Clarion Street

Five Vendors Converged on the Same Agent Stack. Nobody Coordinated.

·8 min read

Five enterprise vendors have shipped near-identical infrastructure for governing AI agents over the past several months. Broadcom, Citrix, CrowdStrike, ServiceNow, and Genesys each announced some version of the same three-layer stack: a connectivity layer built on the Model Context Protocol, a security and governance layer, and an observability layer. None of them coordinated. Forkast first grouped the launches under a “five vendors in two weeks” headline, and that framing is a compression. [1] Citrix and ServiceNow shipped in April and May, months before the rest. The dense burst is August 31 through September 8, when Broadcom, AWS, Genesys, and Red Hat all landed within eight days.

I have written about the pieces of this stack before, so I will not re-derive them. The control plane, the missing layer around the model, is the infrastructure gap. The compliance side, observation plus constraint plus an MCP chokepoint, is the compliance gap. The harness that decides what a model sees and which tools it can call is the shift from chatbots to agentic infrastructure. What changed is that the vendors shipped the whole stack as a single product, and the question is no longer whether the layer exists but who owns it.

The product wave

The burst is datable. Broadcom unveiled AgentMinder at VMware Explore on August 31. [5] AWS took its Agent Registry to general availability the same day. [8] Genesys launched a four-product orchestration stack at Xperience on September 2. [7] CrowdStrike unveiled Falcon Guardian at Fal.Con 2026. [9] Red Hat shipped OpenShell, a kernel-level agent sandbox, as a developer preview in OpenShift AI 3.5 on September 8. [4] Citrix and ServiceNow arrived earlier: Citrix’s NetScaler AI Gateway in April, [13] its MCP Gateway in July, [10] and ServiceNow’s expanded AI Control Tower in May. [6]

Each vendor approaches the stack from its own legacy strength.

Broadcom’s AgentMinder is a control plane it describes as a “traffic controller” for agents. [5] It binds an agent’s authority to a declared mission, its permitted intents, approved tools, and authorized resources. It authenticates tokens and enforces least privilege on every tool call, and its audit trail is built on OpenTelemetry. It ships only inside VMware Private AI Cloud, alongside vDefend for agentic zero trust and Avi Load Balancer for agentic threat defense. There is no standalone SKU.

AWS’s Agent Registry is a catalog layer. [8] It is a private, governed registry for agents, tools, skills, and MCP servers, exposed as an MCP endpoint that developers query from IDEs. It auto-detects agents across AgentCore runtimes and gateways, supports cross-account sharing through RAM, and works with CloudFormation, Terraform, and CDK for infrastructure as code. Migration from the bedrock-agentcore namespace is required by September 17. [2]

CrowdStrike’s Falcon Guardian treats “agent detection and response” as its own security category, fusing agent activity with endpoint telemetry to trace a prompt to a tool call to a downstream action. [12] CrowdStrike claims 99% detection efficacy on prompt attacks at 100ms latency, and a centralized AI Gateway is expected in Q4 2026. That 99% and 100ms are vendor numbers, not an independent measurement. [9]

ServiceNow’s AI Control Tower spans Discover, Observe, Govern, Secure, and Measure across “any system in the enterprise” and can detect and shut down a rogue agent in real time, with an added AI Gateway for MCP transactions. [6]

Genesys’s four-product stack is the customer-experience take: Navigator for intent routing, Orchestrator for journey coordination, Contextual Intelligence for persistent enterprise memory, and an AI Control Plane for discovery, identity, policy, and observability. [7] Control Plane and Contextual Intelligence are available now. Navigator reaches GA in Q4 fiscal 2026 and Orchestrator in Q1 fiscal 2027.

Red Hat’s OpenShell is the odd one out, and the most interesting to me. [4] The controls sit below the model layer: Landlock LSM, seccomp, and network namespaces for isolation, OPA policy at L4/L7, NeMo Guardrails for semantic guardrails, and Garak for red-teaming. The argument is that a control the model can talk its way past is not a control, so enforcement has to live in the kernel where a prompt injection cannot negotiate it.

The shared layer is MCP

The connective tissue is the Model Context Protocol. Anthropic introduced MCP in November 2024 and donated it to the Linux Foundation’s Agentic AI Foundation in December 2025. The project now reports 97 million monthly SDK downloads and more than 10,000 active servers. [14] Vendors are treating MCP as the open plumbing and building their governance and observability value on top of it. I have followed the protocol through its stateless rewrite.

The stated reason for all of this is governance. Forkast cites Gartner’s figure that 60% of GenAI proofs of concept were abandoned in 2024, primarily for a governance gap, with a projected 35% abandonment rate through 2029. [1] The gap is measured elsewhere too: a Cloud Security Alliance survey found 92% of large-enterprise CISOs and CIOs lack full visibility into agent identities, [2] CSA/Oasis found 78% of organizations lack any documented policy for agent identities, [3] and Okta found only 34% apply the same security controls to agents as to human employees. [3] Those are self-reported survey figures, so I treat them as direction rather than audited fact. I have covered the identity half of that gap here and the shadow-AI half here. The vendors are moving governance from a bolt-on to core infrastructure, and the reason is that the buyers have a real problem.

Plumbing or a moat

The buyer question the topic raises is whether this is plumbing that makes agents production-ready or lock-in dressed as governance. Both readings are defensible, and I keep going back and forth.

The lock-in reading is that governance now ships only inside a vendor’s platform. Broadcom ties AgentMinder to VMware Private AI Cloud. [5] Citrix folds its gateways into the NetScaler platform license with no separate SKU. [10] Forkast’s framing is that the goal is not to monetize a single layer but to control the whole stack and become the “mandatory gatekeeper” for enterprise agent deployment. [1] If the only way to get default-on governance is to buy the whole stack, then governance is the moat.

The plumbing reading is that the one genuinely open layer, MCP, is foundation-governed, and the governance work on top of it is commodity infrastructure. [14] Default-on compliance is a feature when it lowers the cost of running secure agents, even as the compliance bar rises.

Broadcom’s own framing names the fork: an identity-layer strategy, like Okta’s Agent SSO, versus an infrastructure-layer strategy, like AgentMinder bundled into Private AI Cloud. [3]

My read is that the convergence is real evidence the enterprise agent market has passed from framework proliferation to infrastructure consolidation. The wild-west phase is ending. The MCP layer is the hinge. It is the one piece that is vendor-neutral and foundation-governed, and it is what keeps the convergence from being pure lock-in. Whether that hinge holds depends on whether MCP stays open now that the vendors have built their moats on top of it.

Caveats

The “two-week window” is editorial compression. Forkast frames five vendors as shipping in two weeks, but Citrix’s AI Gateway came in April, ServiceNow’s Control Tower in May, and Citrix’s MCP Gateway in July. [13] [6] [10] The genuine burst is August 31 through September 8: Broadcom and AWS on the 31st, Genesys on September 2, Red Hat on September 8. CrowdStrike’s exact date is not in the sources.

The three layers are not one-to-one across vendors. Forkast names connectivity, security, and observability. [1] CrowdStrike names connectivity, observability, and authorization and enforcement. [9] Broadcom describes three core layers as vDefend, Avi, and AgentMinder. [5] Red Hat uses a five-layer defense-in-depth model. [4] They are converging on a shared problem, not a shared taxonomy.

Most of the lock-in is still prospective. Genesys Navigator and Orchestrator ship in 2027, [7] CrowdStrike’s AI Gateway is expected in Q4 2026, [9] Broadcom’s vDefend and Avi enhancements are described in future tense, [5] and Red Hat’s OpenShell is a developer preview. [4]

The numbers are mostly vendor-framed. CrowdStrike’s 99% and 100ms are vendor metrics. The Cloud Security Alliance, CSA/Oasis, and Okta figures are self-reported survey data. I treat the direction as solid and the individual numbers as marketing.

And MCP standardization is not yet universal. NIST’s AI Agent Standards Initiative, launched in February 2026, has produced no binding requirements. [11] The AWS Agent Registry is explicitly AWS-specific rather than an industry standard, and the OWASP Agentic Top 10 is the de facto interim baseline. [2]

Sources

  1. Five Enterprise Vendors Just Shipped the Same Three-Layer Agent Infrastructure Stack — Forkast
  2. AWS Agent Registry GA Marks the Shift From Agent Runtime to Governed Catalog Layer — Forkast
  3. Broadcom Bakes Agent Governance Into the Private Cloud, Not as a Bolt-On — Forkast
  4. Beyond container boundaries: Kernel-level agent security in OpenShift AI 3.5 — Red Hat
  5. Broadcom Delivers End-to-End Security, Identity, and Observability for Agentic AI — GlobeNewswire
  6. ServiceNow Expands AI Control Tower to Discover, Observe, Govern, Secure, and Measure AI — ServiceNow
  7. Genesys Launches Innovations Advancing Genesys Cloud as the Agentic Orchestration Platform — Genesys
  8. AWS Agent Registry for Centralized Agent Discovery and Governance Now Generally Available — AWS
  9. CrowdStrike Falcon Guardian Makes the Endpoint the Enforcement Layer for AI Agents — Forkast
  10. Citrix Bakes Agent Governance Into the Private Cloud, Not as a Bolt-On — Forkast
  11. AI Agent Standards Initiative — NIST
  12. CrowdStrike Unveils Falcon Guardian to Secure AI Agents at Runtime — CrowdStrike
  13. Citrix Introduces NetScaler AI Gateway for Enterprise Governance of AI Application Delivery — Citrix
  14. MCP Joins the Agentic AI Foundation — Model Context Protocol