Tanzu runs AI agents deny-by-default. Steal the pattern
Broadcom's Tanzu Platform Agent Foundations sandboxes agents with a deny-by-default runtime, an external credential store, and regex tool filtering.
Most teams deploy an AI agent the way they deploy a script: give it the environment variables, point it at the API, hope the prompt holds. Broadcom just shipped the opposite default at VMware Explore 2026, and the architecture is worth copying even if you will never buy a VMware license. The phrase to take away is deny-by-default agent runtime.
What actually happened
At Explore on August 31, Broadcom announced Tanzu Platform Agent Foundations — agent hosting on VMware Cloud Foundation built around five pillars. The engineering detail is where it gets interesting.
Agents run in isolated sandboxes with zero access to APIs, networks, MCP servers, or the internet unless explicitly granted. Credentials live in a store positioned outside the sandbox, so a successful prompt injection gets the agent's ability to call a tool, not the secret behind it. Each agent gets its own identity and inherits only the initiating user's permissions, so actions are attributable per agent. An integrated AI Gateway logs tool calls, prompts, and resources accessed into Tanzu Hub, and platform teams can define regex rules to enable or disable specific tools — constraining an agent to a defined path rather than trusting it to stay there.
The Agent Buildpack ships a harness with persistent memory and human-in-the-loop autonomy levels set per action: always deny, always allow, or request before acting. Alongside it Broadcom released AgentMinder, a control plane that treats agents as enterprise identities and authorizes every tool invocation against a declared mission and current context. AgentMinder is generally available now; the Tanzu Platform capabilities are slated for fall 2026, with the Agent Buildpack in technical preview.
Why deny-by-default matters for your business
You can build this on a laptop with Docker and an hour. The pattern has four parts and none of them require a platform team.
Run the agent in a container with no host network and no mounted credentials. Put secrets behind a small local proxy the agent calls by name — it says "charge this customer," the proxy holds the Stripe key. Allowlist the tools explicitly instead of registering every MCP server you have and trimming later. Log every tool call with the agent identity attached, not the human's.
That gives you the same containment property Broadcom is selling: a compromised prompt can only reach what you enumerated. The expensive part of enterprise agent platforms is the console and the compliance reporting. The security property itself is architecture, and architecture is free.
Key takeaways
- Tanzu Platform Agent Foundations sandboxes agents with zero access to networks, APIs, or MCP servers unless explicitly granted
- Credentials sit outside the sandbox, so prompt injection yields tool access, not the secret itself
- Per-agent identity plus AI Gateway logging makes actions attributable; regex tool filtering constrains what an agent can call
- Human-in-the-loop autonomy is set per action: always deny, always allow, or request before acting
- AgentMinder is GA now; Tanzu Platform capabilities land in fall 2026, Agent Buildpack in technical preview
- The containment pattern — no host network, secrets behind a proxy, explicit tool allowlist, per-agent logs — is buildable without any of it
Deny-by-default is an architecture decision, not a product you buy. We build agent runtimes that hold no secrets, call only the tools you enumerated, and log every action under the agent's own identity — on your infrastructure, no platform contract. See how we containerize agents, or send us your agent config for a containment review.
Sources: Broadcom press release, VMware Tanzu blog, Broadcom AgentMinder announcement.
- #ai-agents
- #deny-by-default
- #sandboxing
- #mcp-servers
- #vmware
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Tenable will inspect MCP servers before you run them
Tenable's CyberAgents Exchange AI Inspector reviews community-built agents, skills, and MCP servers using OpenAI cyber models plus human researchers.
Read itRepo-To-Skill: 5,000 skills lifted an agent 134%
A BAAI-led paper distilled 1,000 ML repos into 5,000 verified agent skills. Same model, same harness, 134.3% higher on MLE-bench. Context beat capability.
Read it