With AgenticWorkforces, we can define with which other agents and tools a Agent may talk. If we create network policies based on this configuration, the cluster can enforce this and disallow the agent to talk with any other service or the internet.
The agent-runtime-operator should create these network policies together with the deployment, service, etc.
The cluster needs a network plugin installed to make network policies work.