Her Agent's Calls Never Leave the Building

At eleven on a Tuesday Yuki changes one line in a config file — an endpoint, nothing more — and her agent's next tool call, instead of leaving through somebody else's gateway, lands inside a pod on her own three-node cluster. She watches it happen twice: once as a sentence in the agent's log, once as a row in kubectl logs, the same request translated into two languages a few milliseconds apart.

The sentence is the easy part. An agent says something like ‘list this week's unpaid invoices,’ and for that to mean anything, it has to become an actual HTTP call to an actual API, with the actual credentials to make the call allowed. The piece of software doing that translation — turning agent-speak into API calls, enforcing which tools an agent may touch — is the Model Context Protocol's data plane, and for most teams it has, until now, run on infrastructure somebody else owns.

What arrived this week from Google's API gateway team is small and exactly the kind of thing Yuki trusts: the policy layer — who can call what, with which key, logged how — stays where it already lived, but the data plane, the part that actually handles every message between an agent and a tool, can now run inside your own Kubernetes cluster. The translation happens on a machine she can ssh into, not on a machine she has to take somebody's word for.

She spun up the sidecar on a weekend cluster before she wrote a line about it, mostly to see where it would break. It did not break in the way marketing decks promise nothing ever breaks; it broke in the ordinary way, a missing namespace, a service account with the wrong scope, both fixed inside twenty minutes with kubectl describe and a coffee gone cold. That ordinariness is the actual news: a boundary that used to be a trust question — do I believe this vendor's network as much as my own — has quietly become a deployment question, which is a kind of question she knows how to answer.

It will not make headlines next to a new model, and it should not. Nobody puts ‘moved the data plane in-house’ on a leaderboard. But every agent she has shipped this year has eventually needed to touch something it was not supposed to see — by accident rather than malice — and the thing that keeps those accidents from becoming catastrophes is never the clever safeguard, it is the boring one: the request that physically never had the chance to leave the building.

By midnight the sidecar is just another process in kubectl get pods, scrolling past with the rest, indistinguishable from everything else that was already trusted to be there.