Agent Microsegmentation
The gateway control that groups agents into zones, applies default-deny authorization to agent-to-agent calls, and scopes which tools each zone may reach. Agent microsegmentation brings the containment idea security teams already trust on the network to the agent estate. It limits the blast radius of a single compromised or over-permitted agent, so one agent that goes wrong cannot quietly drive the rest.
Why agent microsegmentation matters
Single-agent deployments are giving way to estates of agents that call each other. A support agent hands a task to a finance agent; an orchestration agent fans work out to a dozen specialists. Each of those agent-to-agent hand-offs, known as east-west traffic, is a path an attacker can use to move laterally: compromise one low-privilege agent through prompt injection, then use it to reach a higher-privilege agent that can move money or change records. If any agent can call any other agent, the whole estate shares the privilege of its most powerful member.
Perimeter and identity controls do not see this. They authorize the connection and the account, not the specific action one agent is asking another to take. Agent microsegmentation closes that gap by making agent-to-agent calls a first-class, default-deny decision at the gateway.
How IntentGate implements agent microsegmentation
Agents are grouped into zones that reflect trust and function, for example a finance zone, a procurement zone, and a read-only support zone. The zone is signed into the agent's capability token, so it cannot be changed by the agent or by the content it processes. Three controls then apply.
East-west control (agent to agent). Agent-to-agent calls are default-deny. An agent may only call another agent when a zone rule explicitly permits that direction, for example "procurement may call finance." An unpermitted hand-off, such as a support agent trying to drive the finance agent, is refused at the gateway before it reaches the target agent.
Per-zone tool scope (agent to tool). Each zone is scoped to the tools it needs and nothing else. A read-only zone that attempts to move money is denied at the gateway, before the tool is ever invoked, even if the individual agent's token would otherwise allow the tool.
Cross-zone delegation containment. When an agent delegates to a sub-agent, its capability token attenuates: the delegate inherits a subset of the parent's rights, never more. A cross-zone hand-off cannot be used to smuggle privilege from one zone into another.
Seeing and proving it: the flow map and estate matrix
Segmentation is only trustworthy if you can see it working. IntentGate builds a live flow map from real gateway decisions: which agent reaches which tools and which other agents, coloured by allowed, held, and blocked. Every line is a real call, not a hand-drawn diagram, and every dashed line is an agent-to-agent hand-off routed through the gateway.
For scale, the estate matrix presents the same information as a zone-by-zone grid that stays readable whether you run five agents or five hundred: green where a zone may call another, red with a count where a wall was hit, empty where there is no relationship. Because each cell is a whole zone pair, the grid does not grow with the number of agents. Click any zone to drill into its individual agents.
Getting to least privilege without a segmentation project
You do not have to guess the rules. IntentGate's recommender reads observed traffic and proposes the tightest zone and tool policy that still permits what actually happens; it never proposes opening something the gateway already blocks. You review the recommendation and apply it. You can also author rules in plain language, for example "support may not call finance," and the gateway compiles that into the enforced configuration. If an agent misbehaves, one-click quarantine halts its calls immediately.
Defence-in-depth pairing
Microsegmentation composes with the rest of the IntentGate suite. Intent enforcement stops an agent acting outside its declared task; policy and the action guard hold irreversible and high-value actions for a human; the PII filter redacts sensitive data flowing between agents. Microsegmentation adds the containment layer: even if a single agent is compromised, default-deny zones stop it reaching the agents and tools it was never meant to touch.
Related controls
Agent microsegmentation builds on the capability token, which carries the zone claim, and runs alongside intent enforcement and the policy engine. See the Agent Runtime Authorization category page for the full pipeline, or the Glossary for related terms.
Frequently asked questions
What is east-west traffic between AI agents?
East-west traffic is agent-to-agent communication: one agent calling or delegating work to another agent, rather than calling a tool or data source directly (which is north-south traffic). As multi-agent systems grow, east-west calls become the path an attacker uses to move laterally: compromise one low-privilege agent, then use it to drive a higher-privilege agent. IntentGate treats agent-to-agent calls as first-class and authorizes them by default-deny, so an agent can only reach another agent when a zone rule explicitly permits it.
How is agent microsegmentation different from network microsegmentation?
The idea is the same, applied one layer up. Network microsegmentation limits which hosts may open connections to which; agent microsegmentation limits which agents may invoke which agents and tools, judged at the action layer rather than the connection layer. A network firewall sees a permitted session; IntentGate sees that a support agent is trying to make a finance agent transfer money, and denies it because the support zone has no rule permitting a call into the finance zone.
Does microsegmentation slow down building multi-agent systems?
No, because you do not have to author every rule by hand. IntentGate observes real agent traffic and recommends the tightest zone and tool policy that still allows what actually happens, which you review and apply. You can also write rules in plain language, and the gateway compiles them into the enforced configuration. The result is least privilege reached in days, with a live flow map and a zone-by-zone matrix to prove it.
See it in the live demo → Explore the live flow map and zone-by-zone estate matrix on the demo page, driven by real agents making real calls through the gateway.