Securing Agentic AI for Singapore Enterprises: A Reference Architecture

Syam Bandi, Assistant Director of AI Engineering, open-sourced a reference architecture for secure multi-agent conversational AI on Google Cloud, addressing data security and hallucination control for Singapore enterprises. The architecture uses GCP Sensitive Data Protection, Model Armor, and Vertex AI LLMOps Guardrails to redact PII, filter malicious content, and enforce fact-based constraints before data reaches the Gemini 2.5 Flash agent.

By Syam Bandi https://www.linkedin.com/in/bandisyam/ - Assistant Director of AI Engineering The Generative AI revolution is here, but for many enterprises in Singapore and Southeast Asia, adoption has hit a hard wall. The barrier isn’t a lack of use cases—it is Data Security and Hallucination Control . When dealing with highly sensitive domains like Healthcare, Insurance, or Financial Data , passing raw payloads to external Large Language Models LLMs without strict guardrails is a compliance nightmare. Over the last few weeks, I set out to solve this exact problem by architecting a secure, multi-agent conversational platform on Google Cloud. Today, I’m open-sourcing the reference architecture and the codebase. The Architecture: Defense-in-Depth for LLMs To build an enterprise-grade agent, you cannot simply connect a frontend directly to an LLM. You need a multi-layered security protocol. I leveraged GCP Sensitive Data Protection SDP , Model Armor, and Vertex AI LLMOps Guardrails to create an impenetrable filtration layer before the data ever touches the Gemini 2.5 Flash agent. 1. The PII Redaction Layer SDP When a user inputs a prompt or uploads a medical document, the payload is intercepted by the GCP SDP engine. This engine uses custom inspection templates to hunt for specific Southeast Asian PII patterns such as Singapore NRICs/FINs, local phone numbers, and names . Before the LLM even sees the prompt, it is tokenized. For example, "Hi, my name is Syam and my NRIC is S1234567A" becomes "Hi, my name is PERSON NAME and my NRIC is SINGAPORE NRIC FIN ". 2. The Content Filtration Layer Model Armor Even with PII redacted, the prompt must be scanned for malicious intent. I integrated GCP Model Armor as a firewall to detect prompt injections, jailbreaks, and toxicity. It scans both the inbound prompt and the outbound agent response to ensure the system cannot be manipulated into leaking internal system instructions. 3. LLMOps Guardrails: Fact-Based Constraints In highly regulated sectors like insurance and healthcare, an AI system cannot give medical or financial advice. It is strictly restricted to providing fact-based details and retrieving policy information. To enforce this, I implemented strict System Instructions and Guardrails managed through the Vertex AI LLMOps process. This acts as the final perimeter. If a user asks the agent for a medical diagnosis, the guardrails force the agent to politely decline and redirect the user to a human specialist. This virtually eliminates dangerous hallucinations. 4. Agentic Routing & Apigee Integration Once the sanitized prompt clears these three security layers, it hits the Agent Router. Using Google's Agent SDK, the router dictates which specialized agent e.g., Clinical Inquiry vs. Customer Support should handle the request. These agents are wrapped in an Apigee API Gateway, allowing them to securely pull real-time enterprise data from internal databases. Validating the Architecture: GPT-as-a-Judge Building an agent is one thing; validating it at scale is another. To prove this architecture works across the diverse linguistic landscape of Southeast Asia, I built a Batch Evaluation Platform. We ran simulated prompts through the pipeline in English, Cantonese, Malay, and Bahasa. Instead of manual review, I engineered an automated LLM-as-a-judge pipeline to score the responses based on relevance, harmfulness, and regional localization accuracy. Open Source & Next Steps As Singapore continues to push its Smart Nation agenda, securing AI workflows will be the defining challenge for our tech ecosystem. We cannot sacrifice privacy for innovation. I have open-sourced the terraform infrastructure and the backend codebase for this architecture on my GitHub. I encourage local developers and enterprise architects to fork it and adapt it for their own secure AI deployments. View the Infrastructure Repo: https://github.com/bandisyam/gcp-agentic-infrastructure https://github.com/bandisyam/gcp-agentic-infrastructure View the Agent Security Framework: https://github.com/bandisyam/enterprise-agent-security-framework https://github.com/bandisyam/enterprise-agent-security-framework If you are a local developer looking to transition into Agentic AI architecture, I’d love to help. I am opening up mentorship slots on ADPList this month—feel free to reach out or book a session Syam Bandi https://www.linkedin.com/in/bandisyam/ is an Assistant Director of AI Engineering based in Singapore, specializing in secure GenAI integrations and enterprise data strategies.