Confidential workloads on Azure
Lead product strategy for Confidential Containers on Azure Container Instances, helping enterprises run sensitive container workloads with hardware-backed isolation.
Principal Product Manager · Trusted AI Infrastructure
I build trust infrastructure for consequential systems.
I'm Pawan Khandavilli. At Microsoft, I lead product strategy for confidential cloud platforms. Across my career, I have worked on secure AI infrastructure, confidential computing, multiparty computation, mobile payments, and the systems that let organizations act on sensitive data with confidence.
Selected experience
A career spent making trust concrete
From payments to multiparty computing
Built across the trust stack: North America's first HCE mobile wallet, cryptographic services, secure multiparty-computation platforms, and confidential cloud products.
Agent security and verifiable AI
Develop a practical point of view on MCP security, agent identity, delegated authority, workload isolation, and the evidence enterprises need before agents can act.
Current thesis
The next bottleneck for AI is not intelligence. It is whether we can trust an agent's identity, authority, and execution when it acts on our behalf.Read the argument →
Areas of focus
The problems I keep returning to
01
Agent & MCP Security
Identity, delegated authority, tool permissions, and trustworthy execution for autonomous systems.
Explore the topic → 02Confidential Computing
Protecting data in use and turning infrastructure promises into verifiable evidence.
Explore the topic → 03Security Product Leadership
Product judgment that turns security from a late-stage gate into a platform for adoption.
Explore the topic →Start here
Selected essays
Trust Is the Next Bottleneck: Why the Agentic Economy Needs Confidential Computing
The agentic economy is scaling on software trust primitives that can't keep up. Hardware-rooted attestation via confidential computing is the missing layer.
Read essay →Follow the Data: Five Questions That Make Security Architecture Clearer
Five questions for tracing sensitive data and delegated authority through any security architecture, from payments to AI agents.
Read essay →The Weakest Link in AI: Hardening MCP Servers with Confidential Computing
MCP servers aggregate high-value credentials behind a weak trust boundary. TEEs can protect them with memory isolation and measured identity.
Read essay →Continue the conversation
Working on a hard trust problem?
I enjoy comparing notes with people building secure cloud, AI, payments, and products where trust has to be earned.