<-- Back to All News

From Infrastructure to Agents: A Hands-on Guide to Secure Private AI with Broadcom – Part 4

Publish Date: November 2, 2026
Executive Overview

The strategic cybersecurity agenda for enterprise private cloud infrastructure has arrived at a critical operational reckoning: the transition from conversational large language model (LLM) inference to autonomous agentic artificial intelligence systems. Over the past twelve to eighteen months, enterprise software engineering and platform teams across global software-defined data centers have moved rapidly beyond simple prompt-response interactions. Organizations are now deploying autonomous software agents capable of dynamic multi-turn reasoning, procedural task decomposition, persistent memory retrieval, and autonomous programmatic tool execution against production enterprise infrastructure. While agentic loops unlock unprecedented levels of business process automation, they simultaneously dissolve the foundational security and governance assumptions upon which enterprise IT controls were historically constructed.

Historically, securing data center applications relied heavily on network-layer micro-segmentation, transport encryption, and static identity boundaries. However, in an agentic computing paradigm, an authenticated, authorized agent communicating over an encrypted Mutual TLS (mTLS) session can send a syntactically valid API request that nonetheless exceeds its organizational responsibility. Because autonomous agents utilize the Model Context Protocol (MCP) to discover and invoke application programming interfaces (APIs), granting an agent access to a broad infrastructure endpoint—such as VMware Cloud Foundation (VCF)—exposes thousands of API operations. If an agent designed solely to count virtual machines is granted access to an unsegmented infrastructure doorway, subtle prompt injection, goal hijacking, or model hallucination can cause the agent to invoke destructive APIs, such as altering virtual network switches, dropping firewall rules, or deleting storage volumes. Furthermore, allowing autonomous agents to ingest, process, and retain sensitive employee records, credentials, or Personally Identifiable Information (PII) during multi-turn reasoning loops introduces catastrophic data privacy compliance violations under frameworks such as GDPR, HIPAA, and the EU AI Act.

This technical infrastructure advisory delivers an exhaustive operational and architectural evaluation of the hands-on engineering deployment guide published by Niran Evenchen and William Arroyo from the VMware Cloud Foundation Division at Broadcom. As the fourth and concluding installment of the authoritative series on securing Private AI—succeeding Part 1 on compute tenancy and isolation, Part 2 on VMware vDefend micro-segmentation, and Part 3 on VMware Avi Web Application Firewall (WAF) and Istio service mesh encryption—this advisory examines how platform engineering and security operations (SecOps) teams can govern the agentic loop. By analyzing the integration of Tanzu Platform with AgentMinder running on VMware vSphere Kubernetes Service (VKS), this report deconstructs the three foundational controls of agentic governance: Bind (catalog-governed service attachment via VCAP_SERVICES), Grant (runtime intent-based tool authorization via sidecars and gateways), and Scrub (inline PII and sensitive data redaction on the model path via Tanzu AI Services). This advisory equips enterprise technology leadership with an actionable framework to constrain autonomous agentic behavior, eliminate tool-calling privilege escalation, and establish deterministic zero-trust governance over enterprise private AI.

Features

The technical capabilities articulated in Broadcom’s guidance establish an integrated, multi-tiered agentic governance framework within VMware Cloud Foundation engineered to decouple service connectivity from tool authorization, enforce runtime containment, and sanitize data paths across the autonomous agent lifecycle.

  • The Structural Anatomy of the Agentic Loop: The architecture deconstructs the core dependencies required to sustain an autonomous agentic loop, identifying the explicit governance requirements across each operational domain:

    • Skills and Instructions: Procedures, system prompts, and guidance governing how the agent approaches a task, requiring strict change-management governance over who can modify system prompts.
    • Memory: Previous context, conversation logs, task history, and persistent facts, requiring granular read, retain, and update permissions to prevent context poisoning.
    • Large Language Model (LLM): The reasoning, tool-selection, and output-synthesis engine, requiring strict governance over which model service the agent is permitted to query.
    • Tools via Model Context Protocol (MCP): The active operational doorway providing the agent with programmatic access to external systems, data repositories, and action APIs, requiring granular authorization over which specific operations may be invoked.

  • Model Context Protocol (MCP) Architectural Mechanics: Model Context Protocol (MCP) functions as an open-standard API doorway that allows an agent to discover and invoke external tools without hardcoding custom API clients:

    • Dynamic Tool Discovery (tools/list): The agent queries the MCP server to retrieve available tool definitions, semantic descriptions, and JSON schema input argument specifications.
    • Programmatic Tool Execution (tools/call): The agent selects an appropriate tool, formats the required parameters, and transmits the execution directive to the MCP server, which executes the underlying API or CLI operation against target infrastructure.
    • Token and Efficiency Optimization: In an environment like VCF with thousands of discrete API calls, providing an agent with a raw command-line shell forces it into a slow, error-prone trial-and-error discovery loop that consumes excessive tokens. An MCP server wraps underlying commands into a focused catalog of 8 to 10 curated tools, dramatically shrinking token consumption and execution latency while establishing an explicit boundary where authorization policies can be enforced.

  • Dual MCP Path Architecture with Comparative Enforcement: To demonstrate the absolute necessity of runtime intent authorization, the lab deploys an agent on Tanzu Platform with two divergent tool-calling pathways:

    • Un-Governed Direct Path (Kubernetes MCP): The agent connects directly to an unmanaged Kubernetes MCP server. On this path, zero intermediate intent enforcement exists; any tool presented by the MCP server can be invoked by the agent, constrained only by the static service account credentials assigned to the MCP server.
    • Governed Path (VCF MCP via AgentMinder): The agent connects to a local AgentMinder sidecar proxy (listening on 127.0.0.1:8181), which routes traffic through an AgentMinder gateway running on a VKS cluster before reaching the VCF MCP server. On this path, an independent, runtime authorization decision is evaluated for every tool execution request.

  • Runtime Containment and Immutable Buildpack Architecture: Governance begins at the container operating system layer. To prevent an autonomous agent from compiling unauthorized code or executing local shell commands, Tanzu buildpacks assemble a minimal, stripped-down container runtime:

    • Unneeded shells, compilers, administrative utilities, and package managers are stripped from the container filesystem.
    • The agent application is compiled and deployed as an immutable container artifact (cf push), ensuring that updates must traverse a verified CI/CD pipeline rather than modifying a running container.
    • Local system privileges, file paths, and environment variables are locked, ensuring the agent cannot execute unauthorized actions locally.

  • Deny-by-Default Network Micro-Segmentation: Extending the zero-trust network baselines established in prior series installments, VMware vDefend Distributed Firewall (DFW) enforces strict Layer 4 micro-segmentation at the hypervisor vNIC layer. The agent container is blocked from general routing into corporate subnets or management networks. The agent is permitted to communicate strictly with its bound private LLM service, the local AgentMinder sidecar, and the designated ingress gateway front-ended by VMware Avi WAF.


  • The First Control: Bind (Service Connectivity via Tanzu Marketplace): Platform engineering teams govern which services an agent can physically connect to using the Tanzu Platform Marketplace:

    • Upfront Service Curation: Administrators publish approved, vetted service instances in the self-service catalog, preventing developers from attaching unapproved models or unvetted MCP servers.
    • Service Binding Execution: Operators bind services declaratively via the Tanzu CLI (cf bind-service infrademo-agent private-ai-llm and cf bind-service infrademo-agent sc-infrademo-vcf).
    • In-Memory Credential Injection: The binding injects service endpoints, cryptographic tokens, and credentials dynamically into the container’s VCAP_SERVICES environment variable at runtime. No secrets or connection strings are ever hardcoded in application source code.
    • Operational Boundary: The Bind control establishes network and credential connectivity; it provides the address of the doorway, but does not grant permission to walk through specific operational doors.

  • The Second Control: Grant (Intent-Based Runtime Authorization via AgentMinder): To prevent an agent from invoking every tool exposed by an MCP server, AgentMinder introduces the concept of Intents:

    • Decoupling Tools into Intents: Platform engineers group granular MCP tools into domain-specific operational bundles termed “Intents.” For example, virtual machine inventory tools (list_vms, get_vm_status) are assigned to a “VM Management” intent, while network configuration tools (modify_vswitch, alter_firewall) are assigned to a separate “Network Management” intent.
    • Explicit Grant Assignment: An agent identity must be explicitly issued a Grant within the AgentMinder administration console to execute a specific intent.
    • Runtime Policy Enforcement: When an agent attempts to execute a tool, the request hits the local sidecar proxy and passes to the AgentMinder gateway. The gateway validates the agent’s cryptographic identity against active grants. If an agent with a “VM Management” grant attempts to invoke a network modification tool, the gateway blocks the request at runtime, returning an authorization failure to the agent.
    • Immunity to Prompt Injection: The “Intent” is an immutable platform-level authorization object configured by human platform administrators. An agent cannot grant itself intents through internal prompt reasoning, recursive reflection, or adversarial user prompt injection.

  • The Third Control: Scrub (Inline Sensitive Data Redaction on the Model Path): To prevent sensitive data from leaking into foundation models or persistent context stores, the architecture operationalizes inline data scrubbing:

    • Model Path Webhook Interception: Tanzu AI Services deploys an inline inspection webhook on the model interaction path between the agent and the private LLM.
    • Automated PII Redaction: Incoming prompts and outgoing model payloads are scanned in real time for sensitive content—including Social Security numbers, credit card data, API keys, and corporate secrets.
    • Inline Masking: Sensitive strings are scrubbed and replaced with deterministic cryptographic tokens before the payload reaches the model inference server. The model reasons over the masked data, and responses are de-tokenized on the return path, ensuring that sensitive data is never ingested, logged, or retained within the model’s transient context window.
Benefits

Deploying the tripartite agentic loop governance model—Bind, Grant, and Scrub—within VMware Cloud Foundation delivers measurable strategic, security, operational, and regulatory advantages over unmanaged private AI deployments.

  • Structural Containment of Prompt Injection and Tool Hijacking: In conventional AI agent deployments, compromising an agent through indirect prompt injection grants the adversary access to every tool and API privilege held by the agent’s service account. Layering AgentMinder intent grants on top of MCP connections ensures that an agent’s blast radius is strictly contained to its assigned functional domain. An adversary who successfully hijacks an infrastructure inventory agent cannot weaponize it to alter network configurations, delete storage datastores, or exfiltrate sensitive ledgers, because the underlying gateway enforces deterministic authorization independent of model reasoning.


  • Elimination of Hardcoded Credentials and Secret Sprawl: Traditional application integrations require software developers to manage API keys, database passwords, and service tokens within configuration files or source code repositories. Leveraging Tanzu Platform’s bind-service automation injects connection parameters dynamically via VCAP_SERVICES. Cryptographic credentials are generated on demand, rotated centrally, and scrubbed from container filesystems, preventing credential harvesting from compromised containers.


  • Granular API Surface Reduction across Software-Defined Infrastructure: Exposing thousands of raw VMware Cloud Foundation APIs directly to an autonomous agent creates immense operational instability, token bloat, and security exposure. Wrapping infrastructure capabilities into curated, domain-specific Model Context Protocol tools reduces the operational surface to focused, pre-validated actions. Infrastructure teams maintain absolute visibility over allowable tool calls, while agents operate with deterministic efficiency and lower token costs.


  • Turnkey Data Privacy and Compliance with Global AI Regulations: The European Union AI Act, GDPR, HIPAA, and the Digital Operational Resilience Act (DORA) impose strict legal penalties for unmonitored automated processing of personal data. Enforcing inline PII scrubbing on the model interaction path ensures that sensitive records, customer telemetry, and confidential keys are mathematically redacted before processing. Enterprise organizations satisfy regulatory data privacy mandates while capturing the operational velocity of generative AI automation.


  • True Defense-in-Depth Uniting Infrastructure, Network, and Application Planes: Broadcom’s four-part framework delivers a cohesive, multi-layered private AI security architecture: compute tenancy isolates hardware (Part 1); vDefend isolates network segments (Part 2); Avi WAF and Istio secure application transport (Part 3); and Tanzu with AgentMinder governs agent actions (Part 4). Organizations eliminate point-tool security silos, establishing an unbroken chain of custody from physical host silicon to autonomous agentic reasoning loops.


  • Operational Agility with Developer Self-Service Guardrails: Forcing security teams to manually audit every software agent prompt or script severely throttles digital innovation. The Tanzu Marketplace and AgentMinder intent framework provide self-service autonomy within hard-coded platform guardrails. Application teams can deploy and iterate on autonomous agents rapidly, while platform administrators maintain centralized governance over allowable service bindings, tool intents, and data scrubbing policies.


Use Cases

Global enterprise organizations operating across capital-intensive, data-sensitive, and strictly regulated industry sectors can implement Broadcom’s agentic loop governance architecture to resolve acute operational and security challenges.

  • Sovereign Financial Services Autonomous Core Banking Operations Agent: A global commercial banking consortium deploys autonomous infrastructure agents within a private VCF cloud to monitor transactional clusters, balance compute loads, and triage database performance anomalies:

    • The bank’s platform team packages the agent using Tanzu buildpacks and deploys it to Tanzu Platform on VCF.
    • Using the Tanzu Marketplace, administrators bind the agent to an on-premises Llama 3.1 70B model hosted on VMware Private AI Services, alongside a VCF MCP service mapped to vCenter and NSX APIs.
    • Within AgentMinder, the security team creates two intents: “Read-Only Diagnostics” (tools to inspect host CPU, query VM inventory, and read datastore capacity) and “Infrastructure Remediation” (tools to migrate VMs via vMotion and restart services).
    • The daily operations agent is granted strictly the “Read-Only Diagnostics” intent. When a simulated prompt injection attempt tricks the agent into issuing a command to delete an NSX edge gateway, the AgentMinder gateway intercepts the tool call and blocks execution, logging an alert to corporate SIEM dashboards.
    • The bank automates 70% of routine infrastructure diagnostics, prevents unauthorized configuration sabotage, and maintains complete regulatory compliance under DORA.

  • Sovereign Healthcare Integrated Delivery Network Clinical Documentation and Diagnostic Agent: A nationwide healthcare provider deploys clinical co-pilot agents across eighty regional hospital private clouds to assist physicians with summarizing patient health records and scheduling diagnostic pathology imaging:

    • Patient Electronic Health Records (EHR) containing sensitive Protected Health Information (PHI) are queried by the clinical agent during patient consultations.
    • The agent’s model interaction path is routed through Tanzu AI Services with automated PII scrubbing active.
    • When a physician queries patient history, patient names, Social Security numbers, and home addresses are automatically tokenized and scrubbed before the prompt is transmitted to the local model runtime.
    • The agent utilizes an MCP connection governed by AgentMinder to interface with hospital scheduling databases. The agent is granted an intent allowing it to book laboratory slots, but is denied intents that modify primary patient prescriptions.
    • Hospital emergency rooms maintain uninterrupted diagnostic co-pilot availability, patient data privacy is cryptographically guaranteed, and the healthcare network fulfills federal HIPAA security guidelines.

  • Sovereign Public Sector Administration and Defense Cloud Multi-Agency Intelligence Synthesis: A national defense intelligence agency operates classified intelligence-parsing agents across multi-tenant private clouds running on VCF:

    • Multiple independent departmental agents (such as Maritime Intelligence and Cybersecurity Threat Tracking) run on a shared platform.
    • Platform administrators enforce strict compute tenancy (Part 1) and vDefend East-West micro-segmentation (Part 2) to ensure agents cannot communicate across departmental network boundaries.
    • Ingress traffic is inspected by VMware Avi WAF, and internal communications are encrypted via Istio mTLS (Part 3).
    • Using AgentMinder (Part 4), the Maritime agent is granted intents strictly for naval tracking MCP servers, while the Cyber agent is granted intents strictly for vulnerability scanning MCP servers.
    • Even though both agents share the identical underlying physical GPU cluster and foundational model runtime, AgentMinder prevents cross-domain intelligence traversal, fulfilling strict national defense compartmentalization mandates.

  • Global Digital Retail Platform Autonomous Supply-Chain and Flash Sales Agent Swarms: A major e-commerce conglomerate deploys autonomous agent swarms to monitor inventory levels, negotiate supplier pricing, and adjust product catalog placements during peak seasonal holiday sales:

    • Customer-facing conversational bots interact directly with external shoppers, exposing the platform to massive volumes of adversarial prompt injection attempts.
    • The platform engineering team isolates the customer service bot from internal supply-chain management tools.
    • The internal pricing agent is bound to private PostgreSQL product databases via MCP servers, with AgentMinder enforcing an intent that permits read-only inventory queries and restricts automated price updates to a maximum variance of 5%.
    • Any tool execution attempting to discount products beyond 5% is blocked by the gateway, triggering an automated escalation ticket to human merchandising managers.
    • The digital retailer processes millions of holiday commercial transactions without service interruption, preventing algorithmic pricing manipulation and protecting corporate revenue margins.
Alternatives

A comprehensive infrastructure assessment requires comparing Broadcom’s tripartite agentic loop governance model against alternative enterprise artificial intelligence governance and orchestration methodologies.

  • Un-Governed Direct API Integration (The “Open Shell” Antipattern): In this traditional operational shortcut, software engineering teams connect AI agents directly to enterprise systems by providing the agent with raw administrative credentials, SSH keys, or unrestricted REST API tokens. The agent interacts with the environment through trial-and-error shell execution or unconstrained API calls. While this avoids deploying intermediate governance proxies, it represents a catastrophic security antipattern. Lacking runtime tool gating, any successful prompt injection or model hallucination grants the agent unrestricted authority to delete databases, modify network perimeters, or exfiltrate sensitive files, completely collapsing enterprise security perimeters.


  • Public Cloud Managed Agent Frameworks (AWS Bedrock Agents / Azure AI Studio / Google Vertex AI Agents): In this operational model, organizations build and host autonomous agents entirely within public cloud hyperscaler ecosystems, utilizing proprietary cloud-native agent builders and tool connectors. While public hyperscalers provide rapid Day-0 onboarding, this approach introduces severe long-term financial unpredictability through continuous per-token consumption billing, execution step surcharges, and aggressive data egress fees. More critically, transmitting proprietary enterprise infrastructure topologies, internal database schemas, and confidential records to multi-tenant public cloud networks introduces severe data sovereignty, regulatory compliance (GDPR, HIPAA, DORA), and jurisdictional liabilities for heavily regulated global organizations.


  • DIY In-Code Prompt Guardrails and Software Enclave Scripting (LangChain / LlamaIndex Hardcoding): Under this developer-centric strategy, software squads attempt to enforce agent governance purely through software code—authoring custom system prompts, configuring hardcoded Python if/else checks, or deploying basic open-source guardrail libraries inside the application container. While in-code guardrails require zero platform infrastructure, they represent an exceptionally fragile, easily bypassed defensive posture. Prompt-based guardrails are routinely circumvented through adversarial jailbreaks, multi-turn context manipulation, and linguistic obfuscation. Furthermore, in-code checks fail to provide centralized visibility, lack integration with enterprise identity providers, cannot enforce hypervisor-level network isolation, and force security teams to audit application source code manually.


  • Static Network Perimeter Defense Without Agentic Intent Governance: In this legacy infrastructure approach, organizations attempt to secure AI workloads exclusively using traditional network firewalls and API gateways, assuming that verifying an agent’s IP address, port, and TLS certificate provides sufficient protection. As proven in Broadcom’s research, static network firewalls are structurally blind to agentic intent. An authenticated agent operating over an approved HTTPS connection can execute both benign read operations and destructive write operations against the exact same API endpoint. Without application-layer intent gateways like AgentMinder, network firewalls cannot distinguish between legitimate and malicious tool invocations.


Alternative Perspective

While the capabilities detailed in Broadcom’s guidance on governing the agentic loop deliver an essential enterprise defense baseline, an objective engineering analysis reveals critical operational prerequisites, design complexities, and administrative trade-offs that enterprise technology leadership must evaluate prior to enterprise deployment.

A primary technical consideration centers on the operational complexity and engineering discipline required to design, test, and maintain enterprise-grade Model Context Protocol (MCP) tool catalogs. Transitioning from generic API calls to structured MCP tools is not an automated feature; it requires platform engineering teams to deliberately architect custom MCP servers that wrap complex underlying infrastructure CLIs and APIs into concise, well-defined tools with rigid JSON input schemas. As Broadcom’s authors explicitly note, the VCF MCP catalog grew substantially throughout their lab evaluation as broad commands had to be decomposed into specific, domain-restricted tools. If an organization designs a broad, generic MCP tool that accepts arbitrary API paths or dynamic shell strings—in an attempt to save engineering effort—the intent boundary enforced by AgentMinder becomes impossible to police, reintroducing the exact privilege escalation risks the platform was deployed to eliminate.

Furthermore, platform leadership must examine the latency overhead and throughput impact introduced by serializing requests through multiple intermediate proxies. In the governed VCF pathway, an agent’s tool-calling request must traverse the local container sidecar proxy, route across the network to the AgentMinder gateway running on VKS, undergo cryptographic intent authorization, and forward to the MCP server before executing against the target API. Concurrently, model interactions must route through Tanzu AI Services inline webhooks to execute regular-expression and machine-learning-based PII scrubbing. In high-concurrency enterprise environments where autonomous agent swarms execute thousands of real-time tool calls per minute, these cumulative network hops and inspection algorithms can introduce measurable latency jitter. Platform architects must profile latency-sensitive workloads and allocate sufficient compute resources to AgentMinder gateways and inspection webhooks to prevent governance from becoming an operational bottleneck.

Finally, enterprise leadership must address the organizational adaptation and cross-functional governance required across development, security, and infrastructure teams. In conventional enterprise environments, platform teams govern infrastructure, security teams audit firewalls, and application teams write code. Governing the agentic loop demands continuous collaboration: application developers must define required tools, platform engineers must curate MCP service bindings in the Tanzu Marketplace, and security officers must define and audit AgentMinder intent grants. If corporate leadership does not establish clear governance workflows and cross-functional operational ownership, administrative friction between teams can stall private AI deployments, prompting frustrated application developers to bypass governed platforms in favor of unmanaged shadow AI implementations.

Final Thoughts

The rapid transition of enterprise computing toward autonomous agentic artificial intelligence marks a permanent paradigm shift in data center security architecture. The conventional reliance on network segmentation, transport encryption, and static service account credentials is fundamentally obsolete in an era where software agents dynamically reason, select tools, and execute programmatic actions across enterprise platforms. An authenticated agent operating over an encrypted channel can easily become an existential corporate threat if permitted to interact with infrastructure endpoints without intent-level authorization.

Broadcom’s strategic blueprint for governing the agentic loop—articulated by Niran Evenchen and William Arroyo in the concluding installment of the Secure Private AI series—delivers an authoritative, production-hardened operational model. By combining runtime container containment via Tanzu buildpacks, service binding governance through the Tanzu Marketplace (Bind), fine-grained runtime intent authorization via AgentMinder sidecars and gateways (Grant), and inline PII redaction on the model path (Scrub), VMware Cloud Foundation provides enterprise technology leadership with an empirical, multi-layered execution tier.

To translate these advanced capabilities into sustained enterprise velocity, technology leadership should take immediate, decisive operational steps: audit current private AI initiatives to identify un-governed agentic workflows and direct API integrations; establish an enterprise Model Context Protocol (MCP) catalog that wraps infrastructure capabilities into focused, domain-specific tools; deploy Tanzu Platform on VCF paired with AgentMinder on VMware vSphere Kubernetes Service (VKS); mandate that all agent service connections utilize declarative Tanzu bindings; enforce least-privilege intent grants across all agent identities; and activate inline PII scrubbing across all model interaction paths. By anchoring autonomous artificial intelligence to a governed, secure, and structurally sound private cloud foundation, organizations can eliminate agentic security risks, protect sensitive corporate data, and build an impenetrable operational fabric for continuous enterprise innovation.

Source

From Infrastructure to Agents: A Hands-on Guide to Secure Private AI with Broadcom – Part 4