Autonomous AI agents require robust architectural guardrails for safe innovation as they scale. To protect data, clear network-level boundaries are essential for these agents that connect across tools and datasets. Google Cloud recommends VPC Service Controls (VPC-SC) to establish a crucial destination-based perimeter for these workflows. New capabilities in VPC-SC enhance AI security by strengthening these boundaries.Agent identities can now be directly added to service perimeter rules, allowing for least-privilege access and immediate revocation if an agent is compromised. Conditional access rules can be enforced using model context protocol (MCP) attributes, enabling granular control over tool interactions, like denying email sending while allowing read access. VPC Service Controls are now natively integrated with the Gemini Enterprise Agent Platform, automatically blocking public internet access for enhanced security.This integration secures agentic workloads by reinforcing network-level security controls, acting as a foundational layer for data protection. VPC-SC, alongside identity and resource controls, forms a layered approach to enterprise AI security. It defends against unique attack vectors, acting as a critical network safety net against compromised agents. VPC-SC effectively prevents data exfiltration even when agents have valid IAM credentials.