AI control plane
also called agent control plane · AI agent control plane · agentic control plane · AI governance platform
In a network, the control plane computes the routing table and the data plane forwards packets according to it. The split is useful because it names two failure modes that feel different: a control plane that is wrong sends traffic to the wrong place, and a control plane that is merely slow lets traffic keep flowing under yesterday’s rules. Both carry over to agent estates, where the request path usually performs both jobs in one process — the same component that decides whether a call is permitted is the one that forwards it — and where the words are consequently used loosely enough that the label alone tells a buyer very little.
What is actually inside one is a short list. A record per agent, carrying an identifier, a named human owner, a team, a declared purpose, a risk tier, a lifecycle status and a budget. An authorisation model saying which actions each agent may take. A policy set describing the conditions under which a request is blocked, altered or held. Registrations for the model providers and tool servers the estate is allowed to reach, with custody of the credentials for them. And a store of what happened. The thing that makes this a control plane rather than an inventory is a single property: the enforcement point resolves the same record on every call. If it does, an edit to the record changes behaviour on the agent’s next request. If it does not, the record is documentation.
That property is also the test to apply when evaluating one, because failing it is common and quiet. The recognisable symptom is two lists: an inventory maintained beside the runtime, which is updated by whoever remembers, and the runtime configuration, which is updated by whoever ships. They diverge in the first week and nobody finds out until an audit. The subtler symptom is propagation. A control plane that pushes configuration to enforcement points on a schedule is advisory for the length of the interval, so the questions worth asking are what the propagation delay is, what happens to in-flight decisions when the sync fails, and whether suspending an agent takes effect on its next call or at the next deploy. A caching layer is a reasonable engineering answer to latency; it is a governance claim only once somebody has written down how stale the cached authority may be.
The category label is crowded and it is compressing further. Hyperscalers, enterprise control towers, identity vendors, security platforms, API gateways, observability products and open protocols all describe part of their offering as an AI or agent control plane, and each has a genuine claim to a piece of it — Microsoft Agent 365 and Entra Agent ID, ServiceNow AI Control Tower, Okta and Google on discovery, ownership, sponsorship and lifecycle; Kong, Envoy, Portkey and Cloudflare on routing, quotas and credentials; AWS AgentCore and its equivalents on bundling runtime, gateway, identity and observability together. Those are vendor-authored descriptions and have not been independently tested here. The useful conclusion is not that one of them is the real one, but that the phrase names a slot rather than a capability, and that three questions separate its occupants: does it decide or only describe, is it in the path or beside it, and what does it do when it cannot decide at all.
The last of those is where the honest cost sits. A control plane that can refuse is a dependency for everything it governs, and an organisation adopting one is trading a diffuse governance risk for a concentrated availability risk. That is usually the right trade for consequential actions and the wrong one for an estate of drafting assistants whose output a human reads before anything happens. It is a decision to make deliberately, with a named owner for the question of what happens when the control plane is unavailable, rather than one to discover during the first incident.
Suspending an agent, two ways
An agent starts behaving oddly at 02:00 and an on-call engineer sets its status to suspended. In one architecture the status lives in a record the request path reads on every call, so the agent’s next request — the one already in flight behind the one that raised the alert — is refused, and the refusal is recorded against the agent, its owner and the operator who suspended it. In another, the status lives in a registry that publishes to enforcement points every five minutes, or on the next deploy, or when somebody runs the sync job; the agent keeps working for a window nobody measured, and the record of the suspension is accurate about the intent and silent about the effect. Both systems will show the agent as suspended in the morning. Only one of them can tell you what it did after you suspended it.
What ai control plane is routinely confused with
- LLM gateway
- A gateway is the data plane: it carries the request, holds the credentials and applies quotas. A control plane holds the authority the gateway enforces. Most products that occupy the gateway slot include some control-plane state, and most control planes ship a gateway, so the distinction is about which half the product is actually for — connectivity, or the decision.
- Agent registry or AI inventory
- A registry is the record of which agents exist and who owns them. It becomes a control plane only when something in the request path reads it. A registry nothing enforces against is a spreadsheet with better formatting, and it drifts from the running estate at the speed of the first undocumented deploy.
- AI control tower
- Control towers govern the organisation’s AI portfolio: discovery, ownership, lifecycle, risk mapping, business-value reporting. They are usually the authoritative upstream for identity and asset data, and they are usually not in the request path, so they answer which agents exist and not whether this call may proceed.
Related terms
LLM gateway
An LLM gateway is a proxy that sits between applications and one or more model providers, presenting a single endpoint and a single credential while handling provider routing, failover, rate limiting, caching, key custody and usage accounting on their behalf. Applications adopt one by changing a base URL rather than by rewriting code, which is why it is usually the first piece of shared AI infrastructure an organisation deploys.
AI gateway
An AI gateway is a policy-bearing proxy for AI traffic: it terminates the calls an application or agent makes to models, tool servers and other agents, and applies authorisation, inspection, quota and logging rules to them before they reach the upstream. The term is used for at least three different products — an API gateway extended to model traffic, a security-inspection layer sold as an AI firewall, and a cloud runtime that bundles gateway, identity and observability — so the label describes a position in the architecture rather than a set of guarantees.
Inline enforcement
Inline enforcement means the decision to allow, refuse, alter or hold an action is taken in the path the action must travel, before it takes effect, by a component the acting system cannot bypass or overrule. The alternatives — a rule the agent is asked to follow, a check inside the agent’s own framework, an alert raised afterwards — are advisory rather than enforcing, because in each case the party being governed is also the party enforcing.
AI agent governance
AI agent governance is the practice of deciding, outside the agent and before it acts, whether the authority it is about to exercise is authority somebody actually delegated to it — and of recording afterwards what it did with that authority in a form that survives the people who could edit it. What separates it from model safety, from observability and from identity management is where the decision sits: in the path the action must travel, where it can refuse, rather than in a policy document, a dashboard, or a nightly reconciliation.
Where Token Observe does this
The definition above is the field's, not the product's. This is the part of the product that implements it, for a reader who wants to see one.
Agent registry
One record per agent, and it is the record the gateway enforces against.
An overdue review never suspends the agent itself
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Injection scoring is nine fixed patterns, not a model
Agent permissions
Deny by default, explicit deny wins, and delegation intersects — so an agent cannot borrow authority it was never granted.
Off by default; only enforce refuses anything
The terms next to this one
What the field is called, what its members have in common, and the one property that separates them from each other.
Definitions are the easy part.
The glossary is written to be useful whether or not you ever buy anything. If you have got to the point of deciding how to implement one of these in your own estate, say what your agents do and you will get a straight answer about what it would actually take.
no form · no qualification step · no sales desk · the other three ways in