Workato
Azure
MuleSoft
Salesforce
AWSReady To Modernize Your Architecture?
Discuss your current infrastructure and scalability goals with our integration experts.
Article Series
The Control Plane: What “Governed Agents” Actually Look LikePart 2 · you are here
Controls inside the agent are controls that the agent — or its attacker — can reason around. The fix sits outside.
In my last article — “The AI Decided” Is Not a Defense — we left three questions an auditor will ask about AI agents: what’s running, who owns it, what can it touch.
That piece cited published survey and breach research — not a survey we ran — including IBM’s Cost of a Data Breach 2025 (63% of breached organizations had no AI governance policy or were still writing one; of the 13% that reported a breach of an AI model or application, 97% reported lacking proper AI access controls) and the Cloud Security Alliance’s 2026 survey with Token Security (n=418: 82% had unknown AI agents running in their environments; 65% reported at least one AI agent–related security incident in the past twelve months). Fear without a path is just doom. So here is the path: the architecture those numbers imply is a control plane — controls outside the agent. In 2026, vendors and analysts are using that noun for a product category, not only a slide title.
01 — Start with Why: The pattern three incidents prove
The instinct after every agent incident is to make the agent smarter. The disclosed CVEs of the past year argue the opposite.
No governance product would have “stopped” these CVEs — all three ran inside Microsoft’s and AWS’ own products, on traffic no customer gateway would have intermediated. The lesson is architectural. EchoLeak’s agent behaved exactly as designed. Copilot’s agent turned off its own safety settings. Amazon Q’s agent was compromised at the source. Controls inside the agent are controls that the agent, or its attacker, can reason around. The fix sits outside: a registry the agent can’t hide from, a gateway it can’t reconfigure, an identity it can’t escalate, and an approval channel it can’t answer for you.
Figure 1 — Each incident illustrates a control that must exist for the agents you build and route. None of these failures were stopped by a policy living only inside the agent.
The pattern keeps producing examples. On July 7, 2026, SAND Security disclosed that Writer AI’s agent-preview sandboxes forwarded session cookies into the sandbox, enabling cross-tenant account takeover — exposing another customer’s private chats, documents, agent configurations, private models, connectors, and LLM credentials. Writer patched it within 24 hours; published accounts state that no customer data was compromised. Note the shape, though: the agent’s own execution environment was the attack surface, and the fix was infrastructure, not a smarter prompt.
02 — Four controls, and four independent frameworks that converge on them.
Strip the vendor language from the major agent-security frameworks published so far — OWASP’s, Forrester’s, the Cloud Security Alliance’s, and the six-agency government guidance — and the same four controls fall out:
- 1. See everything. A live inventory of every agent — named owner, lifecycle state, what it can access.
- 2. Gate every action. One enforcement point, outside the agent, where identity, policy, data rules, and quotas are checked at each call.
- 3. Propagate identity. The end-user’s identity rides every hop, so backends enforce that person’s permissions — not a "god-mode" service of accounts.
- 4. Watch and cap. Behavioral telemetry, per-agent usage limits, and audit evidence you could hand to a regulator.
Four independent bodies, working from different mandates, arrived at that same architecture. OWASP’s Top 10 for Agentic Applications (December 9, 2025) reaches it by way of application security: enforcement before execution that treats model output as untrusted; distinct governed identities per agent — its AS103 entry covers the identity and privilege abuse risk an agent falls into without one; bounded tool access; continuous behavioral monitoring. Forrester’s AEGIS framework calls for scaled discovery and cataloging of agents, gateway-style enforcement, and identity lifecycle governance for "a new class of identity: autonomous, adaptive, and short-lived."
The Cloud Security Alliance’s agentic profile of the NIST AI RMF (March 27, 2026, draft status) is the most explicit. Its reference enforcement architecture has a name — AAGATE — and two of its sentences are worth quoting exactly:
"The Tool-Gateway Chokepoint implements the single control point through which all external interactions — API calls, database operations, file access — are funneled and audited."
And on why it sits there:
"rather than attempting to enforce these controls in the agent itself (which may be compromised or manipulated), AAGATE enforces them at the infrastructure level where they cannot be bypassed through adversarial influence on the model."
Gartner forecasts that "guardian agents" — technologies that monitor, redirect, and block agent actions — will be 10-15% of the agentic AI market by 2030. And May’s six-agency CISA-led guidance urges per-agent cryptographic identity with short-lived credentials, least privilege, human control points for high-impact actions, and tamper-evident audit logs. Different vocabularies; the same four controls.
03 — "Control plane" is now a category, not a slogan.
If you suspect this is one vendor's marketing frame, the market disagrees - loudly.
- Microsoft - Agent 365: GA May 1, 2026, billed as "the control plane for AI agents": a registry, access control through Entra and Intune, an "Agent Map" of agent-to-resource relationships - $15 per user per month standalone, also bundled into the M365 E7 "Frontier Suite" at roughly $99 per user. Its registry preview even syncs in agents from AWS Bedrock and Google Gemini Enterprise.
- IBM - the Agentic Control Plane: Launched June 2026 in watsonx Orchestrate under the banner "One place to control every AI agent": in IBM's description, a centralized layer for operating, governing, and scaling agents wherever they were built or run.
- Boomi - Agent Control Tower: A single control plane spanning Bedrock, Copilot, Snowflake Cortex, and Agentforce.
- Forrester: Forrester has formally opened an evaluation of the agent control plane market. Separately, its analyst Leslie Joseph ran an informal poll of 47 tech vendors in late February 2026: "Seventy-nine percent of participating vendors recognize agent control planes as a meaningful and distinct product category," and "Forty percent report active RFPs or customer buying motions that explicitly request a control plane or equivalent."
Gartner projects agentic orchestration will redirect $550 billion in software and services spend by 2029, with these platforms as the control layer over how agents collaborate and comply with policy.
When Microsoft, IBM, Boomi, Salesforce, and both major analyst houses converge on the same noun in the same year, the noun is the category.
04 — Anatomy of a control plane: MuleSoft Agent Fabric, concretely.
Categories are abstract; controls ship with GA dates. Here is the four-control anatomy as MuleSoft ships it — the stack we implement.
Controls live outside the agent — a registry it can't hide from, a gateway it can't reconfigure, an identity it can't escalate. But only traffic routed through the gateway is governed.
GA dates per docs.mulesoft.com Agent Fabric release notes; platform list per docs.mulesoft.com/exchange/agent-scanners (verified July 28, 2026). Traces labeled Beta in Anypoint Monitoring release notes. Dollar budget caps and a kill switch were announced June 24, 2026 and do not appear in the release notes as of July 28, 2026.
Figure 2 — The control plane sits between every agent platform and everything those agents can touch. Controls live outside the agent, at a layer it can't rewrite.
See.
Registry capability arrived in the October 3, 2025 release wave — alongside Agent Visualizer, Agent Broker orchestration, and Omni Gateway policies. Agent Scanners went GA January 30, 2026, initially covering three platforms. The Agent Registry's Agent, MCP, and LLM asset types, Trusted Agent Identity, and related governance capabilities appear in the April 29, 2026 Agent Fabric notes as newly available on Canada Cloud and Japan Cloud — a regional expansion of capabilities already shipping elsewhere, not an original GA date.
Scanners patrol connected platforms to "detect new, updated, or deprecated agents." The supported set has expanded well beyond that initial short list: the scanner docs now list eleven, Salesforce Agentforce among them — Amazon Bedrock, Bedrock AgentCore Runtime, Anthropic Claude, Databricks Agent Bricks, GoDaddy ANS, Google Gemini (the docs' label; earlier release notes said Vertex AI), LangChain LangSmith, Microsoft Azure Copilot, Microsoft Foundry, Salesforce Agentforce, and Snowflake Cortex AI. A changed agent becomes a visible event, not a silent one.
Gate.
Omni Gateway — Flex Gateway renamed, in Omni Gateway 1.13.0, May 11, 2026 — is the same production engine, now carrying agent policies across the A2A, MCP, and LLM protocols. The ones that matter are named and checkable in the docs: PII detection for LLM, A2A, and MCP traffic; MCP Global Access tool allow-listing; MCP Attribute-Based Access Control; schema validation; a Regex Prompt Guard deny-list; and pass-throughs to Azure Content Safety and Amazon Bedrock Guardrails. Salesforce's own framing is the right one-liner: Agent Fabric connects AI agents to the work they need to do; Omni Gateway governs the traffic those agents generate.
Propagate identity.
Trusted Agent Identity injects the end-user's own OAuth token at the gateway via token exchange, so every downstream system sees the human, not a shared service account. The gateway's on-behalf-of governance also supports OpenID Connect CIBA step-up: a mid-flow MFA prompt pushed to the user's own device before a high-risk action proceeds, with zero application code changes. An agent cannot self-approve what a human must approve on another channel.
Watch and cap.
Agent Visualizer (from the October 3, 2025 wave) renders the live topology of your agent network, with per-node metrics and drill-down to logs; token-based rate limits cap consumption per user or agent per window (HTTP 429, remaining-quota headers). One caveat to carry into any audit conversation: Anypoint Monitoring's release notes label Traces — the feature as a whole, not just its agentic spans — as Beta, and nothing has graduated it since the October 2025 entry added spans for agentic assets. And the rate limit is the point. Cost telemetry without enforcement is a dashboard, not a control: Uber's 2026 AI coding budget was exhausted in four months. A later post in this series takes that up on its own.
05 — Seen is not governed
Here is the distinction that determines whether your control plane is real, and it tends to get lost in the product messaging: discovery is automatic; enforcement is not. Scanners find agents on connected platforms without touching the agents themselves — that part genuinely is a switch you flip. But an agent is only governed if its traffic actually flows through the gateway, which requires its tool and action definitions to resolve to gateway endpoints rather than the backend directly. For an Agentforce agent, that means its actions and Named Credentials; for a Bedrock agent, its action groups; for a custom agent, its MCP server configuration. A per-agent change, made once — but it must be made.
And the gateway only controls what is forced through it. If a Bedrock agent still holds a direct credential to core banking, or an Agentforce Named Credential still points straight at the ERP, the gateway is decorative for that path. The real enforcement mechanism is the gateway plus the absence of any other route: backends that accept calls only from the gateway, agent platforms that no longer hold direct secrets. "See" is a feature you switch on. "Gate" is an architecture you implement. That gap is where the delivery work lives.
This is no longer early-adopter territory: Salesforce's Agent Fabric announcement names Barco, Rush University System for Health, Wynn and Encore Las Vegas, and r.Potential; follow-on coverage adds AT&T and Capita, the latter running more than 350 production AI agents under Agent Fabric governance. And Agent Network 2.0 went GA July 14, 2026, with Agent Script, a graph-based orchestration language separating probabilistic LLM reasoning from deterministic control flow — the orchestration itself becomes reviewable.
06 — What a control plane still won't do.
The limits — because a governance pitch you can't audit is part of the problem.
| THE LIMIT | THE PRECISE VERSION |
|---|---|
| No dollar budgets, no kill switch | MuleSoft's documented cost control is token quotas per window — not a spend cap in currency, and not a button that halts a running agent. MuleSoft announced both an Agent Kill Switch and a "Model Wallet" on June 24, 2026, stating that availability would be announced later that quarter; no GA date has been published since. As of July 28, 2026, neither appears in either of MuleSoft's Agent Fabric release-notes documents; the only July entry in each is Agent Network 2.0. Treat both as direction of travel, not as controls you can operate today — and if any vendor tells you otherwise, ask for the documentation page. |
| Prompt injection isn't "solved" at the gateway | The native defense is regex deny-listing plus pass-throughs to Azure Content Safety and Bedrock Guardrails — useful, but not a semantic classifier. The purpose-built classifiers live in the open-source world. |
| Discovery requires connection | Scanners find agents on platforms you've connected. Nobody citeably "finds agents you don't know exist" on accounts you never linked. |
| Evidence isn't compliance | No vendor maps a feature to a regulation article. A control plane generates the evidence; your governance program — autonomy tiers, sign-offs, disclosures — is what a regulator assesses. |
07 — Where API People fits.
The four controls have a natural order, and getting it wrong is expensive: inventory first (you can't gate what you can't see), then the gateway, then identity propagation, then quotas and telemetry. API People is an integration and automation partner with deep MuleSoft Anypoint expertise and a delivery record in the industries where these controls face examiners — banks, credit unions, and fintechs on cores like Fiserv, Jack Henry, and FIS, plus healthcare and other highly-regulated environments. Our Discovery Workshop starts where the architecture starts: your first real agent inventory in 30 days — what's running, who owns it, what it can touch — then a sequenced rollout of the remaining three controls mapped to your regulatory calendar. The product ships the controls; we make them defensible in your environment.
08 — The three questions, one more time.
What's running. Who owns it. What can it touch.
Last time, those questions were the fear. With a registry, a gateway, propagated identity, and telemetry in place, they become something better: a report you run. That's the whole difference between an AI program that survives its first audit and one that becomes the case study in someone else's fear post. Can your organization answer them today?
If you're trying to figure out what governed AI tooling would actually look like inside your own systems, that's the conversation API People is built to have. Reach out to us to talk through what this looks like for your environment.
Reach out →Sources
Every figure in this article traces to one of the following.
01
CVE-2025-32711 (EchoLeak), CVE-2025-53773 (GitHub Copilot), CVE-2025-8217 (Amazon Q extension) — NVD; AWS security bulletin.
02
Writer AI agent-preview sandbox flaw — SAND Security, "WriteOut: Abusing the Sandbox for a Critical Cross-Tenant Vulnerability in Writer AI"; coverage in The Hacker News, July 7, 2026. Patched within 24 hours; published accounts state no customer data was compromised.
03
Uber's 2026 AI coding budget — Forbes and Fortune coverage, May 2026.
04
IBM, Cost of a Data Breach Report 2025 — 63% of breached organizations had no AI governance policy or were still developing one; 13% of organizations reported a breach of an AI model or application, and 97% of those reported lacking proper AI access controls.
05
Cloud Security Alliance with Token Security, "Autonomous but Not Controlled," April 2026, n=418 — 82% had discovered agents running in their environment they didn't know about.
06
OWASP, Top 10 for Agentic Applications 2026 — published December 9, 2025; ASI03, Identity & Privilege Abuse.
07
Forrester, AEGIS framework — Agentic AI Enterprise Guardrails For Information Security.
08
Cloud Security Alliance, Agentic AI profile of the NIST AI RMF — published March 27, 2026, draft status; AAGATE reference architecture.
09
CISA, NSA, NCSC-UK, ASD’s ACSC, CCCS and NCSC-NZ — “Careful Adoption of Agentic AI Services,” released May 1, 2026.
10
Microsoft — Agent 365, GA May 1, 2026; $15 per user per month standalone, also bundled in the Microsoft 365 E7 “Frontier Suite” at roughly $99 per user; agent registry with Bedrock and Gemini Enterprise sync in public preview.
11
IBM — Agentic Control Plane in watsonx Orchestrate, June 2026.
12
Boomi — Agent Control Tower.
13
Forrester — “Announcing Our Evaluation Of The Agent Control Plane Market”; the 79% and 40% figures are from Leslie Joseph’s poll of 47 technology vendors in late February 2026, reported in “Agent Control Planes Still Need A Robust Standards Stack”.
14
Gartner — “Guardian Agents will Capture 10-15% of the Agentic AI Market by 2030,” press release June 11, 2025; Tech FutureSight, agentic orchestration as a $550B control layer by 2029 (document 7086598).
15
Agent Fabric release notes — the canonical source for every GA date cited above: October 3, 2025 wave, including Agent Visualizer, Agent Broker orchestration and Omni Gateway policies; Agent Scanners GA January 30, 2026; GoDaddy ANS discovery GA February 17, 2026; April 29, 2026 Canada Cloud and Japan Cloud availability notes covering Agent Registry asset types, Trusted Agent Identity and related governance; Agent Network 2.0 GA July 14, 2026.
16
Omni Gateway agent policies — PII detection for LLM, A2A and MCP traffic; MCP Global Access; MCP Attribute-Based Access Control; schema validation; Regex Prompt Guard; Azure Content Safety and Amazon Bedrock Guardrails pass-throughs. Omni Gateway is Flex Gateway renamed, in version 1.13.0, released May 11, 2026.
17
Agent Scanners supported platforms — eleven listed, including Salesforce Agentforce, Amazon Bedrock, Google Gemini, Microsoft Azure Copilot and Foundry, Databricks Agent Bricks and Snowflake Cortex AI.
18
Anypoint Monitoring release notes — Traces labeled Beta, October 3, 2025 entry.
19
Agent Kill Switch and Model Wallet — announced June 24, 2026, with availability to be announced later that quarter; absent from both Agent Fabric release-notes documents as of July 28, 2026.
20
OpenID Connect CIBA support for the gateway’s on-behalf-of governance policy.
21
Named customers — Barco, Rush University System for Health, Wynn and Encore Las Vegas, and r.Potential, per the Agent Fabric announcement; AT&T and Capita in follow-on coverage, with Capita running more than 350 production agents (salesforce.com/news; mulesoft.com/case-studies).
FAQs
What is an AI agent control plane?
A control plane is the architecture layer that enforces governance controls outside the AI agent itself — a live registry of every agent, a gateway that checks identity and policy on every call, propagated end-user identity instead of a shared service account, and telemetry with usage caps. Microsoft, IBM, Boomi, and MuleSoft all ship products under this name.
Why can’t security controls just live inside the AI agent?
Disclosed incidents (EchoLeak, GitHub Copilot’s “YOLO mode,” the Amazon Q extension compromise) show that controls inside the agent are controls the agent — or its attacker — can reason around or switch off. The fix has to sit outside the runtime, at a layer the agent cannot rewrite.
What are the four controls every AI agent governance framework converges on?
See everything (a live inventory of every agent, its owner, and what it can access), gate every action (one enforcement point outside the agent checking identity, policy, and data rules), propagate identity (the end-user’s identity rides every hop, not a shared service account), and watch and cap (behavioral telemetry and per-agent usage limits). OWASP, Forrester, the Cloud Security Alliance, and six national cyber agencies all independently arrive at the same four.
What does MuleSoft Agent Fabric actually do?
It implements the four-control anatomy with named, dated capabilities: Agent Registry and Agent Scanners for discovery, Omni Gateway for policy enforcement across A2A, MCP, and LLM traffic, Trusted Agent Identity for OAuth-based identity propagation with CIBA step-up MFA, and Agent Visualizer for topology and rate-limit telemetry.
What can’t an AI agent control plane do yet?
As of mid-2026, MuleSoft’s documented cost control is token quotas per window, not a dollar-denominated budget cap or kill switch. Prompt injection defense at the gateway is regex deny-listing plus vendor content-safety pass-throughs, not a semantic classifier. Discovery only covers platforms you’ve connected, and a control plane generates audit evidence — it doesn’t by itself constitute regulatory compliance.
How can API People help implement an agent control plane?
We run a Discovery Workshop that builds your first real agent inventory, then sequence the remaining three controls — gateway policy, identity propagation, and telemetry — against your regulatory calendar, drawing on our MuleSoft and Salesforce delivery experience in banking, credit unions, fintechs, and healthcare.
Free PDF
Read it offline — get the full PDF
Fill in two fields and the download starts right here.
- Every figure and diagram at full resolution
- All sources, linked and cited
No spam. We respect your inbox and your data.
Contact Us
Talk to an integration expert
About your environment — no pitch deck required.
