In networking, the control plane decides where traffic goes and the data plane moves it. Agentic systems need the same split. The model and its tools are the data plane: they do work. The control plane decides which work is allowed, how much, and under whose authority.
What the control plane owns
- Registry. Which agents exist, which version is live, which tools each may use.
- Policy decision. For every proposed action: allow, deny, or require approval.
- Budgets. Token, time, tool-call, and money limits per run and per tenant.
- Kill switches. The ability to stop one agent, one tool, or one tenant without a deploy.
- Audit. An append-only record of proposals, decisions, and outcomes.
A minimal decision loop
The simplest useful control plane is a function the orchestrator must call before every side effect:
decision = control_plane.authorize(
agent_id, agent_version,
on_behalf_of=user,
action="crm.update_contact",
arguments=args,
run_budget=run.remaining
)
# decision.effect in {"allow", "deny", "needs_approval"}Three properties make this work. The call is synchronous, so no side effect happens without a decision. The decision is deterministic given its inputs, so it can be tested and replayed. And the agent cannot skip it, because tool credentials are only issued after an allow.
Why not put this in the prompt
Prompts are advice, not enforcement. A system prompt that says "never delete records" is a request the model will usually honor. A control plane that does not hold delete credentials is a guarantee. Enterprise risk teams can sign off on the second, rarely the first.
Versioning is the underrated feature
When an agent misbehaves, the first question is "what changed?" A registry that pins prompt, model, tool set, and policy bundle to a single agent version turns that question into a diff. It also makes rollback a pointer change instead of an incident.
Start small
You can begin with a config file, an allow-list, and a logging wrapper. What matters is that the *shape* exists: every action routes through one choke point that can say no. Everything else, dashboards, approval UIs, tenant quotas, grows into that shape without a rewrite.