Broadcom has introduced AgentMinder, a security and governance solution designed to control AI agents as they interact with enterprise applications and data. The system verifies the agent’s identity, its stated goal, and the context of each operation before authorizing access to a tool or resource. The company announced general availability during VMware Explore 2026 and says it already uses the technology internally at large scale.
The key facts about Broadcom AgentMinder in 30 seconds
- AgentMinder controls what AI agents do while they’re running, not just their initial permissions.
- Each agent has an identity, a mission, approved tools, and authorized resources.
- A gateway checks every call before letting it reach the corresponding enterprise system.
- Traceability is built on OpenTelemetry and logs sessions and actions for auditing.
- Broadcom says its internal deployment handles close to 43 million API calls a day.
The problem AgentMinder tries to solve shows up once an AI assistant stops simply answering questions. An agent can query a database, modify information, call APIs, run tools, or complete a multi-step business process.
In that scenario, knowing who kicked off the operation is no longer enough.
An authorized person can ask an agent to carry out a legitimate task, but during execution the system might try to access information it doesn’t need, pick the wrong tool, or take an action that goes beyond the original goal. There’s also the risk that manipulated instructions alter its behavior.
AgentMinder inserts controls precisely between the agent and the resources it’s trying to use.
Identity and purpose before granting access
Traditional identity and access management systems have mainly been built around people, applications, and services.
A user logs in and gets certain permissions. An application uses a service identity. Policies then determine which resources each identity can view or modify.
Agents add another variable: they can dynamically decide which steps to take to reach a goal.
Broadcom’s argument is that identifying the agent is no longer enough. What it’s trying to do also needs to be known.
AgentMinder assigns each agent an enterprise identity and ties its authority to a declared mission, a set of allowed intents, approved tools, and authorized resources.
That way, a request can be evaluated based on both identity and the purpose of the action.
For example, an agent authorized to look up financial information in order to prepare a report shouldn’t automatically be allowed to modify accounting records just because it has access to the same system.
The policy can take that difference into account before the operation runs.
This approach introduces a more dynamic authorization layer than traditional static permissions.
Every tool call goes through a runtime check
The core piece of AgentMinder is a cloud-native gateway sitting between agents and the tools or services they want to use.
When an agent makes a call, the system authenticates its credentials and evaluates the request through a dynamic policy engine.
The decision can factor in identity, intent, context, and risk level before routing traffic to the authorized resource.
So the check doesn’t happen only when the agent’s session starts.
It repeats throughout execution.
That detail matters especially in long-running processes. An agent might start out performing a perfectly valid operation and, several steps later, try to use a different tool or access data that falls outside its mission.
AgentMinder aims to evaluate each of those transitions.
Broadcom describes this capability as continuous authorization, as opposed to a model where credentials are granted at the start and every subsequent decision the agent makes is then trusted.
The architecture also doesn’t force all traffic through a single external SaaS service, according to the company.
AgentMinder can be deployed alongside large language models (LLMs), whether on-premises, in virtual private clouds (VPCs), or in public cloud environments.
Broadcom also uses the AuthZEN standard to integrate with existing authorization systems and reuse policy enforcement points that are already in place.
Knowing what an agent did will matter as much as knowing who ran it
The second big issue is traceability.
When a person carries out a sensitive operation, companies typically log who accessed it, when, and what changes were made.
With AI agents, that trail can get considerably more complex.
A human request can kick off an agent. That agent can use several tools and hand off certain tasks to other agents or specialized capabilities before producing the final result.
Reconstructing that process afterward requires keeping a chain of information across every one of those steps.
AgentMinder includes an observability layer built on OpenTelemetry, the open project used to collect traces, metrics, and logs in distributed systems.
Broadcom says this layer provides visibility into every agent session and action, with capabilities geared toward auditing, anomaly detection, and operational monitoring.
The company uses the term chain of custody to describe the ability to reconstruct interactions between developers, agents, and the different capabilities used during an operation.
That can be especially important in departments subject to internal or regulatory controls.
Finance, human resources, and IT are precisely some of the highest-risk scenarios Broadcom mentions.
If an agent modifies information in one of those systems, an organization needs to be able to determine which request kicked off the process, which identity it used, which tools it queried, and which policies authorized each action.
The risk changes once AI can take action
The guardrails typically built around generative models tend to focus on inputs and outputs: blocking certain instructions, filtering sensitive information, or avoiding responses considered unsafe.
But an agent introduces a different surface.
The problem is no longer just what the model says, but what it can do after making a decision.
An agent with access to email, databases, HR systems, code repositories, or cloud infrastructure can trigger real changes.
A malicious instruction can also arrive indirectly.
A document, a web page, or a message processed by the agent could contain instructions designed to alter its behavior. Prompt injection techniques are especially relevant when the model has access to tools that can execute external operations.
An independent authorization system provides a second barrier: even if the model decides to take an action, it still has to clear the policies enforced at runtime.
AgentMinder doesn’t eliminate risks such as prompt injection on its own, nor does it guarantee an agent will always make correct decisions. Its role is to limit the consequences through identity, policy, continuous authorization, and traceability.
Broadcom says it already runs it across millions of identities
Broadcom isn’t positioning AgentMinder purely as a product built for third parties.
The company says it uses it for its own AI agent infrastructure.
According to figures shared during VMware Explore 2026, the architecture runs across multiple regions in an active-active design and supports peaks of close to 36 million customer-related API calls a day and another 7 million tied to employees.
That works out to close to 43 million API calls a day at the levels the company has reported.
Broadcom also says the system provides connections for more than 20 million customer identities and 72,000 employee identities.
These are figures the company itself has provided about its internal deployment, not an independent assessment of AgentMinder’s performance.
The architecture can be deployed on VMware vSphere Kubernetes Service (VKS), Google Cloud Platform, and other standards-compatible Kubernetes platforms.
Broadcom also says its multi-region setup keeps the service running through maintenance and updates. The company describes zero downtime in its own deployment, a claim likewise based on its internal experience.
Governing agents could become a new layer of enterprise security
AgentMinder’s arrival reflects a problem that will likely keep growing as companies let agents do more.
Organizations already have tools to manage human identities, privileged accounts, applications, devices, and services. Agents introduce a different kind of identity, because their behavior can vary depending on the goal, the context, and the information they receive during a task.
Granting them broad permissions so they can handle any situation simplifies development, but it raises risk.
Restricting them too much lowers that risk, but it can also stop them from completing the processes they were built for.
Intent-based authorization tries to find a middle ground: determining not just which agent is requesting access, but what it needs to use it for at that moment.
IDC, in a report cited by Broadcom, points precisely to the need for unified governance, continuous authorization, and real-time telemetry so that agent actions can be observed, attributed, and rolled back.
AgentMinder is Broadcom’s commercial answer to that need, though it remains to be seen how it performs with different models, tools, and enterprise architectures outside the company’s own environment — an open question the wider push for shared, open defenses for AI agents is also trying to answer.
There’s also an important question left open: security policy still needs to be defined by humans.
An engine can automatically check millions of operations, but someone still has to decide which missions are allowed, which tools each agent can use, which data falls outside its limits, and when an action needs extra approval.
Automation increases the speed at which those decisions are enforced; it doesn’t remove the need to make them.
AgentMinder has been generally available since August 31, 2026. Broadcom positions it as a layer independent of the model and of where it runs, a feature especially relevant for companies combining local AI, private cloud, and public cloud services — the same private AI cloud push Broadcom has been building around VMware Cloud Foundation.
Enterprise AI security is therefore starting to extend beyond protecting models and data. As agents gain the ability to carry out real tasks, the focus shifts to a much more operational question: what each agent is authorized to do at any given moment, and how that can later be proven.
Frequently asked questions
What is Broadcom AgentMinder?
AgentMinder is a solution for governing and controlling AI agents. It verifies their identity, intent, context, and permissions before authorizing actions on enterprise tools and resources.
Does AgentMinder only work with VMware?
No. Broadcom says it can be deployed on VMware vSphere Kubernetes Service, Google Cloud Platform, and other compatible Kubernetes platforms, alongside models running on-premises, in a VPC, or in the public cloud.
What’s the difference between AgentMinder and a model’s guardrails?
Guardrails mainly control a model’s inputs and outputs. AgentMinder focuses on the actions an agent tries to carry out against enterprise tools and systems, and enforces policies during execution.
Is Broadcom AgentMinder available yet?
Yes. Broadcom announced general availability on 08/31/2026 during VMware Explore 2026.
