VMWARE TANZU ADDS AN AI-READY, DENY-BY-DEFAULT AGENT DATA PLANE INSIDE VCF
Broadcom put guardrails and data plumbing for agentic AI directly into VMware Tanzu Platform on VMware Cloud Foundation. Announced at VMware Explore, Tanzu’s u...
Broadcom put guardrails and data plumbing for agentic AI directly into VMware Tanzu Platform on VMware Cloud Foundation.
Announced at VMware Explore, Tanzu’s update processes structured and unstructured data in a private cloud, adds agent sandboxes with deny-by-default containment, and ships an out‑of‑the‑box developer harness plus a curated marketplace of vetted models, data products, and MCP servers InfoWorld.
This aligns with a governance‑by‑design approach—encode policy as runtime controls across identity, data boundaries, and lineage so agents operate within rules every day under change InfoWorld. Open efforts like TrustControls.ai map agentic controls to ISO/NIST, helping teams extend existing programs instead of starting over WebProNews.
For teams hardening learned state and provenance, Agentic QE v3.14.0 adds fail‑closed admission, embedding‑space provenance, and instruction lineage to reduce unauthorized state mutation GitHub.
If you already run VCF, this puts agent data access and enforcement where your ops and controls live.
Deny-by-default sandboxes and curated MCP/tooling reduce data leaks, tool abuse, and compliance risk.
-
terminal
Spin up a small agent in Tanzu; attempt prompt- or tool-based egress and confirm sandbox blocks, logs, and isolates credentials end-to-end.
-
terminal
Evaluate the curated MCP servers: wire one tool into a simple workflow and validate policy checks, lineage capture, and rollback paths.
Legacy codebase integration strategies...
- 01.
Map Tanzu agent policies to your existing ISO/NIST control set; extend with TrustControls-style controls without re-auditing the world.
- 02.
Keep data local: migrate existing RAG indexes and feature stores into the private-cloud path and enforce outbound deny-all by default.
Fresh architecture paradigms...
- 01.
Start with decision rights outside the model: encode roles, scopes, and tool limits as runtime checks before any tool or write.
- 02.
Adopt the marketplace’s vetted models/MCP servers to standardize identity, logging, and least-privilege from day one.
Get daily MODEL-CONTEXT-PROTOCOL-MCP + SDLC updates.
- Practical tactics you can ship tomorrow
- Tooling, workflows, and architecture notes
- One short email each weekday