Citation:

Rajesh Balaji, 2025. "AgenticSecOps for Microservice APIs: Policy-Constrained Multi-Agent Investigation and Response to Application-Layer Incidents", ESP Journal of Engineering & Technology Advancements  5(3): 212-221.

Abstract:

AI agents can investigate API security alerts and propose responses far faster than people, but in an application they must read fields that attackers write: profile names, order notes, support tickets. An agent that reads such text and can suspend accounts gives anyone who can fill in a form a way to steer it. This paper presents AgenticSecOps for microservice APIs. Five cooperating agents investigate and respond to application-layer incidents, and each is treated as an untrusted workload. Only one agent reads user-written content, and it can neither act nor close an alert alone. A second agent works only from the authorization engine's decision logs, which users cannot write into. A response agent chooses from a fixed catalogue of application-level actions (step-up, throttle, revoke, suspend, disable a feature) using the application's threat model. A policy gate binds every action to evidence, prices it in legitimate requests and users locked out, and requires a human signature for anything that locks someone out. The design specifies an inverse or compensating procedure for each state-changing action; successful rollback has not been demonstrated against live systems. We compare rule-based automation, a single AI agent and AgenticSecOps on the generated alert episodes and request streams of five held-out weeks from an earlier detection study: about a million requests and 200 incidents across eight abuse scenarios. Agent error and prompt-injection susceptibility are explicit parameters shared by the agent-based designs. No language model is run. With agents that are wrong 10% of the time and follow injected instructions 30% of the time, AgenticSecOps reduced wrongful lockouts from 0.68 to 0.02 a day and injection success from 30% to 3% compared with the single agent. It contained less attack activity, 35% against 42%, and against 49% for rule-based automation that acts in seconds. Ablations show that the Zero Trust policy checks provide the safety, agent coordination the injection resistance, and threat-model context most of the containment. The manuscript describes a simulation and a protocol for subsequent validation with real agents; public availability of the executable artifacts must be confirmed before submission.

References:

[1] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, "Zero Trust Architecture," NIST Special Publication 800-207, Aug. 2020.

[2] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, "ReAct: Synergizing Reasoning and Acting in Language Models," in Proc. International Conference on Learning Representations (ICLR), 2023.

[3] Q. Wu et al., "AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation," arXiv:2308.08155, 2023.

[4] Anthropic, "Introducing the Model Context Protocol," Nov. 2024.

[5] G. Deng et al., "PentestGPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing," in Proc. 33rd USENIX Security Symposium, 2024.

[6] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," in Proc. 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023.

[7] OWASP Foundation, "OWASP Top 10 for LLM Applications 2025," Nov. 2024.

[8] National Institute of Standards and Technology, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile," NIST AI 600-1, Jul. 2024.

[9] R. Fang, R. Bindu, A. Gupta, and D. Kang, "LLM Agents Can Autonomously Exploit One-day Vulnerabilities," arXiv:2404.08144, 2024.

[10] Open Policy Agent Project, openpolicyagent.org.

[11] SPIFFE Project, "SPIFFE and SPIRE," spiffe.io.

[12] B. A. Alahmadi, L. Axon, and I. Martinovic, "99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms," in Proc. 31st USENIX Security Symposium, 2022.

[13] OWASP Foundation, "OWASP API Security Top 10 – 2023," owasp.org.

[14] D. Hardt, Ed., "The OAuth 2.0 Authorization Framework," RFC 6749, IETF, Oct. 2012.

[15] E. Debenedetti, J. Zhang, M. Balunović, L. Beurer-Kellner, M. Fischer, and F. Tramèr, "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents," in Proc. NeurIPS Datasets and Benchmarks Track, 2024.

[16] Q. Zhan, Z. Liang, Z. Ying, and D. Kang, "InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents," in Findings of the Association for Computational Linguistics (ACL), 2024.

[17] E. Debenedetti et al., "Defeating Prompt Injections by Design," arXiv:2503.18813, 2025.

[18] V. Bertocci and B. Campbell, "OAuth 2.0 Step Up Authentication Challenge Protocol," RFC 9470, IETF, Sep. 2023.

[19] T. Lodderstedt, Ed., S. Dronia, and M. Scurtescu, "OAuth 2.0 Token Revocation," RFC 7009, IETF, Aug. 2013.

[20] OpenID Foundation, "OpenID Continuous Access Evaluation Profile 1.0," Shared Signals Working Group.

[21] W. U. Hassan et al., "NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage," in Proc. Network and Distributed System Security Symposium (NDSS), 2019.

[22] R. Balaji, "Threat-Model-Driven Zero-Trust Authorization for Microservice APIs in Kubernetes-Based Cloud-Native Applications," manuscript in preparation.

[23] R. Balaji, "Request-Level Anomaly Detection and Risk-Adaptive Authorization for Microservice APIs," manuscript in preparation.

[24] J. H. Saltzer and M. D. Schroeder, "The Protection of Information in Computer Systems," Proceedings of the IEEE, vol. 63, no. 9, pp. 1278-1308, 1975.

[25] National Institute of Standards and Technology, "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile," NIST Special Publication 800-61 Rev. 3, Apr. 2025.

Keywords:

AI Agents, LLM Security, Prompt Injection, Incident Response, API Security, Microservices, Zero Trust, Human-In-The-Loop, Open Policy Agent