Agentic AI security layers put controls around runtime, network and tools

Agentic AI security layers need to address more than a model’s output once software can invoke tools, change data, trigger workflows and communicate across enterprise systems. A Nutanix-sponsored explainer proposes three responsibility areas, infrastructure, network and control plane, while Nutanix has separately been rolling out its Agent Gateway product for governing agent access.

The distinction matters because autonomous agents carry permissions into systems where a bad action has operational consequences. Microsoft says that as agents gain autonomy, errors can spread more quickly, affect more systems and become harder to reverse. Its list of relevant threats includes agent hijacking, intent breaking, sensitive-data leakage and supply-chain compromise.

Nutanix’s three-layer model is a vendor framework, not a settled industry taxonomy. Microsoft uses four layers: model, safety system, application and positioning. AWS uses infrastructure, identity and data, and AI application. The shared premise is that a content filter or prompt guardrail cannot replace controls on an agent’s runtime, its network routes and its authority to call a tool or access data.

What are the three agentic AI security layers?

• Infrastructure: Nutanix places trust in the environment where the agent runs at the bottom of the stack. The sponsored explainer points to hardware-rooted controls such as platform attestation, confidential computing and secure boot. Its stated aim is to verify the execution environment and reduce exposure to runtime or model tampering, supply-chain compromise and unauthorized workload access.
• Network: Agents communicating with APIs, other agents, applications and data sources create east-west traffic that can be difficult to track. Nutanix argues that agents should have distinct network identities, with default-deny access, zero-trust segmentation and dynamically enforced policies to restrict connections and help contain lateral movement or data exfiltration.
• Control plane: This is the central policy point for permissions, tool and model access, resource consumption, runtime visibility and audit records. In Nutanix’s framing, it is intended to address privilege misuse, unapproved tool use, leakage and agents caught in token-consuming loops.

For operators, the useful test is at the action boundary: can the system establish which agent made a request, whether its network path is allowed, whether the requested tool or dataset is explicitly permitted, and whether the decision is recorded? That is a responsibility map across complementary controls, not a claim that any one product can secure an autonomous system.

Microsoft recommends starting agents with no permissions by default, explicitly authorizing tool calls, data access and external integrations, and limiting capabilities to a task or, if necessary, a period of time. It also recommends deterministic human approval for consequential actions rather than leaving escalation to the model’s probabilistic judgment. That approach fits the broader view that enterprise security is a program, not a product.

Nutanix said Agent Gateway became generally available in May as part of Enterprise AI 2.7. On Aug. 26, the company said Enterprise AI 2.8 included a generally available Model Context Protocol gateway for governing how agents connect to applications and data. Nutanix describes the gateway as providing centralized policy enforcement, usage visibility, audit logging and token controls. The supplied sponsored explainer presents Agent Gateway as designed to provide governance and cost-control capabilities; it is not independent validation of product effectiveness.

This story draws on original reporting from VentureBeat.