Abstract: Disclosed embodiments relate to systems and methods for controlling access to a resource by an artificial intelligence orchestration system. Example techniques include receiving, at an authorization component integrated with the orchestration system, a request to perform an operation, the request being initiated by an autonomous component; deriving, from the request and data associated with an environmental state, information representing at least one of a purpose and a context of the operation; dynamically evaluating the information, to identify one or more least-privileged permissions required for the operation; issuing an authorization artifact that embeds an ephemeral permission set scoped to the least-privileged permissions; and enabling the operation to execute using only the ephemeral permission set.

Abstract: Disclosed embodiments relate to providing blind secret management and rotation. Techniques include identifying, by a secret rotation manager operating in a first network environment, an encrypted version of a first key material, generating, by the secret rotation manager, an additional key material, combining the encrypted first key material and the additional key material, and providing the combined key material to a rotation agent operating in a second network environment, wherein the rotation agent is configured to decrypt the encrypted first key material from the combined key material, and wherein the rotation agent is configured to generate, according to a secret generation policy, a secret using at least the combined key material.

Abstract: Disclosed embodiments relate to systems and methods for securely handling secrets by securing development and operations pipelines. Techniques include identifying a network access request for a process within the development and operations pipeline; accessing a result of at least one investigation of the process and the network access request, wherein the at least one investigation includes one of monitoring the process behavior, performing a process attestation, or performing an inspection of the network access request; determining whether to authorize the network access request; and conditional on whether the network access request is authorized, dynamically injecting a secret into the network access request, wherein the secret is not made available to the process itself.