# JIT Chapter 88: Production Security & Compliance (/docs/deploying-agent-factories-in-the-cloud/88-production-security/overview)

---
type: Document
title: "JIT Chapter 88: Production Security & Compliance"
description: "Secure Kubernetes deployments with RBAC, NetworkPolicies, Pod Security Standards, and compliance controls"
status: stable
order: 8800
generated:
  by: ag-archive/0.1.0
  at: 2026-08-26T00:00:00Z
ksor:
  audience: [public]
  approval:
    by: ag-archive/0.1.0
    at: 2026-08-26T00:00:00Z
trust_tier: unverified
build_id: sha256:c8912c3008ae345a7fdc33ace656531ad74f37c065177057c390c7d759f1e970
source_commit: dad4758bb59919c7b9130444778ade062a2dce3e
ksor_version: 0.0.47
---

You build a `cloud-security` skill first, then apply it to harden your Kubernetes agent: identity, network, workloads, secrets, supply chain, and compliance checks.

---

## Goals

- Apply the 4C’s model: Cloud → Cluster → Container → Code
- Enforce Kubernetes security: RBAC, NetworkPolicies, Pod Security Standards
- Harden containers: image scanning, non-root users, seccomp/apparmor
- Protect secrets: external stores and sealed/encrypted patterns
- Add compliance and auditing: policy-as-code, admission controls
- Capture security patterns in a reusable skill

---

## Lesson Progression

- Build Your Cloud Security Skill (skill-first)
- Cloud/Cluster security: RBAC, NetworkPolicies, PSS
- Container security: scanning, users, seccomp/apparmor
- Secrets management and signing/supply-chain hygiene
- Compliance and policy-as-code (admission controls, audit)
- Capstone: hardened Task API deployment; finalize the skill

Each lesson ends with a reflection to test, find gaps, and improve.

---

## Outcome & Method

You finish with a hardened, compliant Task API deployment and a reusable cloud-security skill. The chapter follows the skill-first pattern with a spec-driven capstone.

---

## Prerequisites

- Chapters 79-86 (containerized, deployed, observable, routed service)
- Familiarity with GitOps to apply security manifests