F5 guardrails become first-class in MuleSoft's Agent Fabric

On September 2, F5 and MuleSoft — a Salesforce company — announced they are bringing F5 AI Guardrails, part of the F5 AI Security Platform, directly into MuleSoft's Agent Fabric. The move in one sentence: as agents move from experiments into the critical path of the enterprise, security teams cannot see agentic traffic, so the two companies decided to put inspection inside the gateway that traffic must pass through — not in a parallel proxy beside it.

The problem: agentic traffic is becoming an invisible pipe

As organizations scale AI agents and LLM applications, security teams face a growing governance gap and frequently lack visibility into agentic traffic. The risks on that gap are concrete: prompt injection, harmful outputs, and sensitive data leakage. F5 Chief Product Officer Kunal Anand put it directly: "AI agents are moving from experiments into the critical path of the enterprise. The biggest risk in agentic AI is that agents will move faster than enterprise security and governance models can keep up."

Until now, organizations deploying Agent Fabric while using F5 AI Guardrails faced a trade-off: route LLM traffic through a separate F5 inspection layer — adding operational complexity and fragmenting telemetry — or rely only on Agent Fabric's native gateway controls, leaving F5 guardrail policies unable to reach MuleSoft-managed workflows. Neither path was complete; eliminating that trade-off is what this integration is for.

How it works: inspection inside the gateway, not beside it

The architecture is direct: Agent Fabric's Omni Gateway routes LLM calls straight to the F5 AI Guardrails Scan API, inspecting inbound prompts before models are invoked and outbound completions before responses return. Per MuleSoft's blog, Agent Fabric becomes one of the first enterprise AI control planes to broker F5 AI Guardrails inline, with guardrails joining Amazon Bedrock Guardrails and Azure Content Safety as first-class providers.

"No second proxy, no parallel inspection path, and no blind spots across both F5's SaaS and customer-hosted Kubernetes deployments" — that sentence from MuleSoft captures the architectural intent: policy management for AI traffic lives in a single control plane. Andrew Comstock, SVP and GM at MuleSoft, notes Agent Fabric was built as the neutral solution for enterprises running agents across a mix of models and platforms; making F5 AI Guardrails a first-class provider lets customers scale their agentic enterprise on the security tooling they already trust.

What it blocks: injection, jailbreaks, toxicity, PII and restricted topics

The inspected threat surface is explicit: prompt injection, jailbreaks, toxicity, and unauthorized topics are blocked, while exposure of PII and protected data is reduced at runtime. On the F5 side, detection is organized into scanners, grouped into packages, and bound to projects, with prebuilt compliance packs for the EU AI Act and GDPR.

The capability's provenance matters: after F5's acquisition of CalypsoAI, runtime AI guardrails became a standard control across one of the largest app-and-network installed bases in the world. For customers already running Agentforce, the integration extends consistent runtime security controls across Agentforce-powered agents, Agent Fabric workflows, and custom AI applications.

Data sovereignty: sensitive traffic can stay inside the customer boundary

Unlike many cloud-only security offerings, this integration keeps an on-premises option: a dual-deployment topology supports self-hosted Kubernetes, including private VPCs, so sensitive prompt and completion data can remain inside customer-controlled boundaries instead of entering F5's SaaS. For finance, healthcare, and other industries with hard data-residency and sovereignty requirements, that option can decide whether the solution is procurable at all.

One control plane, one telemetry stream

Security teams author and version scanners, blocklists, and sensitivity thresholds in the F5 console; the Omni Gateway picks up those changes dynamically, with no policy or code changes. Every decision carries detailed telemetry and shared scan IDs for correlation in the F5 console with business-side logs, simplifying audit preparation under regulations such as the EU AI Act, GDPR, and HIPAA.

What it means for enterprises — and its limits

The real signal of this news is where the enforcement point lives: guardrails are no longer a separate appliance running in parallel with the business gateway, but a first-class capability inside it. When procuring AI security, enterprises pushing agents into critical processes should ask: can this vendor's guardrails land inside the gateways and platforms we already run — or will it force another proxy?

The limits deserve equal attention. Prompt-injection detection is a continuous adversarial race, and vendor-reported capabilities need independent testing. The gateway only covers traffic flowing through Agent Fabric — shadow agents and direct API calls remain blind spots. Runtime guardrails are one layer of defense-in-depth, not a replacement for identity, authorization, and least privilege. The integration is generally available now, with more detail expected at Dreamforce on September 15–17.

References: F5 press release, "F5 and MuleSoft, a Salesforce company, collaborate to deliver inline security and governance for Agent Fabric and agentic AI applications" (2026-09-02) — https://www.f5.com/company/news/press-releases/inline-security-governance-agentic-ai-applications ; MuleSoft Blog, "F5 AI Guardrails Now a First-Class Provider in Agent Fabric" (2026-09-02) — https://blogs.mulesoft.com/news/one-gateway-every-guardrail-f5-ai-guardrails-joins-agent-fabric-as-a-first-class-provider/ ; SMBtech (2026-09-04) — https://smbtech.au/news/f5-integrates-ai-security-guardrails-into-mulesofts-agent-fabric/