Nutanix puts agent token quotas and a single-control-plane claim into Enterprise AI 2.8

The word silo is carrying most of the marketing weight here, so it helps to separate what the platform decides from what it hands back to the operator. Cornely's framing is that the customer picks the substrate for each workload, and Nutanix optimizes the deployment only after that choice is made ^[5]. That is a narrower promise than run anything anywhere, and a more testable one: the claim is not that VMs, containers and agents become one runtime, but that they stay under one control plane instead of three ^[1]. Cornely puts the emphasis on operations rather than enablement, saying the hard part is not getting containers working but how you manage them ^[4].

The governance additions are where the release earns attention. The new MCP gateway is a single point for controlling which tools and data an agent can reach ^[6], and a companion MCP server exposes Nutanix-managed infrastructure to agents under the same control ^[7]. The reason is a billing problem, not a model one. Cornely says customers ask first for visibility, control and governance because they do not control cost per token, and agents make repeated calls nobody watches ^[9]. He says he has seen a monthly budget spent in a week ^[10], roughly four times the intended burn rate ^[20]. The quota controls at team, user and agent level are the direct answer to that ^[8].

The cheaper answer sits alongside it: steer work that does not need a frontier model, such as basic Python scripting, to open-weight models the customer hosts, where the bill is infrastructure rather than tokens ^[11]. Private Inference supplies the machinery, including LoRA tuning for sub-8B models, tensor-parallel inference across GPUs, batching and speculative decoding ^[12]. Nutanix claims speculative decoding can raise token-generation speed up to 2.5 times, with the caveat that the number depends on the model and the configuration ^[13], which makes it a ceiling to verify rather than a figure to plan against.

Two limits temper the governance story. MCP activity logs record which data sources an agent touched and what it did, but prompt inspection is not the default purpose ^[14], so the trail is about access, not intent. And Cornely is blunt that an MCP server is only as secure as the backend infrastructure and the API keys and role controls behind it ^[15]: the gateway concentrates access without removing the need to lock down what it fronts.

The rest of the release supports the single-plane argument. NKP 2.19 extends Kubernetes management across virtualized and bare-metal environments, with NKP Metal automating OS, firmware and container deployment and NKP on AHV integrating with Nutanix Flow for isolation ^[16], and the platform carries CNCF Kubernetes AI Conformance certification while Unified Storage has enterprise Nvidia certification ^[17][18]. Whether it removes a silo or just relabels one is the question an infra team can actually put to it.