What is an agentic control plane?

Identity

The control plane establishes who or what an agent is acting as, and ties that identity to a real accountable owner rather than a shared credential. Token Security and Entrust both argue that agent identity has become the de facto control point for enterprise AI, because it is “the only consistent layer where security teams can monitor, authorize, and audit agent behavior” regardless of which model, framework or vendor the agent runs on (Token Security; Entrust).

Policy

Rules about what an agent may do, which tools it may call, which data it may reach, and under what conditions, are defined once and enforced at the point of use rather than left to each agent’s own judgement. TrueFoundry describes this as policy enforcement operating “at the gateway layer before any agent requests are sent,” covering access control, tool permissions and data boundaries (TrueFoundry, What is an AI control plane?).

Credentials

Agents need to authenticate to real systems, but handing them long-lived secrets is a standing liability. A control plane centralises credential issuance and scoping so access can be granted narrowly, rotated, and revoked without touching the agent’s own code, rather than pasted into configuration files per deployment (TrueFoundry, as above).

Approval

Some actions are consequential enough that a policy rule is not sufficient; a named human has to say yes. This is usually framed as a human-in-the-loop or approval gate that pauses execution and routes the decision to an accountable person before the agent proceeds. Red Hat frames the equivalent AgentOps function as “guardrails and human-in-the-loop checkpoints to prevent unauthorized actions” (Red Hat, What is AgentOps?).

Audit

Every decision, whether allowed, blocked or escalated, is recorded in a form that can be inspected after the fact, independent of the agent that generated it. Forrester’s evaluation of this market lists “risk, compliance, and auditing” as a core capability, meaning decisions and policy changes are “recorded in auditable ways” (Forrester, Announcing our evaluation of the agent control plane market).

Forrester’s own definition draws these together at the estate level: an agent control plane is “an enterprise control plane that inventories, governs, orchestrates, and assures heterogeneous AI agents across vendors and domains” (Forrester, as above). Its use of “orchestrates” is looser than the technical sense of orchestration discussed below; Forrester’s capability list makes clear the emphasis is oversight of governance, not task sequencing.

Speakeasy also draws a line against two other near-neighbours: the Model Context Protocol (MCP) “describes how one request is handled, while the control plane governs how the whole fleet behaves,” and an AI gateway is “the enforcement mechanism,” with the control plane being “the broader layer the gateway is part of” (Speakeasy, as above).

The SaaS model

In the SaaS model, the control plane runs on the vendor’s infrastructure and enterprise agents call out to it for identity checks, policy decisions and audit logging; this is faster to adopt but means governance decisions and audit data leave the customer’s network boundary.

The self-hosted model

In the self-hosted model, the control plane runs inside the customer’s own infrastructure alongside the agents it governs, so identity, policy and audit records never leave the organisation’s security perimeter; TrueFoundry frames this as data sovereignty, where the control plane must “operate from your infrastructure” (TrueFoundry, as above).

Agent orchestration

Builds and sequences agent workflows; the control plane governs and audits them from outside that build layer, so oversight stays available even when an agent behaves unpredictably (per the orchestration-versus-control-plane distinction above from Speakeasy and Forrester).

AI governance

The broader organisational discipline of rules, accountability and risk management for AI systems generally, spanning models, data and agents. A control plane is one piece of technical infrastructure that AI governance programmes rely on to enforce their rules at runtime, rather than the governance programme itself.

AgentOps

The operational discipline of running agents in production: observability, evaluation, cost tracking and incident response, in the same relationship MLOps has to model training. AgentOps and a control plane overlap heavily on observability and guardrails, but AgentOps is oriented toward keeping an agent (or fleet) working well operationally, whereas a control plane is oriented toward whether an agent’s actions are authorised and provable after the fact. Red Hat’s definition of AgentOps as monitoring “the ‘brain’ of an AI as it makes decisions in real time” (Red Hat, as above) captures the operational focus; a control plane cares less about decision quality and more about decision authority.

The category also appears in academic work, not just vendor content: a 2026 paper on agent operating systems proposes “integrating an agentic control plane into existing operating systems,” decomposed into schedulers, tool and capability registries, policy and trust enforcement, and observability/audit functions (Agent Operating Systems (AOS), arXiv:2606.01508), which maps closely onto the identity/policy/credentials/approval/audit list above, independently of any vendor’s framing.