Red Hat’s IdeaBot isolates research agents without handing them long-lived credentials

Red Hat has described the architecture behind IdeaBot, an internal research-agent application built on OpenShift to help employees develop and assess proposals for open source projects, integrations and new technologies.

The interesting part is not the corporate-innovation use case by itself. It is the set of boundaries Red Hat’s emerging technologies team put around agents that search both internal and public systems: one runtime per session, proxy-mediated credentials, narrowly scoped tools and durable state outside the agent pod.

Separate the session from the secrets

Each IdeaBot conversation runs in a dedicated pod with its own network namespace. That pod contains a session container for the research workflow and an authentication proxy sidecar. The proxy strips inbound credentials and obtains short-lived tokens from a centralized token service for authorized outbound calls.

Long-lived API keys and refresh tokens therefore remain outside the session pod. Red Hat says tool permissions are limited to the minimum scope required by each research subagent. That design narrows the resources available to a compromised or misdirected agent rather than assuming prompts alone can provide an adequate security boundary.

IdeaBot also keeps persistent state in PostgreSQL instead of treating the pod as durable. The platform can terminate inactive sessions and later reconnect a user to a fresh pre-provisioned pod hydrated from the database. A warm pool is used to reduce scheduling and cold-start delays.

Isolate research domains, then make findings inspectable

The application sends research agents into isolated internal and external data domains. Its source set includes Google Workspace, Jira, Git repositories, Red Hat documentation, Red Hat Knowledgebase material and the public web. The article says this contextual separation is intended to prevent corporate-data exfiltration.

Findings are organized into categories such as prior art, potential collaborators, product alignment and competitive analysis. Users can inspect references and confidence scores, edit or remove generated material, set priorities and request revalidation against primary sources.

That human review continues into the final output. IdeaBot synthesizes an executive summary, problem statement, proposed solution, market analysis and prior-art assessment, but users retain authority to edit the documents. Automated checks flag gaps without blocking submission.

Requirements become the test boundary

Red Hat also used the Easy Approach to Requirements Syntax, or EARS, with Gherkin feature files to define system behavior. Humans review the requirements, test infrastructure is generated from those specifications, and implementation proceeds against the resulting tests.

The team presents that method as a step toward reproducible agentic software-development pipelines. For platform engineers, the immediate takeaway is more concrete: an agent application can keep ephemeral compute, credentials and durable state in separate control planes while preserving source inspection and human decisions at the workflow level.