{ "id": "arista", "name": "Arista", "subtitle": "Mapped to the 4+1 Layer AI Infrastructure Model", "version": "v1.1 - 4+1 v3: Layer 0 Sub-Layers", "date": "October 19, 2026", "source": "Arista product documentation: 7800R4 Series AI Spine datasheet, 7060X6 and 7060XE7 product pages, platforms listing, EOS TOI for Cluster Load Balancing (EOS 4.32.2F to 4.35.2F) and packet trimming (EOS 4.35.0F), CloudVision datasheet (July 2026), CV UNO and network access control product pages, NDR appliance quick start guide and overview, NDR and NDR Campus datasheets (Japanese), product documentation index (AGNI On-Premises Setup and Access Guide), AMD Next-Gen AI white paper (September 14, 2026), AVA white paper (December 10, 2025). GitHub: aristanetworks/avd (Apache-2.0, v6.4.0), aristanetworks/anta (Apache-2.0, v1.10.0), aristanetworks/eos-mcp-server (Apache-2.0, v0.6.1-beta), aristanetworks/yang. Arista press releases (Etherlink June 5, 2024; 7800R4 and 7280R4 October 29, 2025; CV UNO AI observability March 12, 2025; remote AI agent May 29, 2024; AVA December 10, 2025 and May 20, 2026; 7060XE7 June 9, 2026; VeloCloud ETM July 21, 2026; Etherlink SU-144 October 7, 2026; SONiC support May 5, 2020). Arista 10-Q (Q1 2026, VeloCloud close June 30, 2025) and Q2 2026 earnings release. Tech Field Day sessions (Networking Field Day 40, April 9, 2026; Mobility Field Day 14, May 8, 2026). IBTA PlugFest 41 RoCE Integrators List. EANTC 2026 interop report. Network World coverage (February and October 2026). Published 4+1 model. Evidence boundary: EOS release notes and the full user manual weren't reachable, so GA for the agentic AVA features, the host NIC agent and the AI-job dashboard rests on press and event sources and isn't scored. v1.0 (October 19, 2026): new row, graded cell by cell with Keith. Reconciliation changed no grade; it moved the NDR override inference into the Layer 3 notes, stated the AVD and EOS split in the 2A borrowed judgment, and worded the SONiC finding as undocumented rather than absent. Review (October 19, 2026, before first publish): a ChatGPT review of every locked cell (reviews/arista-judgment.md; 33 claims, 29 upheld, 4 rejected after verification) moved no grade. Layer 3 authority moved to model and Ceded: NDR's detections are machine learning and no document shows a per-detection override. 0B added the 7700R4 (datasheet; Meta deployment on Arista's blog) and narrowed the SONiC finding to no Arista certification, since upstream SONiC tests run on the 7060X6. Ask AVA reads Beta on the CloudVision Help Center. Fact fixes: the SU-144 partner list, XPO at 0B, which products run EOS, the OpenConfig configuration subset, VeloCloud's own orchestrator, CV UNO as CVaaS-only, VeloBrain, NetDL's API exposure, AGNI's multi-vendor support, acronym expansion. Rejected: an OpenConfig Delegated chip and NDR and DMF storage at 0C (Keith). Whole-row review (October 19, 2026, Antigravity on gemini-4-argon-high; reviews/arista-row-agy.json; 6 claims, all upheld): the summary refocused on the AI fabric (Keith: \"Do we care for AI?\"), with campus, Wi-Fi and SD-WAN as the wider estate; VeloCloud Orchestrator named at 2A, not scored, and CV-CUE folded into the CloudVision chip; the 7720R4-128PE spine corrected from the datasheet's ordering tables; NetDL's label aligned with its API exposure; grammar and acronym fixes. v1.1 (October 19, 2026, /reconcile): plain-language pass: methodology rule numbers in the prose and audit notes replaced with the reasoning they stood for; no grade, chip or authority reading changed.", "status": "complete", "summary": { "title": "Etherlink on EOS, Run Through CloudVision", "paragraphs": [ "Arista's AI infrastructure is the Etherlink fabric and the plane that runs it. Layer 0B is strong: the 7060X6 leaf, the 7800R4 spine and the 7700R4 Distributed Etherlink Switch on EOS, Arista's network operating system, with documented congestion control and Cluster Load Balancing, and a public production-validated design on AMD MI3xx GPUs, at up to 13,824 GPUs on a 7812R4 spine. Meta, Microsoft and Oracle Cloud Infrastructure are named customers with statements in Arista's releases. Layer 2A is moderate on CloudVision, the fleet plane over the fabric, with approval-gated change control and rollback. Layer 3 is moderate on Network Detection and Response (NDR) and CV AGNI network access control, first-party security applications. Arista's campus, Wi-Fi and SD-WAN lines sit at 0B as the wider estate and carry no grade. Everything else is a gap: no compute, storage, data, runtime or agent plane. Authority sits in three places. EOS makes the fabric's runtime calls inside the enterprise's thresholds, CloudVision executes intent the enterprise declared so that half reads as the enterprise's code, and NDR's models make the detection calls, with no documented per-detection override.", "The capture is coupled and visible: one operating system across the switching estate. The openness is real. Arista publishes OpenConfig models, implements the gRPC Network Management Interface (gNMI), and ships Apache-licensed Arista Validated Designs (AVD) and ANTA and an open-source Model Context Protocol (MCP) server, and AVD is genuinely the enterprise's code, the only Retained chip on the row. The catch is where it lands. AVD renders EOS and CloudVision only, so the enterprise owns the code that writes Arista's opinions, not a portable form of them. Upstream SONiC tests run on the 7060X6, but no Arista document certifies SONiC on it: the only support statement is from 2020, before the hardware carrying the grade, and the current product pages list EOS alone. The single-OS consistency that makes Arista easy to operate is the same property that makes it hard to leave, and the buyer can see it, because every switch runs EOS.", "The architect gets a generally available Ethernet AI fabric with a production-validated design and one operating model across its switches, and pays for it with a single-OS commitment. The thing to watch is agentic Autonomous Virtual Assist (AVA). Arista's own MCP README documents models trying to route around a read-only tool door through Secure Shell (SSH), so any gate has to sit outside the model, in the credentials it holds or in code the enterprise runs, not in the tool list. Buy Arista for the fabric and the operating consistency, and price EOS as the decision: Nokia documents and supports SONiC on its own paper, and Arista doesn't." ] }, "layers": [ { "id": "layer0a", "label": "Layer 0A", "shortName": "Compute", "title": "Compute", "purpose": "CPUs, accelerators, servers, integrated systems, OS and hypervisor, physical plant", "status": "gap", "statusLabel": "No Compute; SU-144 Rack Announced, No Rack SKU", "authority": { "decides": "absent", "visible": null, "overridable": null, "boundary": "vendor", "direction": "Absent" }, "nvidia": [], "gap": "Arista sells no compute. Its platform listing has no server, accelerator or system category, and its AI designs bring GPUs from elsewhere: the AMD Next-Gen AI white paper (September 14, 2026) runs MI3xx with Pollara or Broadcom Thor 2 NICs.\n\nOne item is named, not scored. The Etherlink SU-144 rack-scale architecture (announced October 7, 2026, demoed at OCP) puts 7060XE7 switches, patch panels, optics, liquid-cooling manifolds, leak-detection trays, rack management controllers and power shelves around partners' accelerators: the partner statements name d-Matrix Raptor XPUs and Microsoft Maia, while AMD's names its Vulcano NICs and Qualcomm's names no product. No compute is on Arista's paper, no GA date is given, Arista told investors scale-up is an entry for 2027 and beyond, and Arista's own executive told Network World that customers won't find a rack SKU on its price list: integration runs through joint designs, which is a partnership, not Arista paper. At GA, the rack plumbing and power would read as physical plant here and the scale-up fabric at 0B.\n\nCalibration: Nokia reads moderate here only because it sells servers inside its telco cloud stack; Arista sells no compute at all. Cisco, Dell and HPE read strong on systems they sell.", "borrowedJudgment": "None. The enterprise picks and runs its own servers, and Arista neither offers nor absorbs the decision.", "notes": "Named, not scored: Etherlink SU-144 rack-scale architecture (press release, October 7, 2026; no GA date; no rack SKU per Arista in Network World, October 2026). Ethernet for Scale-Up Networking (ESUN): 2027 and beyond per the earnings call. XPO optics are transport and are noted at 0B.", "components": [] }, { "id": "layer0b", "label": "Layer 0B", "shortName": "Fabric", "title": "Network Fabric", "purpose": "Interconnects, switching and routing, network virtualization", "status": "strong", "statusLabel": "Etherlink on EOS: 7060X6 and 7800R4 With an AMD-Validated Design", "authority": { "decides": "vendor", "visible": true, "overridable": false, "boundary": "vendor", "direction": "Ceded" }, "nvidia": [ { "component": "IBTA RoCE Integrators List (PlugFest 41)", "detail": "7060X5 and 7060X6 tested with NVIDIA ConnectX-7 and BlueField-3. That's interoperability testing, not a validated design. The public production-validated design uses AMD MI3xx, and no Arista document claims a Spectrum-X design." } ], "gap": "This is Arista's home layer, and it's strong. Etherlink is four generally available (GA) platforms: the 7060X6 AI leaf on Tomahawk 5 (64 or 32 ports of 800G, available since June 2024), the 7800R4 AI spine on Jericho3-AI (up to 576 ports of 800G, shipping since October 2025, with a datasheet; the product page names Data Center Quantized Congestion Notification (DCQCN), Priority Flow Control (PFC), Explicit Congestion Notification (ECN) and remote direct memory access (RDMA) load balancing), the 7700R4 Distributed Etherlink Switch (7700R4C-38PE leaf and 7720R4-128PE spine, with a datasheet; Arista's blog of October 15, 2024 says Meta deployed it in an AI cluster), and the 7280R4. The congestion and load-balancing features are documented, not just announced: Cluster Load Balancing has EOS TOI documentation from 4.32.2F through 4.35.2F, and packet trimming has TOI under 4.35.0F. The design document carrying the grade is the AMD Next-Gen AI white paper (September 14, 2026): production validated on MI3xx with multiple customers, from 1,152 GPUs on a single 7800R4 tier to 13,824 on a 7812R4 spine, with Core42's Maximus-01 (9,000+ MI300X) named. Meta, Microsoft and Oracle Cloud Infrastructure gave supporting statements in Arista's June 2026 release.\n\nAround the AI fabric, Arista sells 7800R, 7500R and 7280R routing and campus switching (750, 720 and 710 series) on EOS, Wi-Fi 7 access points managed through CloudVision Cognitive Unified Edge (CV-CUE), and VeloCloud SD-WAN, a separate stack with its own orchestrator, acquired from Broadcom on June 30, 2025 for $300 million per the 10-Q. Converged Cloud Fabric (ex-Big Switch) is a software-defined networking (SDN) fabric controller with its own software. CloudVision takes a facet here: its change control decides when switch state changes or reverts (snapshots, network-wide rollback); its fleet-plane facet is scored at 2A. The DANZ Monitoring Fabric is a visibility fabric and makes no transport decision for the workload, so it's named, not scored.\n\nThe fabric's opinions sit in EOS. Arista publishes OpenConfig YANG models, and its OpenConfig documentation says a subset of the configuration models, QoS among them, can be written over gNMI, RESTCONF and NETCONF. That makes telemetry and part of the configuration standard-shaped, but the features that carry the grade (Cluster Load Balancing, dynamic load balancing, the RoCE tuning) are native EOS, and EOS's full configuration surface is single-vendor. No current Arista document certifies SONiC on the Etherlink platforms. Upstream SONiC does run on the hardware: the sonic-mgmt test suite lists 7060X6 SKUs, and an Arista engineer filed issue #26216 (July 9, 2026) on SONiC tests across about 13 of them. That's upstream test evidence, not Arista paper or support. Arista's own record: the only explicit support statement is a May 2020 press release (Arista SAI on 7050X and 7060X with 24x7 support, SONiC in production for select customers), Arista became a SONiC Foundation Premier member in April 2025, the 2026 releases say \"EOS or open network operating system\" without naming SONiC, and the 7060X6 and 7060XE7 pages list EOS only. No current support matrix turned up, so no SONiC chip is scored.\n\nCalibration: Nokia reads strong on the 7220 IXR and its validated design, Cisco on Nexus Hyperfabric and Silicon One, Dell on PowerSwitch with Spectrum-X, HPE on Slingshot and Juniper. A Tomahawk 5 and Jericho3-AI line with a production-validated RoCEv2 design stands with them. Not scored: the 7060XE7 on Tomahawk 6 (dated GA Q4 2026 air-cooled and Q1 2027 liquid-cooled and 128-port, so a watch item), UEC 1.0 and Ultra Ethernet Transport (Arista's wording drifts from \"emerging\" to \"designed for future\" to \"compatible with,\" and no EOS feature is documented; EANTC's 2026 interop report shows Arista packet trimming in a UEC demo), and XPO, liquid-cooled 12.8T pluggable optics under a multi-source agreement (March 12, 2026, no availability date).", "borrowedJudgment": "The fabric's runtime calls are EOS's: routing, Cluster Load Balancing placement, and ECN and PFC marking, inside thresholds the enterprise sets. Setting thresholds is configuration, not override. CloudVision's commits and rollbacks execute intent the enterprise declared, so that half reads as code; the cell reads with the transport half the grade would fall without. Leaving means rebuilding the configuration and the CloudVision intent on another vendor's NOS and tooling, and no Arista document certifies a second network operating system (NOS) on the same hardware.", "notes": "Watch item: 7060XE7 on Tomahawk 6 (102.4T, 1.6T): air-cooled 64PS and PRS Q4 2026; liquid-cooled 64PRS-RV3-L and 128PE Q1 2027 (press release, June 9, 2026). Named, not scored: DANZ Monitoring Fabric, UEC 1.0 and UET support, XPO optics. Open question: a current Arista SONiC support matrix or datasheet line on the Etherlink platforms would add a Delegated chip. Etherlink is reported at more than 100 cumulative customers in earnings-call summaries (secondary).", "components": [ { "component": "Etherlink AI platforms through EOS (7060X6, 7800R4, 7700R4, 7280R4)", "detail": "Tomahawk 5 leaf, Jericho3-AI spine and the 7700R4 Distributed Etherlink Switch, with documented DCQCN, PFC and ECN, Cluster Load Balancing and packet trimming, production validated in the AMD Next-Gen AI design. EOS is proprietary; a subset of OpenConfig configuration models is writable over gNMI, but the grade-carrying features are native EOS, so the configuration doesn't port.", "dapm": "Ceded" }, { "component": "Routing through EOS (7800R, 7500R, 7280R families)", "detail": "Data center gateway, interconnect and backbone routing with EVPN, VXLAN, MPLS, segment routing and SRv6, and TunnelSec on the 7800R4 and 7280R4. EOS opinions are captive to the Arista stack.", "dapm": "Ceded" }, { "component": "Campus switching and Wi-Fi (750, 720 and 710 series on EOS; Wi-Fi 7 access points on CV-CUE)", "detail": "Campus and branch switching on EOS and wireless access points managed through CloudVision Cognitive Unified Edge. The policy and configuration live in EOS, CV-CUE and CloudVision.", "dapm": "Ceded" }, { "component": "VeloCloud SD-WAN (edges and orchestrator)", "detail": "SD-WAN edges (7x0, 4100 and 5100, Virtual Edge) and the VeloCloud orchestrator, acquired from Broadcom June 30, 2025. Path-steering and business policy are VeloCloud objects.", "dapm": "Ceded" }, { "component": "Converged Cloud Fabric (SDN fabric controller)", "detail": "Ex-Big Switch controller that programs the fabric from its own policy model. The opinions don't lift to another vendor's controller.", "dapm": "Ceded" }, { "component": "CloudVision, change control and fabric state facet", "detail": "Decides when switch state changes or reverts: snapshots, a review-and-approve stage under RBAC, and network-wide rollback. Studios and configlets are CloudVision objects. The same product carries a fleet-plane facet at 2A with the same reading.", "dapm": "Ceded" } ] }, { "id": "layer0c", "label": "Layer 0C", "shortName": "Storage", "title": "Storage Substrate", "purpose": "Arrays, storage servers and software, front-end protocols: where the data sits", "status": "gap", "statusLabel": "No Storage", "authority": { "decides": "absent", "visible": null, "overridable": null, "boundary": "vendor", "direction": "Absent" }, "nvidia": [], "gap": "Arista sells no storage for the enterprise's data. Storage vendors appear only as partners in its material: VAST, Pure Storage, EMC, HPE, NetApp, Nutanix, WEKA and DDN. Two Arista products carry storage hardware, and neither is storage the enterprise buys as substrate: the DCA-NDR-STR appliance holds NDR's own captures, and DANZ Monitoring Fabric Recorder Nodes hold recorded packets for network visibility. Both store the appliance's own data inside a security or visibility product, so they're named, not scored. The 7060XE7's 480 GB of internal storage is the switch's own. Arista's contribution is the storage network: Etherlink and the 7280R carry front-end and storage traffic, which sits at 0B because the switches a storage protocol crosses are fabric.\n\nThe whose-paper rule shows up in reverse: VAST's own row lists Arista 7050DX4 and 7060DX5 switches as stock-keeping units (SKUs) on VAST's paper for its NVMe over Fabrics (NVMe-oF) back end. That's Arista hardware credited on a storage vendor's row, which is the rule working as designed. Calibration: Nokia reads moderate here only on Everpure storage inside its telco cloud stack; Cisco reads strong because VAST EBOX is on Cisco's price list.", "borrowedJudgment": "None. The enterprise picks and runs its own storage.", "notes": "Named, not scored: DCA-NDR-STR (NDR capture storage appliance) and DMF Recorder Nodes (packet recording for visibility). Storage partners named in Arista material: VAST, Pure Storage, EMC, HPE, NetApp, Nutanix, WEKA, DDN.", "components": [] }, { "id": "layer1a", "label": "Layer 1A", "shortName": "Data", "title": "Data Foundation & Governance", "purpose": "The data itself, organized and governed: the Governance Catalog that Layer 2C queries", "status": "gap", "statusLabel": "NetDL Is Embedded in CloudVision, Not Sold as a Data Foundation", "authority": { "decides": "absent", "visible": null, "overridable": null, "boundary": "vendor", "direction": "Absent" }, "nvidia": [], "gap": "Nothing on Arista's paper governs an enterprise's data foundation. The candidate is the Network Data Lake (NetDL). The CloudVision datasheet calls it a state-based, cloud-hosted, network-wide data lake built on Kubernetes and Hadoop and says telemetry is kept for three months; Arista's cloud-networking page adds flow and packet data and third-party feeds (Zscaler telemetry documented into NetDL, Palo Alto building on it), and it's the memory behind Autonomous Virtual Assist (AVA). For network and security operations, one queryable store of network truth is real value.\n\nIt doesn't score here, for two reasons. The exposure test: NetDL presents a single API surface through CloudVision's API, but the datasheet's ordering section lists only CloudVision tiers and no NetDL SKU, so it's exposed as part of CloudVision, not sold as a data foundation. And the layer's function: 1A is graded on a catalog that says what the enterprise's data is (classification, lineage, sensitivity), and NetDL catalogs facts about the network, with nothing documenting classification of enterprise data.\n\nCalibration: Nokia reads gap here, with its service-provider Data Suite named; Arista has no comparable sold data product. Rows without a catalog read gap.", "borrowedJudgment": "None. The enterprise governs its own data.", "notes": "NetDL appears again in the 2A, 2B and 2C prose as CloudVision's store and AVA's memory and retrieval store. Its API is reached through CloudVision's API; nothing documents it as a customer store for non-network data.", "components": [] }, { "id": "layer1b", "label": "Layer 1B", "shortName": "Retrieval", "title": "Context Management & Retrieval", "purpose": "Low-latency retrieval for RAG — vector/hybrid search, context windows", "status": "gap", "statusLabel": "Enterprise Responsibility", "authority": { "decides": "absent", "visible": null, "overridable": null, "boundary": "vendor", "direction": "Absent" }, "nvidia": [], "gap": "Arista sells nothing an enterprise can use for retrieval. The only retrieval on its paper is inside its operations assistants. VeloBrain's Knowledge Assistant, introduced in VeloCloud release 6.2.2, answers questions about VeloCloud products with references. At Mobility Field Day 14 (May 8, 2026), Arista showed Autonomous Virtual Assist (AVA) investigating with large language models (LLMs) plus retrieval-augmented generation, guided by skill documents, with per-tenant memory in the Network Data Lake (NetDL). Both are the operations assistants' own context, not retrieval products, and they're described at 2A and 2B. The fabric carries retrieval traffic, but transport isn't retrieval, and it's scored at 0B. Calibration: Nokia reads gap here on the same shape.", "borrowedJudgment": "None. The enterprise builds or buys its own retrieval.", "notes": "", "components": [] }, { "id": "layer1c", "label": "Layer 1C", "shortName": "Pipelines", "title": "Data Movement & Pipelines", "purpose": "Move/transform data — ETL/ELT, lineage, cost-aware movement, KV cache tiering", "status": "gap", "statusLabel": "Enterprise Responsibility", "authority": { "decides": "absent", "visible": null, "overridable": null, "boundary": "vendor", "direction": "Absent" }, "nvidia": [], "gap": "Arista moves traffic, not data. Etherlink, routing and VeloCloud software-defined WAN (SD-WAN) are scored at 0B, and VeloCloud's application-aware path steering is WAN routing, not a pipeline. The only data movement on Arista's paper lands in its own product: CloudVision Universal Network Observability (CV UNO) runs on-prem sensor virtual machines that collect flow and Simple Network Management Protocol (SNMP) data from compute and third-party devices into the Network Data Lake (NetDL). That's a console's ingest path, and it fails the general-coverage destination test, since the documented output lands in NetDL. Calibration: Nokia reads moderate here on Nokia Mediation, a documented pipeline product for service providers; Arista has no counterpart.", "borrowedJudgment": "None. The enterprise runs its own pipelines.", "notes": "", "components": [] }, { "id": "layer2a", "label": "Layer 2A", "shortName": "Orchestration", "title": "Infrastructure Orchestration", "purpose": "GPU scheduling, quotas, RBAC, fair-share scheduling, utilization optimization", "status": "moderate", "statusLabel": "CloudVision Over the Fabric; No Compute", "authority": { "decides": "code", "visible": true, "overridable": true, "boundary": "vendor", "direction": "Retained" }, "nvidia": [], "gap": "CloudVision is the fleet plane for Arista's data center, routing, campus and Wi-Fi, and for EOS-based WAN through CV Pathfinder; VeloCloud software-defined WAN (SD-WAN) is managed through its own VeloCloud Orchestrator, a fleet plane for branch edges that's named here and not scored, since nothing an AI architect deploys runs through it. CloudVision comes on-prem as CloudVision Portal (Arista appliances or a virtual machine, three-node high-availability cluster) or as CloudVision as-a-Service (CVaaS), run by Arista's site reliability engineering team, and the datasheet says both have the same functionality. It documents Studios for provisioning (Static Config, Software Management, Network Fabric, Custom Studios, AVD Studio) plus configlets, and change control with snapshots, a review-and-approve stage under role-based access control (RBAC), runbook templates and network-wide rollback. CloudVision Universal Network Observability (CV UNO), a premium feature sold only with CVaaS, pulls flow and SNMP data from compute and third-party devices into the Network Data Lake through on-prem sensors. Other vendors' gear is read-only: official support covers Cisco and VMware, plus integrations with ServiceNow, Ansible, NSX and OpenStack including Ironic. Beside it, Arista publishes Arista Validated Designs (AVD), an Apache-2.0 Ansible collection that turns YAML fabric data models into EOS configuration and CloudVision workspaces and can open change controls pending approval, and ANTA, Apache-2.0 network test automation. Ask AVA, a generative assistant in CloudVision's Services + AIOps feature category, is labeled Beta in the CloudVision 2026.2 Help Center, and VeloBrain plays the same role inside VeloCloud; both are operations consoles over Arista's own platform, so they're described here and scored nowhere.\n\nIt's network only. Nothing schedules GPUs, sets quotas or fair-share, or orchestrates compute; the only Kubernetes touchpoint is Container Tracer visibility, so the enterprise runs Slurm, Kueue or Run:ai beside it. AI-job awareness is visibility with unconfirmed GA: the March 2025 release dated AI job-centric observability for Q2 2025, Networking Field Day 40 (April 2026) showed a jobs dashboard correlating training jobs with flows, servers and switches, and Network World (February 2026) reported more host telemetry in the works. Even at GA it sees jobs and doesn't place them.\n\nCalibration: Nokia reads moderate at the thin end on Event-Driven Automation, a data center fabric plane. CloudVision is broader in domain and documents an approval stage, but it's still network-only, so it sits mid-band, above Nokia and below anything that touches compute. Cisco reads moderate with Intersight, which covers compute; HPE (GreenLake) reads strong and Dell (OpenManage) moderate.", "borrowedJudgment": "The enterprise decides. Studios render and enforce intent the enterprise declared, change control executes approved changes and rolls them back on command, and AVD is literally the enterprise's code, so the grade-carrying half makes no runtime judgment of its own. Portability splits: CloudVision's Studios, configlets and templates are CloudVision objects and don't lift, while AVD and ANTA are open-source code the enterprise runs without Arista. AVD's output is EOS, and that captivity is carried by the EOS chips at 0B, not by the code that writes it. CVaaS is operated by Arista and CloudVision Portal by the enterprise; the chip reads the same either way.", "notes": "Named, not scored: AI job-centric observability in CV UNO (GA dated Q2 2025 in the March 12, 2025 release, unconfirmed in product docs; shown at Networking Field Day 40, April 9, 2026). Remote EOS AI agent on NVIDIA BlueField-3 SuperNICs or servers, streaming NIC telemetry into NetDL (customer trials 2H 2024, May 29, 2024 release; GA not documented), which would be CloudVision's one NVIDIA hardware dependency in its AI story. Agentic AVA: see 2C.", "components": [ { "component": "CloudVision, fleet and intent plane facet (CloudVision Portal on-prem or CVaaS)", "detail": "Studios, configlets, change control with RBAC approval and rollback, CV UNO observability (CVaaS only), CloudVision Cognitive Unified Edge (CV-CUE) for Wi-Fi, read-only support for Cisco and VMware. Per-switch subscription tiers. The opinions are CloudVision objects. Same product and reading as its 0B facet.", "dapm": "Ceded" }, { "component": "Arista Validated Designs (AVD) and ANTA (Apache-2.0)", "detail": "Open-source Ansible collection (v6.4.0, August 28, 2026) that turns enterprise-owned YAML fabric models into EOS configuration and CloudVision workspaces and change controls, and open-source network test automation (v1.10.0, September 10, 2026). The enterprise possesses and runs both without Arista. The rendered target is EOS only.", "dapm": "Retained" } ] }, { "id": "layer2b", "label": "Layer 2B", "shortName": "Runtime", "title": "Application Runtime & Execution", "purpose": "Model serving, agent execution, inference APIs, distributed inference", "status": "gap", "statusLabel": "No Runtime; the MCP Server Is Beta and Read-Only", "authority": { "decides": "absent", "visible": null, "overridable": null, "boundary": "vendor", "direction": "Absent" }, "nvidia": [], "gap": "Arista hosts no runtime the enterprise deploys its own models or agents on. Its AVA white paper draws an \"AVA Runtime\" under Ask AVA and AVA's agents, but that's the engine of Arista's own assistant. Three surfaces come close and none is a customer runtime. Ask AVA is labeled Beta in the CloudVision 2026.2 Help Center and is an operations assistant over Arista's own platform, described at 2A. The EOS Model Context Protocol (MCP) server (Apache-2.0, npm @aristanetworks/eos-mcp-server, v0.6.1-beta, September 28, 2026) is a tool door for the enterprise's own agents: read-only over EOS's eAPI (show commands, logs, facts, running configuration), it never exposes configuration-changing operations, and its README says it's beta, best-effort and not supported by Arista's Technical Assistance Center, so it's out on the GA gate. The remote EOS AI agent on BlueField-3 is network interface card telemetry, not a runtime, with GA undocumented.\n\nThe MCP README carries a finding worth stating: it warns that large language models have occasionally tried to bypass the server and make configuration changes through other means, such as SSH, and tells operators to scope credentials to read-only. A read-only tool list doesn't constrain a model holding other credentials. The deterministic gate has to sit outside the model: in the credentials it holds, or in code the enterprise runs between the model's decision and the effect (a hook, a persisted approval rule, client-side execution that can refuse).\n\nCalibration: Nokia reads gap here, with Ask EDA a console. Dell, HPE and Cisco read moderate on blueprints, Private Cloud AI and AI Defense; Arista has no counterpart, and nothing in its Network Detection and Response (NDR) documentation names AI-agent or LLM traffic detections.", "borrowedJudgment": "None. The enterprise runs its own serving and agents.", "notes": "Named, not scored: EOS MCP server (beta, read-only, not TAC-supported). No official CloudVision MCP server; github.com/noredistribution/mcp-cvp-fun is a community demo.", "components": [] }, { "id": "layer2c", "label": "Layer 2C", "shortName": "Reasoning", "title": "Agentic Infrastructure — The Reasoning Plane", "purpose": "Policy-driven placement and resource coordination — the Autonomy Layer", "status": "gap", "statusLabel": "Approval Gates Scoped to Arista's Own Plane", "authority": { "decides": "absent", "visible": null, "overridable": null, "boundary": "vendor", "direction": "Absent" }, "nvidia": [], "gap": "Three candidates, and none earns the cell. CloudVision change control documents a review-and-approve stage under role-based access control (RBAC) with rollback, and Arista Validated Designs (AVD) can open change controls pending approval. Whether an agent writing through AVD or the CloudVision API hits an independent gate is configuration: the Non-Author Change Control Review setting requires a different approver, while AVD's workflow can also approve and start a change itself. Nothing documents third-party agents being routed through it, and it governs changes to Arista's network only. Ask AVA itself is labeled Beta in the CloudVision 2026.2 Help Center and never makes configuration changes. The agentic Autonomous Virtual Assist (AVA) expansion, and One AVA shown at Mobility Field Day 14 (May 2026), investigate from tickets and propose remediation, with explicit admin approval for corrective changes, formal change control for structural ones, and RBAC enforced; the December 2025 release said GA was expected by Q1 2026, the May 20, 2026 release says AVA is evolving into multi-domain agentic AIOps, and no GA documentation was found, so it's named, not scored. AGNI (Arista Guardian for Network Identity) is GA network access control that identifies and authorizes users, endpoints and IoT devices; identity for devices on the network doesn't fill an agent-identity leg, which is GA of the wrong function for this layer.\n\nLegs scoped inside one vendor's products are that product's own governance, and the moderate floor at 2C is a gateway every agent and model call passes through. There's no agent identity, gateway, registry or orchestration across agents. The 2B finding carries over: Arista's own Model Context Protocol (MCP) README documents models trying to route around a read-only tool door, so a gate on Arista's control plane doesn't sit in front of an agent's other credentials; that gate has to sit in the credentials or in the enterprise's own code.\n\nCalibration: Nokia and Dell read gap and Absent; Cisco reads moderate on Duo agentic identity and AI Defense, which span applications; HPE reads moderate on GreenLake Intelligence, an IT-operations agent mesh. If One AVA ships GA with documented approval gating, it becomes that question, still scoped to Arista's own domains.", "borrowedJudgment": "None scored. The enterprise brings its own agent governance.", "notes": "Overdue against its stated date: agentic AVA (multi-domain correlation, multi-turn Ask AVA, continuous monitoring with automated root-cause analysis, MCP access for Arista and third-party agents), \"expected to be generally available by Q1 2026\" (December 10, 2025 release); not confirmed in product documentation. Arista webinar on the AVA approach to agentic network operations, October 22, 2026.", "components": [] }, { "id": "layer3", "label": "Layer 3 (+1)", "shortName": "Applications", "title": "AI Application Layer — The Value Plane", "purpose": "AI-powered business capabilities — business logic, workflow automation", "status": "moderate", "statusLabel": "NDR and AGNI, First-Party Security Applications", "authority": { "decides": "model", "visible": true, "overridable": false, "boundary": "model", "direction": "Ceded" }, "nvidia": [], "gap": "Arista sells documented, generally available (GA) first-party security applications. Arista Network Detection and Response (NDR), formerly Awake Security, is AI-driven threat detection from sensors across data center, campus, Internet of Things (IoT) and cloud networks, sold as appliances and licenses: the appliance quick start guide lists the sensor, All-in-One, Nucleus and Central Console models, and NDR and NDR Campus datasheets exist. Its detection uses supervised and unsupervised machine learning and deep neural networks. It watches the enterprise's traffic, whatever network carries it, so it's a security capability, not a console over Arista's own platform. CV AGNI is cloud-delivered network access control (NAC), with an on-prem option shipping since July 2025, that identifies, profiles and authorizes users and devices on any standards-based wired and wireless infrastructure, federated with Okta, Entra, Google Workspace, OneLogin and Ping; Arista's documentation index lists an AGNI on-premises setup and access guide, and the AVA white paper says AGNI uses ChatGPT's models through OpenAI's APIs beside support vector machine models, a model dependency inside a NAC product.\n\nSecurity-operations opinions accumulate in these products: NDR's detection models and entity graph, and AGNI's segmentation and access policy. RADIUS and 802.1X are standard; the policy model isn't. The scope is network security, a fixed-function slice, so the grade is moderate. Arista names an ecosystem of strategic partners and independent software vendors (ISVs) as a logo directory, with no AI application catalog procured on Arista's paper, so partner doesn't apply.\n\nCalibration: Cisco's Layer 3 credits its security portfolio and Splunk as first-party application components, Lenovo reads moderate on first-party applications, and Nokia reads moderate on its documented Deepfield Defender. Named, not scored: MSS and ZTX microsegmentation (GA, network security policy), Edge Threat Management on VeloCloud (GA dated Q4 2026).", "borrowedJudgment": "The enterprise borrows NDR's detection judgment, and a model makes the call: its machine-learning models infer threats from runtime traffic, and no document shows a per-detection override the engine must honor, so the reading is Ceded at the model boundary. It can't take the tuning with it: NDR's models and AGNI's policy are Arista objects, and leaving means rebuilding them in another product.", "notes": "A documented per-detection suppress, dismiss or allowlist that the engine must honor would move the authority to Delegated; none was found in the NDR product page or datasheet. Watch item: VeloCloud Edge Threat Management, GA Q4 2026 (July 21, 2026 release).", "components": [ { "component": "Arista NDR (sensors, Nucleus, Central Console)", "detail": "AI-driven network detection and response from sensors across data center, campus, IoT and cloud networks. Proprietary detection models and entity graph; leaving means rebuilding detection in another NDR.", "dapm": "Ceded" }, { "component": "CV AGNI (cloud or on-prem network access control)", "detail": "Identifies, profiles and authorizes users and devices on any standards-based wired and wireless infrastructure, federated with enterprise identity providers. The access and segmentation policy model is AGNI's; RADIUS and 802.1X don't port it.", "dapm": "Ceded" } ] } ] }