Lessons from building an internal real-time security-operations platform protecting a regulated production environment using Kubernetes-based agents. Key practices include deploying each agent as its own workload, using cert-manager for inter-agent mTLS, enforcing safety constraints through OPA policies rather than LLM prompts, and running an anomaly-detection model as a gatekeeper before LLM invocation to control costs.