Nutanix warns that autonomous, agentic AI systems — which can reason, make decisions and act across environments — introduce risks that application-level controls alone cannot contain. Oscar Wahlberg, senior director of product management at Nutanix, argues that treating these risks as a single problem leads to incomplete architectures.
"The guardrails to catch a malicious prompt won't stop an agent from hallucinating and doing something it never should have done, like accidentally deleting databases or leaking sensitive data with a credential it was granted but then uses for something entirely different," Wahlberg says. He identifies this as a central challenge as enterprises move agentic systems from experimentation into production.
Nutanix proposes that once an agentic system is granted execution privileges across a data center, security must scale into a defense-in-depth architecture covering infrastructure, storage, compute, networking and a governing control plane. Each layer should address a distinct category of risk rather than duplicating the same controls across the stack. No single control or vendor can provide complete protection alone; effective defense-in-depth relies on the layers working together.
Dividing responsibilities across the stack and following zero-trust segmentation creates a practical security framework with three layers, each with a specific role.
Infrastructure layer: establishing trust where agents run
The infrastructure layer’s primary responsibility is to establish a root of trust: answer the question who is operating in the environment. That trusted identity is a prerequisite for every higher-level security control. Before an organization can trust an agent’s actions, it must trust the integrity of the environment where the agent executes. When an agent requests permission to perform an operation, the system must be able to verify the request came from the legitimate agent, not an impersonator.
Delivering that assurance depends on hardware-rooted technologies including platform attestation, confidential computing and secure boot, along with controls that prevent unauthorized access within and beyond a server. For regulated industries such as financial services, this layer enables isolation of AI production workloads so neither agent nor environment can operate beyond assigned scope. That mitigates risks like model and runtime tampering, supply-chain compromise and unauthorized access to sensitive AI workloads.
Network layer: governing agent communications
When agents begin communicating with other agents, APIs, applications and enterprise systems, they create concurrency and dynamic interactions that static network configurations were not built to handle. An agent configured to call APIs, query data sources and spin up additional agents without constraints can produce sprawling east-west traffic that becomes hard to reason about; that complexity can mask lateral movement or data exfiltration if appropriate network security layers are absent.
"We should treat AI agents as a new class of network identity, and make sure that an agent can only talk to other agents or data sources where it's explicitly allowed to do so," Wahlberg says. That requires a shift from rigid static rules to dynamic policy enforcement.
Nutanix’s Agent Gateway, part of the Nutanix Agentic AI solution, is presented as a unified, governed layer that provides cost control and governance capabilities for managing autonomous agent users. When agents are grounded in zero-trust segmentation and use capabilities such as Nutanix Flow for micro-segmentation, and when the platform integrates with networking vendors (including integration into the Cisco Secure AI Factory), Agent Gateway helps enterprises govern interactions across agents, models, data sources and enterprise applications.
The network layer governs lateral movement, data exfiltration and gates an agent’s network interactions. A zero-trust framework with default-deny access and scalable interaction monitoring is important because agents can behave unpredictably. Nutanix software integration with Cisco UCS servers and Cisco AI PODs supplies the turnkey physical infrastructure (compute, storage and networking) on which the AI factory runs.
Control plane layer: governing what agents are permitted to do
The control plane is the brain of the operation: a central point for managing agent permissions, tool access, resource consumption and runtime visibility. Wahlberg emphasizes the importance of a single place where policies are enforced consistently rather than recreated for every agent.
"Agent Gateway acts as a universal endpoint for different models and tools, so an IT team can configure their agents to talk to this single control point," he explains.
The centralized AI gateway enables administrators to observe, audit and control access to models as well as MCP tools protecting data and gating privileged access. This layer is designed to mitigate risks such as privilege misuse, runaway agents, unauthorized tool usage, data leakage and excessive model consumption that can occur when agents become stuck in runtime loops and burn tokens. It relies on treating governance as a runtime control system rather than an after-the-fact compliance exercise.
Why one-size-fits-all security fails agentic environments
The largest architectural mistake enterprises make is assuming a single security model can be stretched across every layer of an AI stack. Solving hardware-level trust with application-level software, or relying on static legacy network rules to manage dynamic agents, produces architectures that either block the agentic system from performing or leave critical doors open. One-size-fits-all thinking often results in performance penalties and operational friction.
"By failing to assign specific responsibilities to the appropriate layers, enterprises end up with blind spots in governance," Wahlberg says. For example, an organization might secure a model’s output but miss data leakage between agents, or secure the network but lack control plane visibility and thus fail to see runaway token consumption when agents are stuck in loops.
Focusing solely on the model leaves the largest gaps, because a guardrail that catches a malicious prompt does nothing to stop a hallucinating agent from misusing a legitimate credential. Embedding security across the full stack helps ensure that even when a model-level threat slips past initial filters, the agent remains bounded by hardware-rooted trust, network isolation and access controls at the agent layer.
How Intel, Cisco and Nutanix combine to build defense-in-depth
The three-way partnership illustrates how the layered architecture comes together as an enterprise-grade AI Cloud. Intel provides compute to run agentic workloads and secures the execution environment through hardware-rooted trust and confidential computing while also reducing costs through accelerators. The article cites Intel Xeon 6 processors with built-in AMX for efficient AI inference acceleration without exclusive reliance on GPUs.
Cisco provides a secure fabric that governs communication between agents and enterprise tools, while Nutanix supplies the software platform and central control plane that enforces permissions, delivers visibility and cost governance, and ties the architecture into a defense-in-depth solution that enables enterprises to scale agentic AI.
Wahlberg notes enterprises currently most underestimate the control plane. A true control plane extends beyond initial deployment to simplify Day 2 operations, providing IT teams with continuous observability and strict token governance required to keep autonomous agents secure and cost-effective in production.
"Apart from model and tool selection, governing the agent deployments and their access to models and business tools in a tightly integrated full stack platform will be important for the success of AI projects," he says, pointing to a near future where organizations scale from a handful of use cases to thousands of autonomous agents driving the business.
Technology leaders should prioritize building a centralized governance layer now that can manage agent identities, tool permissions and token budgets in real time, because that control point builds the operational muscle to scale safely.
"You can't build an AI system without getting into a lot of complex decisions," Wahlberg explains. "And you need a control plane that talks across multiple vendors and infrastructures to help you solve for those defense-in-depth strategies."
This article was presented by Nutanix as sponsored content.
