Tigera Launches Lynx: First Mature Kubernetes Control Plane for AI Agents

Summary

Tigera, the company behind the open-source Calico networking stack, has introduced Lynx, a unified control plane designed to manage Kubernetes-native AI agents at scale. Lynx represents the first mature solution in this emerging category, sitting directly in the path of every agent-to-tool and agent-to-LLM call to enforce consistent security, identity, and policy across distributed AI workloads.

The control plane addresses a fundamental security challenge: AI agents are autonomous and non-deterministic, unlike traditional workloads that perform predictable operations. Lynx tackles this by providing agent discovery and inventory across Kubernetes clusters, attaching fine-grained policies using the open-source Cedar policy language, and delivering real-time visibility into agent behavior and data flows. It integrates with existing identity systems (Entra ID, Okta, SPIFFE) and leverages Tigera's Calico networking foundation for consistent microsegmentation.

Key capabilities include cryptographic identity management with short-lived, auto-rotated tokens, shadow agent detection and instant quarantine, per-agent sandboxing, and pre-built compliance packs for GDPR, HIPAA, SOC 2, and financial services requirements. Every transaction is authorized at the gateway with a default-deny policy enforced before any call executes. The platform is designed to integrate seamlessly with existing Kubernetes and cloud-native application protection strategies rather than forcing organizations to manage a parallel AI-specific infrastructure stack.

This positioning appeals to platform engineering and security teams embedding AI agents into production environments. While competitors like ClawManager, Agent Substrate, and ACP exist, Lynx is presented as the most mature and horizontally scalable offering, bringing enterprise-grade governance controls to the rapidly expanding landscape of autonomous agents in Kubernetes.

• Key features include agent discovery and inventory, shadow agent detection, OpenTelemetry end-to-end tracing, compliance automation, and instant quarantine capabilities.
• The launch targets platform engineering and security teams moving AI agents from experimental to production workloads.

Editorial Opinion

Lynx addresses a critical gap in enterprise AI infrastructure. As organizations move AI agents from experiments to production, the security model breaks down—agents are inherently unpredictable and autonomous, making traditional role-based access controls insufficient. By building on Tigera's proven Calico foundation and integrating with existing Kubernetes and identity systems, Lynx could become the security standard for enterprise AI agent deployment. The real test will be whether Cedar policies and default-deny enforcement prove practical for development teams while maintaining the guardrails enterprises require.