Running Solo.io Enterprise agentgateway and Kagent on VMware Cloud Foundation

Running AI Agents as Governed Enterprise Infrastructure

The Challenge: Agentic AI Governance

AI agents have moved past answering questions. They call tools, query databases, run code, and hand work to other agents without a person in the loop. The controls that enterprises built for traditional software do not extend to this behavior. An API gateway has no concept of agent identity. It’s not usually clearly scoped in agentic AI, which tools an agent may call or which other agents it may reach. In most cases, it’s hard to understand what an agent did, under whose authority, and why.

The gap grows as agent deployments scale. An agent with open tool access inside the corporate network is a new attack surface, and the perimeter controls most organizations rely on were not built to close it. At the same time, inference spend across models and business units is difficult to measure and harder to cap. Before agents can move into production, they need three things that no single existing tool provides: verifiable identity, permissions bound by policy, and a complete audit trail. Regulated industries treat these as conditions of deployment, not enhancements.

The Solution

We are happy to announce the validation of Solo.io Enterprise for agentgateway and Solo.io Enterprise for kagent, on VMware Cloud Foundation (VCF) by Broadcom and Solo.io. The validated solution gives agents these controls while keeping every model call, tool invocation, and policy decision inside the customer’s own infrastructure.

Solo.io Enterprise for agentgateway is an AI-native gateway that governs the traffic agents produce. Written in Rust and donated to the Agentic AI Foundation, it handles three classes of traffic from one control plane: LLM requests across on-premises and cloud models through a single endpoint, Model Context Protocol (MCP) tool access with per-tool authorization, and Agent-to-Agent (A2A) communication between services. It adds token-level cost attribution, budget enforcement, OAuth-based tool access, and audit trails, without the client changes a conventional proxy would require.

Solo.io Enterprise for kagent is the Kubernetes-native runtime for the agents themselves. Where agentgateway governs traffic to and between agents, kagent governs their identity, lifecycle, and behavior. Agents are declared as versioned Kubernetes resources, deployed through the same configuration workflows a platform team already runs, and tracked in Git. It ships with human-in-the-loop approval, policy management, and built-in agents for Kubernetes operations, Helm release management, and gateway administration. kagent is a CNCF Sandbox project with contributions from Google, Microsoft, IBM, and Amazon.

Together the two products supply what agents in production require: kagent gives each agent a managed identity and lifecycle, and agentgateway enforces what that identity is allowed to do at runtime. On VCF with VMware vSphere Kubernetes Service (VKS), both run entirely on the customer’s infrastructure. There is no external cloud dependency and no third-party governance plane. Nothing leaves the corporate perimeter.

What the Combined Solution Delivers

• One endpoint for every model. A single standard API routes requests across on-premises models and cloud providers such as Gemini, OpenAI, and Anthropic. Routing follows the model named in the request, so teams add, switch, or retire a provider without touching client code.

• Cost visible and enforced at the source. Every request captures prompt and completion token counts and exports them over OpenTelemetry to the Solo Enterprise dashboard, broken down by model, route, and team. Token budgets apply gateway-wide and per consumer, enforced before the upstream model is contacted. A spent budget rejects the request outright, consuming no tokens and incurring no provider charge.

• Agents with bounded permissions. kagent assigns each agent an identity and declared scope; agentgateway enforces per-tool MCP policies and A2A rules at runtime. An agent granted read access to a tool cannot write to it, and communication between agents follows deny-by-default policy. Both are logged.

• Lifecycle managed like any other workload. Agents are declared, deployed, updated, and removed through Kubernetes resources tied into VCF’s identity and RBAC. The full chain, from agent to tool call, is auditable, and built-in agents cover common platform operations out of the box.

• A complete on-premises record. Traces, token metrics, tool calls, and policy decisions are stored and queryable inside VCF, giving security and compliance teams the same visibility over agents that they hold over any production service.

Why VCF and Solo.io?

VCF is the established platform for enterprise private cloud, with the compute, storage, and networking consistency that large organizations run production workloads on. Solo.io adds the layer that makes agents ready for that platform: managed identity and lifecycle from kagent, and traffic governance, cost control, and audit from agentgateway.

The result is coherent rather than bolted together. Agents get identity and permissions on the same infrastructure that already runs the enterprise’s critical services, governed by the workflows and controls teams use today. Organizations gain a path to production AI that their security, compliance, and finance functions can sign off on.

The key capabilities validated are: multi-LLM routing across on-premises and cloud backends, token attribution and rate limiting, MCP per-tool scope enforcement, A2A governance, and kagent CRD-based agent lifecycle management. A joint technical reference architecture and deployment guide are in development.

Business Benefits

Agents become governed infrastructure, not ungoverned processes. kagent brings agents under managed identity and lifecycle; agentgateway scopes and logs every action they take. The two close the governance gap end to end — identity, permission, and audit — so security teams can approve agent deployments on the same terms as any other workload.

AI stays inside the perimeter. Agent runtime, traffic governance, policies, and audit logs all run within VCF. No sensitive data or telemetry is sent to an external service. For financial services, healthcare, and government, this is what makes production AI viable rather than a pilot.

Inference cost is controlled before it is incurred. Usage is attributed to the team, project, or key that generated it and capped at the gateway before a provider bills for it. Platform teams produce accurate charge backs and enforce per-team limits without reconciling cloud invoices after the fact.

No new operating model. The stack does not introduce a separate management plane or a new discipline for operators. Agents run as workloads inside VCF, under the same access controls, observability pipelines, and change management already in place. Solo.io reports the gateway delivers markedly lower latency and higher throughput than legacy proxies, so the added governance does not come at the cost of performance.

A few potential use cases are as follows:

Industry	Scenario	Outcome
Platform Engineering	Agents automate infrastructure operations and release management across VCF clusters	Agent lifecycle declared in Git; every tool call scoped, logged, and traceable to a team
Financial Services	Research teams query on-premises models for IP-sensitive work while general queries route to cloud	Sensitive data stays in VCF; hybrid routing governed by one policy from a single control plane
Enterprise IT	Multiple business units share a common cloud LLM quota	Per-team token budgets enforced at the gateway; overruns blocked before they reach the provider
Security and Compliance	Teams require a bounded, auditable record of every agent and tool interaction	A2A and MCP policies enforced at runtime; non-compliant calls rejected with a full trace, all logged on-premises

To deploy Solo.io agentgateway and kagent on VCF, contact the Broadcom Team or reach Solo.io at solo.io.