--- title: "Lynx" source: "https://www.tigera.io/tigera-products/lynx/" description: "A unified control plane for AI agent discovery, identity, authorization & runtime enforcement for every agent in your organization running on Kubernetes." --- For Platform Engineering, AI & Security Teams ![Lynx](https://www.tigera.io/app/uploads/2026/06/lynx-black.svg) # AI Agent Security for Kubernetes ## Your AI agents are making decisions. Do you know what they're authorized to do? The unified control plane for AI agent discovery, identity, authorization, and runtime enforcement for every agent in your organization running on Kubernetes. **Guardrails, not gates**. [Watch Launch Event](https://tigera.wistia.com/s/c37h9qyaiz1ysjv/?utm_source=website&utm_medium=video&utm_campaign=lynx_launchFY27) [Watch Demo](https://app.arcade.software/share/otiiHhZXpIRhebuAZqOv/?utm_source=website&utm_medium=video&utm_campaign=lynx_launchFY27) ![Introducing: Tigera Lynx – Security & Visibility for Kubernetes-Native AI](https://embed-ssl.wistia.com/deliveries/798b6255fac5a02833d563eaed079adb.jpg?image_crop_resized=612x344) ## Unified control across teams ### For AI & Platform Engineering Teams - Deploy agents faster with comprehensive observability - Runtime enforcement without blocking workflows - Identity and authentication for every agent ### For Security Leaders - Complete visibility into every agent; shadow agents too - Zero-trust authorization enforced before every action - Full audit trail for compliance and incident response Problem ## AI agents don’t behave like the workloads enterprise security stacks were built for. They are autonomous and non-deterministic: they act on behalf of a user, reach for any tool, LLM, or other agent, have a delegation chain, and read untrusted input. ### What a control plane for agents must do: ![One place that says what each agent can do](https://www.tigera.io/app/uploads/2026/03/tag-problem-icon1.svg) ### One place that says what each agent can do *Agents reach for any tool, LLM, or agent and read untrusted input* **What you need:** One place that says what each agent can do. Policy-driven, applied at every call. ![Authentication & authorization on every hop](https://www.tigera.io/app/uploads/2026/03/tag-problem-icon2.svg) ### Authentication & authorization on every hop *Every action is a delegation chain: User->agent->agent->Tool.* **What you need:** JWT Tokens scoped, time-bound, carrying the chain. ![A way to watch what agents actually do](https://www.tigera.io/app/uploads/2026/03/tag-problem-icon1.svg) ### A way to watch what agents actually do *A valid credential does not guarantee good behavior* **What you need:** Detect anomalies: quarantine the ones going wrong. ![Continuous posture assessment and sandboxing](https://www.tigera.io/app/uploads/2026/03/tag-problem-icon3.svg) ### Continuous posture assessment and sandboxing *Blast radius moves as new agents and tools come online* **What you need:** Test the posture; sandbox new agents on the way in Solution ## Guardrails, not gates. Security and governance that enables your AI teams to move fast, safely. Lynx is a cloud-native enforcement layer purpose-built for autonomous agents. It sits in the middle of all agentic traffic across Kubernetes clusters to discover, authenticate, authorize, and observe every agent action in real time. ***Every agent** is known. **Every identity** is verified. **Every action** is authorized before it happens. **Every interaction** is traceable.* Capabilities ### Everything you need to govern AI agents at enterprise scale. Discovery, Registration & Observability Know every agent in your estate, registered or shadow ![Discovery, Registration & Observability](https://www.tigera.io/app/uploads/2026/03/Universal-Discovery-and-Registry.png) Configuration & Posture Management AI-CSPM — assess and manage agent configuration risk across your K8s estate ![Configuration & Posture Management](https://www.tigera.io/app/uploads/2026/03/Authorization-and-Access-Control.png) Agent Identity & Authentication Identity broker: cryptographic identity for every agent — zero shared secrets, foundational to all other pillars ![Agent Identity & Authentication](https://www.tigera.io/app/uploads/2026/03/Identity-and-Authentication.png) Policy Definition & Enforcement Guardrails, not gates — single policy for LLM, MCP & Agent access. Cedar policies, default-deny, zero agent code changes. ![Policy Definition & Enforcement](https://www.tigera.io/app/uploads/2026/03/Runtime-Policy-Enforcement.png) Anomalous Behavior Runtime detection — full audit lineage: Agent → Decision → Tool → Data ![Anomalous Behavior](https://www.tigera.io/app/uploads/2026/03/Observability-and-Audit.png) Know every agent before they do something they shouldn't. ### Central Registry A directory of every agent with owner, purpose, version, context. Full APIs for CI/CD registration at deploy time. ### eBPF Auto-Discovery Find every agent running, including ones nobody registered. Detected by behavior (library loads, MCP traffic, TLS SNI. ### Shadow Agent Detection Discovered agents are cross-referenced against the registry. ### Observability Reconstruct any agent's actions end-to-end: what it saw, what it decided, which tools it called. Open Telemetry traces. Fine-grained authorization for every agent interaction before it happens. ### Continuous Posture Assessment Continuously evaluate every registered agent's configuration against security baselines. Detect drift the moment it occurs — not at the next scheduled scan. Surface over-permissioned tools, excessive scopes, missing identity bindings, and exposed MCP servers before they become incidents. ### Sandbox Environments Provide a sandbox environment for each agent with a controlled blast radius. Leverage eBPF to control kernel primitives applied to the cluster before any agent runs. Customer-configurable baselines for safe operation by default. ### K8s-Derived Context Posture policies derived from actual K8s configuration — namespace, service account, RBAC bindings, and network policy — not just agent metadata. ### Compliance Baselines Pre-built policy packs for common compliance frameworks. Map agent configuration gaps directly to GDPR, HIPAA, SOC 2, and financial services requirements. Every agent needs a verified identity. Not a shared API key. ### SPIFFE/SPIRE SVIDs Cryptographic workload identities issued to every agent. Integrates with Microsoft EntraID, Okta, and existing IdPs. Private key never leaves the workload. ### No Shared Secrets Eliminates long-lived API keys entirely. Short-lived tokens with ~10-minute TTL are automatically rotated. Credential theft becomes operationally useless. ### Chain of Custody Tracks On-Behalf-Of delegation chains via RFC 8693 token exchange. Every hop in a multi-agent workflow is cryptographically attributed. ### Token Exchange at Gateway Standard Mode replaces caller tokens with gateway-minted JWTs. Passthrough Mode preserves the original token for downstream verification alongside the gateway JWT. Guardrails, not gates. Enforcement that doesn't slow your AI & platform engineering teams down. ### Runtime Enforcement Istio Ambient Mesh: ztunnel at L4, waypoint proxy at L7. Every policy evaluated in real-time before any action. Break-glass quarantine. HIL hooks. ### Tool Binding Restrict exactly which LLM, MCP server, API endpoint, or tool an agent can access. Bindings enforced at the gateway — not in agent code. ### Describe Policy in Natural Language LLM-assisted authoring of Cedar policies. Plain English expression of desired intent. Lowers the cognitive burden on authoring policies. See everything. Trace every action. Prove it to the auditor. ### Behavioral Anomaly Detection eBPF empirical classifier and behavioral baseline built from real agent traces. Detects anomalies — credential theft, lateral movement, supply-chain compromise — that static signatures miss. ### Forensic Audit Trail Full reproducible audit trail satisfies GDPR, HIPAA, SOC 2, and financial services requirements. Every agent decision is logged with cryptographic attribution. ### eBPF & LSM to Watch Agent Behavior Leverage eBPF & LSM to watch agent behavior on a continual basis and feed traces to the anomaly detection engine. Use Cedar policies to configure eBPF & LSM controls per agent. LLM-assisted authoring of Cedar policies. ### Red Team Agent LLM-driven adversarial agent continuously probes the cluster for posture gaps — IAM misconfigs, over-permissioned tools, exposed MCP servers — before attackers do. [Lynx Overview](https://info.tigera.io/rs/805-GFH-732/images/Lynx%20onepager.pdf?version=0/?utm_source=website&utm_medium=whitepaper&utm_campaign=lynx_launchFY27) DEPLOYMENT ## One security and governance standard. Lynx meets you where your agents are. ### Self-hosted Lynx is a Kubernetes-native gateway deployed in your cluster, sitting in the middle of all agentic traffic and enforcing policy at runtime. Control and data plane fully managed by you. **Ideal for:** Kubernetes-native agent deployments requiring full control over data residency. Why TIGERA? ## Tigera's Kubernetes network and security expertise, now supporting AI agent security and enforcement We’ve spent a decade enforcing policy for cloud-native workloads at the world’s most demanding organizations — **8 million+ nodes, 1 million+ clusters**. The same enforcement rigor and policy framework powering the Calico platform is now available for AI agents. ![Proven Policy Foundation icon](https://www.tigera.io/app/uploads/2026/03/why-tigera-icon4.svg) ### Proven Policy Foundation The enforcement engine behind Lynx secures 8M+ Kubernetes nodes daily. Enterprise-proven at the most demanding scale. ![Purpose-Built for Agents icon](https://www.tigera.io/app/uploads/2026/03/why-tigera-icon6.svg) ### Purpose-Built for Agents Not IAM stretched to cover agents. Not CASB repurposed for a new problem. Built from the ground up for autonomous, non-deterministic, distributed AI agents. ![Guardrails, Not Gates icon](https://www.tigera.io/app/uploads/2026/03/why-tigera-icon7.svg) ### Guardrails, Not Gates Real-time enforcement that enables AI & Platform Engineering teams to move fast — not a bureaucratic control layer that creates bottlenecks and drives workarounds. ![Enterprise Expertise icon](https://www.tigera.io/app/uploads/2026/03/why-tigera-icon8.svg) ### Enterprise Expertise A decade alongside NVIDIA, RBC, Bloomberg, and many more. That accumulated knowledge ships with every product we build. ## AI agents are already making decisions in your organization. Are they authorized to? Lynx gives security, AI, and platform engineering teams the visibility, authorization, and enforcement controls to safely deploy AI agents, anywhere in your Kubernetes environment, at enterprise scale.