Agentic AI security needs three layers, not one

Enterprises moving autonomous agents from pilots to production face a category of risk that single-layer security controls were never built to contain. A guardrail that catches a malicious prompt won't stop a hallucinating agent from misusing a credential to delete databases or leak sensitive data. Nutanix's proposed defense-in-depth architecture for autonomous agents addresses this by splitting security responsibilities across three distinct layers: infrastructure, network, and control plane. Each layer handles a different risk category, and no single vendor or control can cover all of them alone.

The three layers of agentic AI security

The infrastructure layer establishes a root of trust by answering who is operating in the environment. It relies on hardware-rooted trust, platform attestation, confidential computing, and secure boot to verify that an agent request comes from a legitimate source, not an impersonator. For regulated industries, this layer isolates AI production workloads so neither the agent nor the environment can operate outside its assigned scope.

The network layer governs lateral movement and data exfiltration. Once agents start communicating with APIs, other agents, and enterprise systems, they generate east-west traffic that static firewall rules can't manage. Nutanix advocates treating AI agents as a new class of network identity and using dynamic policy enforcement with zero-trust segmentation. Its Agent Gateway, integrated with Cisco Secure AI Factory and Nutanix Flow for micro-segmentation, gates which agents can talk to which data sources.

The control plane is the centralized governance layer. It provides a single point for managing agent permissions, tool access, resource consumption, and runtime visibility. Agent Gateway acts as a universal endpoint for different models and MCP tools, letting IT teams observe, audit, and control access from one place. This layer enforces token budgets to prevent runaway agents from burning through model calls in runtime loops.

Why a single security model fails

The biggest architectural mistake is assuming one security model can stretch across every layer. Oscar Wahlberg, senior director of product management at Nutanix, explains that teams might secure model output but miss data leakage between agents, or secure the network but lack control-plane visibility into token consumption. A model-level guardrail does nothing to stop a hallucinating agent from misusing a legitimate credential. Defense-in-depth depends on all three layers working together.

What this means for AI builders

If you're deploying autonomous agents in enterprise environments, you need to plan for hardware-rooted trust, network segmentation, and a governance plane from day one. The control plane is the most underestimated layer. Wahlberg points out that a true control plane extends beyond initial deployment to simplify Day 2 operations, giving IT teams continuous observability and strict token governance. For builders, this means either integrating with platforms like Nutanix Agent Gateway or building equivalent capabilities for multi-vendor agent deployments. Without a centralized governance layer, scaling from a handful of agents to thousands will create blind spots in privilege misuse, data leakage, and cost overruns.

Caveats and open questions

This analysis is based on Nutanix's sponsored content, so independent validation of the architecture's effectiveness across different environments is limited. The article does not detail deployment costs, performance overhead, or how the approach compares to alternative agent security frameworks. The integration with Cisco and Intel is described at a high level, and cross-vendor applicability beyond that ecosystem remains unverified. Teams evaluating this approach should seek additional sources and test against their own infrastructure constraints.