A method comprising: deploying a cluster of policy agents on a virtual private cloud that interconnects a plurality of virtual private clouds, the virtual private cloud and the plurality of virtual private clouds residing in a cloud associated with a multi-cloud fabric; mapping endpoints in the plurality of virtual private clouds to the policy agents in the cluster based on one or more common attributes; distributing security policies associated with the endpoints across the policy agents based on the mapping of the endpoints to the policy agents, wherein the security policies comprise groups of security policies defined for traffic associated with respective subsets of the endpoints, and wherein each group of security policies is deployed on a respective policy agent that is mapped to a respective subset of the endpoints associated with the group of security policies; advertising, by each respective policy agent in the cluster, to a respective first set of virtual gateways in the plurality of private virtual clouds, one or more routes associated with the respective subset of the endpoints mapped to the respective policy agent; based on border gateway protocol, BGP, route maps, preventing each respective policy agent in the cluster from advertising routes associated with a respective second set of virtual gateways in the plurality of private virtual clouds that route traffic for endpoints that the respective policy agent does not have security policies for; and in response to receiving traffic associated with one or more of the endpoints, applying, via the respective policy agent, one or more of the group of security policies deployed on the respective policy agent. deploying a cluster of policy agents on a virtual private cloud that interconnects a plurality of virtual private clouds, the virtual private cloud and the plurality of virtual private clouds residing in a cloud associated with a multi-cloud fabric; mapping endpoints in the plurality of virtual private clouds to the policy agents in the cluster based on one or more common attributes; distributing security policies associated with the endpoints across the policy agents based on the mapping of the endpoints to the policy agents, wherein the security policies comprise groups of security policies defined for traffic associated with respective subsets of the endpoints, and wherein each group of security policies is deployed on a respective policy agent that is mapped to a respective subset of the endpoints associated with the group of security policies; advertising, by each respective policy agent in the cluster, to a respective first set of virtual gateways in the plurality of private virtual clouds, one or more routes associated with the respective subset of the endpoints mapped to the respective policy agent; based on border gateway protocol, BGP, route maps, preventing each respective policy agent in the cluster from advertising routes associated with a respective second set of virtual gateways in the plurality of private virtual clouds that route traffic for endpoints that the respective policy agent does not have security policies for; and in response to receiving traffic associated with one or more of the endpoints, applying, via the respective policy agent, one or more of the group of security policies deployed on the respective policy agent.