Analysis
agentshield is real, pre-1.0, and undated on every Solo.io surface; the two items with dates on the conference page are September extensions. The boundary layer and the defense layer now share one vendor family while the spec underneath stays a draft.
The announcement that introduces agentshield carries no date. Neither does its own project page . The nearest thing to a date on either surface is the event schema on Solo.io’s key announcements page , which dates the gathering to September 17 through 18 in Amsterdam while the page body covers the Oct. 22 San Jose program. On Solo.io’s press room , where the newest release is dated September 10, the only October 22 item anywhere is the calendar card for AGNTCon North America. Read against the vendor’s own pages, launched at Day 1 is what is positioned. What the record shows is one undated new project and two September extensions. The announcements page carries a card titled “Introducing agentshield”: “Agentshield is a new open source project that protects your APIs, services, data, and workloads from AI agents you don’t control by mapping attack paths, detecting threats, and helping remediate them at machine speed.” The two items beside it have dated primaries from early September. The September 3 press release covers agentdesktop, an open source desktop governance layer. The September 10 press release covers the standalone mode of Solo Enterprise for agentgateway, “a single self-contained binary or container that runs in any environment, from a virtual machine or ECS task to bare metal or a developer workstation,” with a self-service UI and governance that treats Model Context Protocol servers as first-class backends. That is the newest agentgateway item on the record: an extension that carries the gateway beyond Kubernetes, not a launch of it. The claim that Solo.io shipped a Kubernetes-native AgentGateway at Day 1 gets both the date and the direction wrong. agentshield itself is real software with a specific shape. In the vendor’s terms it maps workloads, identities, policies and exposures into one evidence-carrying graph, detects change against the last coherent state, and sends new paths to an investigator model with bounded read-only tools. Fixes are proposed and applied only after explicit human approval, in the sequence plan, dry run, approve, apply, verify. The project’s own page states “nothing is written before the approval step.” Plugins ship for Kubernetes, Istio and Cilium; agentgateway, Falco and AWS are marked early, and Tetragon is planned. It is open source under the Apache 2.0 license. No design partners or customers are named on any fetched surface. It is also pre-1.0, and the project page says in three words what that means: “Evaluate it; do not expose it.” The HTTP API and the user interface carry no authentication, and approval state lives in process memory. A defense tool that arrives without its own doors is a fact a buyer can check before any of the positioning. The coupling is visible in that plugin list. The boundary layer and the defense layer are one vendor family, and agentshield’s own agentgateway plugin is the seam between them: Gateway API semantics, discovery only, no telemetry transport yet. The specification that would make a mesh portable is still a draft. This desk’s announced-but-not-shipped ledger entering the show priced that gap: Personal Agent Protocol at v0.1, Okta’s agent framework pre-general-availability, and the finding that builders cannot buy interoperability, only individual bridges. The week of Oct. 20 shipped the same pattern at three layers: enforcement descending into silicon, a healthcare-native gatekeeper, and now a mesh and a defense tool in one catalog. When the shared spec is a draft, every bridge carries its own agent identity scheme, which is the same gap this desk mapped as the origin-check gap: both theories verify the claimer, neither verifies the requester. For teams weighing the release, the checkable facts are narrow and all of them are on the pages. The Apache 2.0 license. The plugin list. The maturity warning. The absence of a date. The gateway-side figures of over 50 million image downloads and 500 contributors are vendor-reported. What ships is a pre-1.0 tool that tells you not to expose it, plus two September extensions. What is positioned is a launch day.