principal: ai_readonly_role

Database: patient_ehr_prod

Valid for: 3600s (Auto-rotates hourly)

⚡ Fine-Grained Table Access & PII Masking

ReBAC Policy

Permitted Target Tables (Allowed for Agent Queries) * Comma-separated list. Agent is granted select via SpiceDB.

Restricted / Forbidden Tables (Strict 403 Veto) * Attempts to query these tables trigger an immediate 403 Forbidden.

Columns Subject to In-Path Dynamic PII Redaction * AuthHub Gateway replaces values with deterministic PSEUDO:xxxx HMAC hashes.

Policy Summary:

✓ Can SELECT: patient_encounters

✗ Vetoed Tables: mnpi_deal_records

🔒 Redacted Columns: nhs_number, date_of_birth

Phase 4 (Safety Substrate)

FinOps Token Budgeting & Emergency Kill Switch

Configure automated spend governance and sub-50ms emergency session revocation.

Atoms: atom-finops-budget + atom-clock1-killswitch

💰 Token Budgeting & Progressive Downgrade

FinOps

Hourly Spend Ceiling ($) * Max USD per hour

Throttle Trigger (% Budget) Slows query rate

Overspend Enforcement Policy (At 100% Budget) * Default Hard Circuit Breaker halts all database tool execution when spend ceiling is breached.

Fallback Model (If Downgrade Mode Selected) Downscales LLM context cost if progressive downgrade is configured.

Supervisor Slack / Teams Webhook for Overspend Interactive attestation card pushed to supervisor upon budget overrun.

🚨 Clock-1 Sub-50ms Kill Switch

Safety SLA

Control Plane Transport Channel

Revocation Target: clinical-triage-agent-01

Measured Sever Latency: 14.2ms (SLA <50ms)

Audit Trail: RFC 3161 Merkle Ledger

When the kill switch is tripped, Teleport immediately destroys the active database session and SpiceDB drops all agent token permissions.

Phase 5 (Live Verification & Attestation)

⚡ Live Policy Verification & SQL Execution Console

Configuration is live. Test queries against enforced ReBAC and FinOps boundaries before closing.

Agent Status: ACTIVE

📋 Active Policy Matrix (Bound to Your Inputs)

Organization: NHS Imperial Trust

Agent Identity: clinical-triage-agent-01

Database Target: patient_ehr_prod

Human Sponsor:

Permitted: patient_encounters

Vetoed: mnpi_deal_records

Masked PII: nhs_number, date_of_birth

Quorum Deputies: Elena Rostova, David Kim

24/7 Escalation: secops-oncall@enterprise.com

Checking Live Backend (https://api.authhub.cloud)...

SpiceDB ReBAC Policy: Active & Synchronized (enterprise-database-agent-01)

Verify Agent SQL Actions:

Teleport SQL Proxy Session Latency: --

Supervisor: • Role:

🖥️ Execution Response & Policy Inspection AWAITING QUERY

Select one of the query actions above or write custom SQL, then click "Execute via Teleport".

⏸ Admin Gateway State (Maintenance Mode) ENABLED (ACTIVE)

Soft-drain and pause gateway traffic for maintenance without triggering SecOps alerts or Merkle audit key invalidation.

Database In-Path Proxy

Normal proxying to Teleport & SpiceDB ReBAC

🚨 Clock-1 Kill Switch Sub-50ms SLA

Instantaneous socket severance. Cancels the Teleport mTLS certificate and terminates active database TCP streams.

💰 FinOps Cost Trigger $24.10 / $50.00

📜 Merkle Audit Log RFC 3161 TSA

#001 | INIT: Agent identity enrolled

Configuration is active and verified on Gateway

In-Progress Connection Setup Restored