The control plane is a category before it is a product.

A single agent needs a prompt, a model and a tool. A fleet of agents needs an answer to who authorised this, what it is allowed to touch, what it did last night, what it cost, and who is accountable when it is wrong. The control plane is the system that holds those answers.

In network infrastructure the data plane moves packets and the control plane decides how packets should be moved. Applied to agents, the data path is the agent doing its work: reasoning, calling tools, writing to systems of record. The control plane is everything that decides what that agent may do, records what it actually did, and changes the rules without changing the agent.

Forrester's definition, published on 4 December 2025, is the closest thing the market has to a formal one: an enterprise control plane that inventories, governs, orchestrates and assures heterogeneous AI agents across vendors and domains. IBM defines it as the system that deploys, operates, monitors and governs agents across an organisation. The two differ on scope, which matters commercially and is covered in section 03.

Assistants that summarise and draft carry review risk. Agents that send, purchase, refund, escalate and update records carry action risk, and action risk is what security teams, auditors and regulators price. The Cloud Security Alliance and Zenity found that 53 % of organisations have already seen agents exceed intended permissions, while only 31 % had formally adopted policies for agents at all. That distance between capability and control is the market.

Four independent sources converge once the word agent is defined tightly. Menlo Ventures placed 16 % of enterprise deployments in the true-agent category, where a model plans, executes, observes and adapts, against 27 % for startups, and described the remainder as fixed-sequence or routing workflows wrapped around a single model call. Gartner reported 17 % deployed. McKinsey put roughly 20 % of organisations at the scaling stage for agents, against 47 % for conversational assistants.

Figures above 50 % are counting assistants and copilots. Okta's Businesses at Work 2026 found 91 % of organisations already using AI agents on a sample screened for AI use, and in the same study only 10 % reported a well-developed strategy for managing them.

McKinsey's 2026 survey of 1,719 respondents across 97 countries found 40 % of large organisations scaling AI agents, up from 27 % the year before. In the same survey the share attributing any EBIT impact to AI held flat at 37 %, and the share qualifying as high performers held flat at about 6 %. Adoption moved and measured profit did not, which is the strongest evidence behind unclear business value as a cancellation driver.

Menlo measured $37 billion of enterprise generative AI spend in 2025, 3.2 times the prior year. Agent platforms took roughly $750 million of the $8.4 billion horizontal category, about 10 %, against 86 % for copilots. Forecasts placing agentic AI at $1.3 trillion by 2029, published by IDC, count total IT spending influenced by agentic AI rather than agent software licences, and the two figures should never appear in the same argument.

Leslie Joseph announced Forrester's evaluation of the Agent Control Plane market on 4 December 2025, with five in-scope areas: agent inventory and identity, policies and guardrails, monitoring and insight, control and coordination, and risk, compliance and auditing. Development environments and orchestration fabrics sit explicitly outside it. Forrester expects 12 to 24 months before the market resolves into comparable offerings, so no Wave and no vendor ranking exists today.

Gartner predicts that by 2027, 40 % of enterprises will demote or decommission autonomous AI agents "due to governance gaps identified only after production incidents occur", and attributes the cause to binary treatment of governance. Its remedy is four autonomy tiers, each carrying its own control set: Observe, with read-only access to defined sources; Advise, producing recommendations under human review; Act with Approval, executing only after explicit human sign-off; and Act Autonomously, executing independently inside guardrails.

In a February 2026 poll of vendors, Forrester found 92 % had assigned a named product manager or team to agent governance or control plane functionality, 79 % recognised the category, and 40 % reported active requests for proposal. The same analysis lists three blocking gaps: OpenTelemetry has not published a stable version of the generative AI semantic conventions, no portable agent identity and policy-propagation standard exists at enterprise maturity, and there are no cross-plane governance schemas. Vendor-neutral governance is therefore a claim no product can currently substantiate in full.

The Model Context Protocol authorisation specification makes an MCP server an OAuth 2.1 resource server, requires resource indicators, and bans token pass-through, which closes the confused-deputy problem for a single hop. Nothing standardises what happens next: cross-organisational, multi-hop delegation in which authority narrows at every step, each hop is cryptographically bound to the last, and a downstream service can verify the chain without calling a central authority. IETF work on identity assertion authorisation grants reached an adopted OAuth working group draft in May 2026 with an explicit AI-agent use case, but the nested-actor claim is informational and unenforced. Workload identity proves which process holds a credential, not what authority it holds.

No source defines human-on-the-loop normatively. The vocabulary remains open.

The acquirers are identity and security platforms. The targets are gateways, non-human identity, observability and guardrails. No acquirer has yet bought a horizontal registry-and-policy company, which is the open slot in the consolidation map.

Okta's Businesses at Work 2026 found 91 % of organisations already using AI agents, fewer than a third at 32 % securing agents with the same rigour applied to human employees, 58 % naming AI governance and oversight as their top security concern, and only 10 % with a well-developed strategy for managing agents. The Cloud Security Alliance and Zenity study of 445 organisations found 53 % had seen agents exceed intended permissions, 47 % had an agent-involving security incident in the past year, only 31 % had formally adopted agent policies, and only 15 % had defined ownership for most of their agents.

KPMG's second-quarter 2026 pulse of 204 US C-suite leaders at firms above $1 billion in revenue reported only 26 % with real-time visibility into AI operating costs and 36 % with token or usage controls deployed, against average planned AI investment of $202 million over the following twelve months. Gartner named escalating cost as the first of three cancellation drivers and added FinOps for agentic AI to the 2026 Hype Cycle. Run-scoped budgets, per-action cost prediction, loop-depth caps and circuit breakers are moving from engineering hygiene into the control set buyers ask about by name.

First, incumbency: a16z's January 2026 survey of 100 verified senior buyers at Global 2000 firms found 65 % prefer incumbent solutions where available, citing integration and procurement simplicity. Second, provider-native defaults: buyers rely heavily on the agent security shipped by their model and platform providers rather than a third-party control layer. Independent positioning has to be earned on something a platform incumbent cannot do, which in practice means heterogeneity, exportable evidence and regulated-industry depth.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred standalone high-risk obligations under Annex III to 2 December 2027 and embedded high-risk obligations under Annex I to 2 August 2028. Article 12 logging, Article 14 human oversight, Article 26 deployer duties and Article 73 incident reporting travel with those dates. The Commission's position is that the existing definitions of an AI system and a general-purpose model already cover AI agents.

What did apply on 2 August 2026 is Article 50 transparency, which catches any user-facing agent regardless of risk tier: disclosure that a person is dealing with an AI system, and machine-readable marking of synthetic output, with a four-month transitional period for systems already on the market. Enforcement powers over general-purpose models went live on the same date. No harmonised standard has yet been cited in the Official Journal, so no presumption of conformity is available to anyone, which is a large part of why the high-risk date moved.

The EU withdrew the AI Liability Directive in October 2025. Directive (EU) 2024/2853 fills the gap and applies to products placed on the market after 9 December 2026. It expressly treats software as a product, names AI system providers as manufacturers, adds liability for failure to supply security updates, extends recoverable damage to destruction of data, and creates rebuttable presumptions of defect and causation where technical complexity makes proof excessively difficult or the defendant fails to disclose evidence. The disclosure-triggered presumption is the sharp edge for an agent vendor: a platform that cannot produce decision traces stands in a worse position than one that can.

Executive Order 14365 of December 2025 established a Justice Department task force to challenge state AI laws, and Colorado repealed its AI Act, replacing it in May 2026 with a disclosure-and-fault regime effective January 2027. California SB 53 is in force, with transparency reports, a published frontier framework, 15-day critical-incident reporting and penalties to $1 million per violation. On 4 August 2026 the Ninth Circuit held in Amazon against Perplexity that under the Computer Fraud and Abuse Act it is the user who accesses a site with the help of an assistant, and that the assistant "is a tool, not a person for statutory purposes". The holding turns on architecture: browser-mediated agents are protected in a way server-to-server designs are not, and tort, contract and copyright theories were left open.

US interagency guidance SR 26-2 of 17 April 2026 superseded SR 11-7 and SR 21-8, applies to banks above $30 billion in assets, states that it sets no enforceable standards, and excludes generative and agentic AI from scope as novel and rapidly evolving. The Reserve Bank of India moved in the opposite direction, issuing draft Guidance on Regulatory Principles for Model Risk Management on 24 June 2026, covering all models used by regulated entities including third-party and machine-learning models across the lifecycle. Law-firm analyses of the draft report board-approved frameworks, independent validation of third-party models by the regulated entity before and after deployment, kill-switch and override arrangements, long retention of decommissioned model records, and contractual audit rights.

Singapore's IMDA published a Model AI Governance Framework for Agentic AI on 22 January 2026: bound the agent through use-case selection and constrained autonomy, tool access and data permissions; define human accountability with checkpoints requiring approval and mitigation of automation bias; apply baseline testing, access control and lifecycle management; and provide end-user transparency and training. Paired with the NSA's 2026 information sheet on MCP security, which names absent access control, optional authorisation, weak re-approval on capability change and inadequate logging as systemic, these are the two most citable control checklists in existence, and both are free.

MeitY's India AI Governance Guidelines of 5 November 2025 explicitly favour amending existing law over new AI legislation, and hand enforcement to sectoral regulators, with an AI Governance Group, a technology and policy expert committee and an AI Safety Institute as the institutional machinery.

The practical consequence is that for financial services the binding authority is the Reserve Bank of India rather than MeitY. The RBI's FREE-AI committee report of August 2025 set two commercially decisive principles: final decision-making vests with humans rather than models, and the regulated entity remains accountable regardless of the level of autonomy. The June 2026 draft on model risk management extends this to third-party and machine-learning models across the lifecycle.

For personal data, the DPDP Rules notified in November 2025 phase in over eighteen months to roughly May 2027, require breach notification to the Data Protection Board and to affected individuals with no materiality threshold, and require consent managers to be companies incorporated in India. An agent that touches personal data and acts without a human in the path is a notification liability under that regime.

The design consequence: an Indian buyer in banking or insurance cannot accept a model card as evidence, because the regulated entity is required to validate independently. A platform built to that bar, with model and agent inventory export, per-agent documentation, drift monitoring, an auditable override and complete action-chain logs held for long periods, is already over-compliant for a US bank operating under SR 26-2, which excludes agents from scope entirely. Building to the harder regime first turns compliance depth into an export asset.

Demand-side signal: EY's 2025 GCC pulse reported 58 % of India global capability centres investing in agentic AI and 29 % planning to scale within the year, while only 7 % had a fully embedded cybersecurity centre of excellence and 60 % now monitor third-party data access, up from 44 % a year earlier. Buying intent is running well ahead of governance maturity, and third-party scrutiny is tightening quickly.