Default-deny at the Foundry agent subnet. One terraform apply.
Your Aviatrix fabric governs the rest of your estate. Your Foundry agents sit outside it. In BYOVNet mode the delegated agent subnet has a default-allow path to the internet, with no allowlist and no deny log. Close it with a Spoke Gateway, a route on the agent subnet, and a six-rule default-deny policy. No code changes, no sidecars, no new platform. Read it. Clone it. Run it.
or read the full deployment detail on the Validated Containment Architecture product page
New to Aviatrix? Start a 30-day free trial from the AWS or Azure Marketplace.
What containment means
Containment is the architectural enforcement of explicit communication policy at every workload, governing what it can reach and what can reach it, at the granularity of workload identity and protocol, on every path available to it, independent of whether a compromise has been detected.
In practice: the boundary is the allowlisted domain for a specific MCP server, not "the internet." It holds whether or not anything has been detected, and it is the same policy model your fabric already enforces everywhere else.
No sidecar. No code changes.
A user-defined route on the delegated agent subnet sends every outbound connection to a Spoke Gateway in the same VNet. Nothing runs on the agent. The runtime never knows the gateway is there.
Six-rule policy pack.
Deploy in monitor mode, watch what would have been denied, then promote rule by rule. Azure Container Apps control-plane traffic is bypassed, so the runtime still starts. Every deny is logged with workload identity, destination, and rule name.
Policy that ships with the agent.
The WebGroup allowlist and the route table live in the same Terraform as the agent. New MCP server? Same commit, same pipeline run, same review.
Assets and documentation
Everything your team needs. No form.
Read them here. Nothing gated, nothing to fill in, nothing to wait for.
Reference Architecture for Azure AI Foundry Agents
Prerequisites, SmartGroup and WebGroup design, the full Distributed Cloud Firewall ruleset in priority order, the Azure Container Apps domain list, Service Tag configuration, TLS decryption scope, and the subnet immutability preflight checklist. Written for platform engineers.
Download PDFValidated Containment Architectures: The Model
The model behind every Validated Containment Architecture: the five testable properties a containment architecture has to demonstrate, the three insertion patterns with named back-out states, the monitor-before-enforce sequence, and how network containment layers with model guardrails. Covers Bedrock, Foundry, and MCP infrastructure.
Download PDFDemo
Watch a prompt-injected agent get denied.
A prompt-injected Foundry agent with a valid managed identity tries to reach an attacker-controlled endpoint over a legitimate channel. There is no anomaly for a detection tool to catch. This is The Credential Vector, and it is exactly the traffic Chokepoint Security lets through. The connection reaches the Spoke Gateway through the user-defined route, misses the Distributed Cloud Firewall allowlist, and never completes. A second scenario shows the same agent trying to reach a neighboring workload and being denied at the spoke boundary. Its Blast Radius is the allowlist, and nothing else. Nothing had to be detected first.
Deploy today
The Terraform is written. The ruleset is on GitHub.
One terraform apply. Default-deny from minute one. Read the subnet immutability constraint first: the Foundry capability host subnet cannot be changed after the project is deployed, so containment is a pre-release decision, not a retrofit.
ALREADY ON ENTERPRISE
Pull the Terraform from GitHub
Full blueprint, SmartGroup and WebGroup definitions, the Azure Container Apps domain WebGroup, Service Tag SmartGroups, and scenario cards. Deploys in about 25 minutes on the fabric you already run. Destroys cleanly with one command.
Get the Terraform
NEW TO AVIATRIX · BLUEPRINTS INCLUDED
Start with Enterprise
Subscribe on the AWS or Azure Marketplace and deploy a standalone Spoke Gateway inside the Foundry VNet. No Transit required, no hub peering. 30-day free trial.
Controller 8.2 or later required · One managed network per Foundry spoke VNet · No code changes · No sidecars
Secure your cloud for the future of AI
The Containment Era requires enforcement at every workload, not at a chokepoint. The Cloud Native Security Fabric delivers it on the cloud network you already run, for every agent and every workload communication path.