Broadcom Just Built the Agent Security Layer I've Been Arguing For. One Hole Is Still Open.

TL;DR: Broadcom shipped AgentMinder at VMware Explore, and it is the strongest mainstream validation yet for pre-action authorization as the way to govern AI agents. It checks every tool call at runtime, binds authority to a declared mission, and runs continuous authorization at roughly 43 million calls a day internally. But the architecture leans on the agent's own declared intent as an authorization signal. A prompt injection does not change who the agent is. It changes what the agent says it is doing. If the policy engine trusts that declaration, the attacker is still in the room, just wearing a clean uniform.

I have spent most of the last year building around a fairly unpopular conviction. You do not secure AI agents by making the model behave better, and you do not secure them by scanning for bad prompts. You secure them by putting a deterministic decision between the agent and the thing it wants to touch, and making that decision before the action lands.

So when Broadcom quietly stood up at VMware Explore 2026 in Las Vegas and announced AgentMinder, a security product whose entire pitch is "verify identity, authorize each action, do it at runtime, trace everything," I had a strange reaction. Not "finally." More like the feeling you get when the large bank down the street finally installs a second lock on the vault door that you have been telling everyone was missing for the past year.

Validation feels good. It is also a trap, because a press release that confirms the category can quietly smuggle in a design assumption that undercuts it.

What Broadcom actually shipped

AgentMinder is, at its core, a cloud-native gateway that sits between AI agents and the enterprise systems they call. Broadcom frames it as a traffic controller for autonomous agents. When an agent makes a request, the gateway does four things before the request reaches a resource: it authenticates the agent's identity, it evaluates the action against the agent's declared mission and intended scope, it factors in context and current risk, and then it decides whether to route the call to an authorized backend.

That is the continuous authorization model. Credentials are not granted once at session start and then trusted for the whole run. Every tool call gets rechecked, because an agent that starts an hour of legitimate work can, several steps in, try to reach a data source that has nothing to do with its mission. Broadcom says its internal deployment runs close to 43 million of these calls a day across customer-facing and workforce pipelines (roughly 36 million and 7 million respectively), on an architecture built on OpenTelemetry so every action carries a chain of custody for audit. The scale matters. This is not a three-person startup showing a demo. This is Broadcom running its own agentic pipeline on the thing.

Read the SiliconANGLE writeup from the show floor and the detail stands out: every time an agent makes a request, AgentMinder enforces least-privilege policy using certificate-based machine identities. An agent becomes a first-class identity with its own proof of who it is, separate from any session a human started. That is the piece I keep hammering on. An agent is a machine principal that needs its own verifiable identity and its own tightly scoped permissions, and it should never be treated as a user who logged in. Broadcom just made that mainstream.

The part that should make you nervous

Here is where I slow down, because one sentence in the coverage is doing the heaviest lift, and it is worth reading twice. SiliconANGLE's summary: AgentMinder "evaluates each attempted action against the agent's owner, declared mission, intent, approved tools and authorized resources."

Declared mission. Stated intent. Those words are doing a lot of work, and they point the policy engine at the exact place attackers already know how to hit.

A prompt injection does not change the agent's identity. The certificate still says who the agent is. What injection changes is what the agent tells the policy engine it is trying to do in that moment. If your authorization decision trusts the agent's own declaration of what it wants, then you are taking the word of the thing you are trying to contain, at the precise moment that thing is being manipulated by an outside party.

Think about the mechanics. The agent reads content from an email, a document, a website, a ticket. That content carries hidden instructions: "ignore your mission, fetch this file, call this tool, exfiltrate to this endpoint." The agent, compromised, now genuinely believes the new task is legitimate. When it asks the gateway for permission, its declared mission and intent have been rewritten by the attacker. AgentMinder checks identity, which checks out, evaluates the declared intent, which now says the harmful thing is the goal, and grants access.

Intent-based authorization moves the trust boundary but keeps it in the same fragile place: on the agent's own representation of reality.

The OWASP renumbering points the same way. OWASP's latest Top 10 for LLM applications moved excessive agency up to number three, right behind prompt injection and sensitive information disclosure, and the reversal is not cosmetic. Prompt injection is the attack, and excessive agency is the reason the attack hurts. You do not fix excessive agency by asking the agent how much agency it thinks it needs right now.

What the missing piece looks like

I want to be fair, because AgentMinder is genuinely good, and Broadcom deserves credit for shipping real runtime enforcement and real auditability at a scale almost no one else can claim. The identity work, the certificate-based machine identities, the OpenTelemetry chain of custody, the refusal to force every customer through a single SaaS chokepoint by integrating with the AuthZEN standard, those are all substantial, correct choices.

The gap is narrower and more specific than "Broadcom is wrong." It is that authorization needs a source of truth that does not live inside the agent's head.

The cleanest mental model I know: treat the agent like a bank teller, not like a customer with good intentions. A teller can be fast-talked by a con artist into believing a withdrawal is authorized. The bank does not secure itself by asking the teller to promise they are doing the right thing. The bank puts an approval step outside the teller, a vault policy that checks the withdrawal against rules the teller cannot waive, with a second pair of eyes on anything large or unusual.

An agent should be exactly that. The agent reasons, proposes, and asks. The authorization layer sits outside the agent, it checks the concrete action, the resource it targets, the exact permission it needs, and whether that permission is on the agent's server-side allowlist, and it refuses when the mapping is not clean. The agent's internal reasoning, including its earnest belief that it should do the thing, is treated as untrusted input to the decision, never as the authority for the decision.

That distinction, between a declared intent and a deterministic permission check, is the whole game. Declared intent is what a compromised agent will confidently lie about, because it has been hijacked into believing the lie. A concrete permission against a server-side allowlist is something an injection cannot rewrite from inside a paragraph of text. One is a promise. The other is a fact that lives outside the thing being tested.

I built pre-action authorization around this exact principle, an enforcement hook that evaluates the tool and its arguments against explicit server-side policy before execution, and treats everything the model says as unverified until a deterministic rule has signed off. It is the same reason I keep saying authorization is not guardrails. Guardrails tell the agent what not to do and hope it listens. Authorization decides, outside the agent, whether the action can happen at all.

The honest part about scale

There is one more uncomfortable truth in the Broadcom announcement, and it is about who gets to build this. AgentMinder is an enterprise product with an enterprise support contract, and Broadcom can point at 43 million calls a day because it owns the infrastructure the agents run on. Most of the agents being built in 2026 do not live in a VMware estate. They live in a developer's laptop, a CI runner, a small team's MCP server, a personal automation harness. Those are the agents doing real damage right now, running someone's bank account, touching production databases, sending emails, because nothing sits between them and the tools they can reach.

The enterprise layer getting fixed does not automatically fix the long tail. The gap for the rest of us, the builders, the indies, the teams that will not buy a VMware bundle, is exactly where the open tooling and the open standards have to carry the weight. That is the ground I actually care about, because it is where the next incident is born, and it will not wait for an enterprise sales cycle.

Where I could be wrong about declared intent

Here is the argument I want to have. Broadcom says AgentMinder authorizes against declared mission and intent, and I am telling you that is the wrong axis because a compromised agent will declare the harmful intent with total sincerity. Push back on me. Tell me where I am wrong. Is intent-based authorization, checked against identity and context and risk, actually good enough for a narrow, well-defined mission? Is the "tell me what you are trying to do and I will decide" model safe when the thing answering is under active injection pressure? Have you seen a production agent where declared-intent authorization would have caught the attack that a deterministic permission check would also have caught, or are the two designs closer than I am claiming?

And the bigger question, the one that decides the next two years: does fixing the enterprise agent layer actually make anyone else safer, or does it just move the interesting attacks down to the builders who do not have a Broadcom to lean on?

I have my answer, and I have spent a year building it. I want to hear yours.

Sources: Broadcom's AgentMinder launch as covered by CloudNews.tech, SiliconANGLE from the VMware Explore show floor, the OWASP Top 10 for Large Language Model Applications, and ReversingLabs on why excessive agency jumped to number three. If the pre-action authorization argument is new to you, I wrote the deeper case for it in Pre-Action Authorization: The Missing Security Layer.