Broadcom has announced VMware Tanzu Platform Agent Foundations: a secure-by-default agentic runtime for autonomous AI applications on VMware Cloud Foundation. The platform offers enterprise developers a ready-to-use PaaS environment for AI agents, featuring zero-trust networking, isolated secrets, and automated infrastructure management.
This agentic runtime will be available as part of Tanzu Platform 10.4 and is built on VMware Cloud Foundation (VCF). The idea is for platform engineers to manage AI agents using the same tools as their other business-critical applications—no separate tooling, no separate team. But that’s also where the challenge lies. AI agents make autonomous decisions and therefore require a different level of governance than traditional workloads.
Security as a Foundation
Tanzu Platform Agent Foundations operates on a deny-by-default model. By default, agents have no access to internal systems or connections to external services unless this is explicitly configured via secure service bindings. Within this framework, three mechanisms are key.
First, the platform uses Buildpacks instead of Dockerfiles to build agent containers. Containers are automatically patched and verified, which reduces the risk of embedded malware. Second, secrets are isolated: agents cannot read each other’s credentials during runtime. Combined with VMware vDefend, this protection also applies to connections to external SaaS services. Third, zero-trust sandboxing limits runaway agent loops via predefined resource limits.
Ready for production via VCF
For developers, the platform offers a quick start via pre-built agents. Through Tanzu Hub, they have access to a curated catalog of AI services, MCP servers, and data engines, including VMware Tanzu for Postgres with pgvector. The infrastructure behind the scenes automatically scales up and down via VCF IaaS APIs. Four layers have been configured for high availability.
A central AI gateway manages the use of both public and private AI models on VCF, including cost management and security filters. Tanzu Platform 10.4 also uses VMware vSphere Kubernetes Service (VKS) to deliver scalable marketplace services.