At IBM, we’re our own client first. We adopt AI across our organization and seek its benefits while maintaining safety, security, and cost control. Drawing on years of AI security research and innovation, we develop and deploy solutions for these needs, and we help our clients and partners achieve the same goals. As part of this approach, the open-source AI and cloud-native proxy server Praxis gives us a shared foundation to develop, test, and contribute these controls.
Working together with Red Hat, IBM has contributed the Praxis Policy Engine (PPE) to Praxis. Praxis embeds PPE as its policy filter across ordinary and AI traffic. IBM-affiliated contributors hold maintainer roles in this work, and Praxis has been onboarded into the Cloud Native Computing Foundation (CNCF) Sandbox. PPE treats tools, prompts, resources, model calls, and other agents as explicit policy targets. Its common data format and enforcement pipeline combine identity, delegation, content controls, and audit in a reference monitor that uses verified state outside the model’s control.
Teams can express hard access rules, softer behavior policies, and controls for specific domains in one policy specification with several deployment options: at a gateway, beside an agent, or inside a framework. Each placement protects the operations that cross it.
Why this matters to IBM Research
AI gateways form the next layer of AI platform architecture above inference serving stacks such as llm-d, which is the core model-serving layer handling prompts and responses. These gateways also provide access control, tool invocation, parts of the agent loop, accounting, and metering of token usage by individual users or teams. Praxis provides an efficient foundation for an AI gateway, with PPE enforcing organizational security and safety policies.
PPE supports policy enforcement at the application layer, including in Rosso Cortex for its laptop policy build. PPE also has integrations with ContextForge and Mellea.
Future research direction
Praxis and PPE provide a platform for prototyping emerging standards and developing reference implementations with minimal changes to the applications they protect. We are working with CoSAI on the Open Delegation and Identity Standard (ODIS) for agent identity, bounded delegation, and authorization. We have also contributed extensions to the Open Cybersecurity Schema Framework (OCSF), a Linux Foundation project that defines a vendor-neutral schema for security telemetry supported by cloud providers and SIEM platforms. PPE can emit an OCSF audit record for each policy decision, with optional signatures and hash chaining that let verifiers detect later changes.
We are building on this work by investigating how host isolation and gateway policy enforcement can work together. Host isolation limits which local files an agent can access and which commands and subprocesses it can run. When agents access sensitive data and services over the network, policy enforcement must also cover those interactions. A Praxis gateway could govern who can invoke the agent, which tools and services it can reach over the network, and what data can cross its boundary. Policy would tie those decisions to verified identities, scoped permissions, approval requirements, and audit records. PPE already uses verified agent identity for delegated and on-behalf-of authorization, building on our team’s contributions to SPIFFE/SPIRE and extending our work on zero-trust workload identity to agent authorization.
We plan to test how agents and their tools might bypass these controls and evaluate which combinations of host isolation and network monitoring can resist bypass while remaining usable and portable. For high-assurance environments, we also want to determine what evidence these controls can provide that agents stay within their granted authority when they call tools or delegate work across compute and organizational boundaries.
