Securing Agentic AI for Singapore enterprises: A reference architecture

The advent of Generative AI has presented enterprises in Singapore and the Southeast Asian region with an opportunity to capitalize on new use cases. However, a significant hurdle remains: ensuring data security and preventing AI hallucinations. In particular, when handling sensitive domains like healthcare, insurance, or financial data, exposing raw data to external Large Language Models (LLMs) without robust safeguards can lead to compliance issues.

Recognizing this challenge, I set out to develop a secure, multi-agent conversational platform on Google Cloud to address this issue. Today, I am pleased to open-source the reference architecture and accompanying codebase, providing a robust foundation for enterprises seeking to securely integrate AI into their operations.

The core of the architecture is a multi-layered security protocol designed to create a "defence-in-depth" system for LLMs. This involves leveraging Google Cloud's Sensitive Data Protection (SDP), Model Armour, and Vertex AI LLMOps Guardrails to establish a stringent filtration layer that prevents sensitive data from reaching the Gemini 2.5 Flash agent.

The process begins with a PII redaction layer powered by GCP SDP, which scans prompts and uploaded documents for specific Southeast Asian Personally Identifiable Information (PII) patterns, such as Singapore NRICs/FINs, local phone numbers, and names. By tokenizing this information, the system ensures that the raw data never reaches the LLM in its original form.

For instance, the prompt "Hi, my name is Syam, and my NRIC is S1234567A" is transformed into "[PERSON_NAME], and my NRIC is [SINGAPORE_NRIC_FIN]" before being processed by the model.

Even after PII redaction, the prompt must undergo a second layer of scrutiny through GCP Model Armour, which functions as a firewall to detect potential threats such as prompt injections, jailbreaks, and toxicity. This system scans both the incoming prompt and the agent’s outbound response, ensuring that the platform is protected against manipulation attempts that could result in the leakage of internal system instructions.

In highly regulated sectors such as insurance and healthcare, where AI systems cannot provide medical or financial advice, additional Vertex AI LLMOps guardrails are implemented to enforce strict compliance. These guardrails include predefined system instructions and constraints that ensure the agent only provides fact-based information and redirects users to human specialists for sensitive inquiries, effectively minimizing the risk of hallucinations.

Once the sanitized prompt successfully navigates these security layers, it reaches the Agent Router, which determines the appropriate specialised agent based on the context of the request. This routing mechanism uses Google's Agent SDK to direct prompts to the relevant agent services, such as Clinical Inquiry or Customer Support.

These agents are encapsulated within an Apigee API Gateway, providing a secure channel for the agents to access real-time enterprise data from internal databases while maintaining strict access controls.

To validate the effectiveness of this architecture across the diverse linguistic landscape of Southeast Asia and ensure its suitability for real-world deployment, I developed a Batch Evaluation Platform. This platform conducts simulated prompts across English, Cantonese, Malay, and Bahasa, employing an automated LLM-as-a-judge pipeline to evaluate the responses for relevance, harmfulness, and regional localisation accuracy.

By automating this evaluation process, I was able to assess the performance of the architecture without relying on manual review, thus demonstrating its capability to handle a wide array of regional variations in user input.

Acknowledging the critical role of AI security in Singapore's Smart Nation agenda, I have chosen to open-source the Terraform infrastructure and backend codebase for this architecture on GitHub. This initiative invites local developers and enterprise architects to fork the project and tailor it to their specific needs, fostering a collaborative environment for the development of secure AI deployments.

The Terraform infrastructure repository and the Agent Security Framework can be accessed through the following links: [Infrastructure Repo](link) and [Agent Security Framework](link).

It is important to note that the views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27. For further discussion, you can join the conversation on WhatsApp, Instagram, Facebook, X, and LinkedIn.