Multi-Layered Security Architecture for the AI Agent Era

As more enterprises integrate autonomous AI agents into their systems, there is growing recognition that application-layer security alone is insufficient. Oscar Wallberg, Senior Director of Product Management at Nutanix, points out that even with guardrails to block malicious prompts, agents cannot be prevented from making wrong judgments that delete databases or leak confidential data through misused credentials. This is a fundamental challenge when transitioning agents from experimental phases to production environments.

An AI agent is software capable of assessing situations independently and executing processes across multiple systems without constant human instruction. While convenient, once granted execution authority within a data center, the scope of its actions becomes broad and complex. The traditional "defend the perimeter" mindset cannot comprehensively address risks that agents may create internally. Against this backdrop, the concept of multi-layered defense (defense-in-depth) spanning infrastructure, storage, compute, network, and control plane is receiving renewed attention.

Wallberg's proposed architecture consists of three major layers. The first is the infrastructure layer, whose primary role is establishing a trust foundation by answering "which agents are running in the environment." Technologies such as platform attestation, confidential computing, and secure boot provide trust anchors at the hardware level. The goal is to create a state where the system can verify whether an operation request actually comes from a legitimate agent.

The second layer is the network layer, which manages communication paths when agents interact with other agents, APIs, and internal systems. As multiple agents operate simultaneously, communication complexity increases rapidly, necessitating strict definition of which paths and types of communication are permitted. The third layer is the control plane, which spans both infrastructure and network layers and manages overall policy. By having each layer address distinct risk categories, the architecture eliminates security gaps rather than duplicating controls.

At the core of this design philosophy lies the zero-trust principle: "trust nothing by default." All access is restricted until an agent is verified as legitimate, and only minimal necessary privileges are granted thereafter. Wallberg emphasizes that no single security product or single vendor can realize such multi-layered defense alone; multiple technologies and products must work in concert to be effective.

AI agent security design is transitioning from the traditional thinking of "preventing intrusion" to "controlling internal actions." As the scope of information agents handle and operations they can execute expand in production environments, the risks of operating without clear allocation of risks across layers increase. Particularly in regulated industries such as finance, it becomes essential to physically and logically separate AI workloads from other systems and establish mechanisms that prevent agents from operating outside their assigned scope. The movement to translate multi-layered defense principles into concrete implementation strategies within the context of the AI agent era is positioning itself as an important discussion point in future enterprise security architecture design.