An AI control plane sits between the agent runtime and your systems of record, performing policy checks, identity resolution, release gates, and evidence capture on every agent action before it commits. It is not a wrapper around models or an observability dashboard. It is the single layer that decides whether an action may proceed, bounds where it can reach, and writes down what happened, so governance becomes a property of the platform rather than something each team writes into each agent.
What this article covers
- The five-layer enterprise AI stack, with the control plane positioned exactly
- Why 40% of agentic AI projects face cancellation by end of 2027, per Gartner
- How the control plane relates to platforms you already run: Databricks, Palantir, watsonx.governance
- A six-dimension build-versus-buy comparison with an honest build column
- A seven-item readiness checklist you can run this week
- What an AI control plane does not solve, genuinely weighed
What is an enterprise AI platform, and where does the control plane fit?
An enterprise AI platform is the collection of layers that takes a business problem, routes it to models and tools, executes the actions those models recommend, and returns a result that a person or system can use. The stack has five layers, and understanding where each sits explains why the control plane is not optional.
Layer one: data and systems of record. Your ERP, CRM, HR system, financial ledger, customer database. These hold the truth your business runs on. Agents need to read from them and sometimes write to them.
Layer two: models and inference. OpenAI, Anthropic, Gemini, or your fine-tuned Llama deployment. This layer takes a prompt and returns tokens. It has no memory of your business rules, no concept of who is asking, and no mechanism to enforce a spending limit.
Layer three: agent runtime. LangChain, LangGraph, Semantic Kernel, AutoGPT, or your own orchestration code. This is where the agent lives: the loop that calls a model, interprets tool calls, invokes functions, and decides whether to continue or return. The runtime holds the agent’s logic but not the enterprise’s policy.
Layer four: control plane. This is where identity, authorization, egress boundaries, audit, and containment happen. Every request from the agent runtime passes through this layer before reaching the systems of record. The control plane checks who is acting, whether the action is allowed right now, where its data and calls may reach, and whether the result is recorded. It has the authority to deny the action before it commits.
Layer five: workflow surfaces. Slack, ServiceNow, Salesforce, your internal portal. These are where people interact with agents. A user types a request, the surface hands it to the runtime, the runtime calls the model, the model returns tool calls, and those tool calls hit the control plane before they touch layer one.
The analogy that makes this concrete: the control plane is the badge reader at every door between your agents and your systems. The badge reader does not care what the employee wants to do inside the room. It checks the badge, the time of day, the access list for that door, logs the entry, and either opens the lock or does not. The agent runtime is the employee; the control plane is the entire physical security system.
Key distinction: The data plane executes; the control plane decides. Any product that only watches the data plane, however beautifully, is reporting on decisions it never made.
Why enterprise AI projects stall before they reach production
Gartner predicted on June 25, 2025 that over 40% of agentic AI projects will be canceled by the end of 2027. The firm named three causes: escalating costs, unclear business value, and inadequate risk controls. Two of those three are governance problems.
Inadequate risk controls means the team cannot answer the auditor’s question: which agent touched which customer record, when, under whose authority, and what did it change? Escalating costs means the agent called an expensive model 10,000 times overnight because no spending gate existed, or it fanned out across every database in the company because no egress boundary was set.
The same research found that 33% of enterprise software will include agentic AI by 2028, up from under 1% in 2024. That is a thirty-three-fold increase in two years. The gap between adoption and control is the problem the control plane exists to close.
The regulatory force is harder. The EU AI Act’s obligations for high-risk systems became enforceable on August 2, 2026, and Article 12 requires that these systems “technically allow for the automatic recording of events” over their lifetime, with a minimum six-month retention. Retool’s May 2026 survey of 307 CTOs, CIOs, and CISOs found 93% concerned about AI-generated tools reaching production while only 4% had controls that actually reach AI-written code. That is an 89-point gap between worry and enforcement.
Where exactly does the control plane sit, and what does it do on each action?
The control plane sits in the request path between the agent runtime and every system the agent touches. It is not a sidecar that watches traffic. It is not a log collector that writes events after the fact. It is the layer that receives the action, evaluates it against policy, and either forwards it or stops it.
On each action, the control plane performs five checks, in order. These are the five control points every enterprise AI platform must enforce, and they map exactly to the badge-reader analogy.
Identity. Who is acting? The control plane resolves the human or service identity behind the agent request. If the agent is running on behalf of a customer service rep, the control plane knows that rep’s employee ID, department, and role. If the request carries no identity, the control plane denies it outright.
Authorization. Is this identity allowed to perform this action right now? The control plane evaluates the action against attribute-based policies: role, department, time of day, cost budget, data sensitivity. A junior analyst may read customer records but not delete them. A contractor may access the system during business hours but not at 3 a.m. A research agent may call a model 100 times per day but not 10,000.
Egress. Where may this action reach? The control plane bounds the blast radius. An agent helping with HR questions may query the HR database but not the financial ledger. An agent summarizing support tickets may read from the ticketing system but not write to the ERP. The egress boundary is a property of the identity and the action, not the agent’s code.
Audit. What happened, and is the record tamper-evident? The control plane writes an event for every action: who, what, when, which system, what result, how long it took, how much it cost. The log is append-only and cryptographically signed, so an auditor can verify that no one altered the record after the fact.
Containment. Can the control plane stop a runaway agent before it exhausts a budget or breaches a boundary? The control plane enforces spending limits, rate limits, and circuit breakers. If an agent exceeds its daily model budget, the control plane stops forwarding its requests. If an agent attempts to access a system it is not authorized to touch, the control plane denies the action and alerts the platform team.
The five control points compress into a single test. If a vendor claims their product is an AI control plane, ask: can it deny an action before it commits, can it attribute every action to a human or service identity, and can it replay the evidence to an auditor six months later? If the answer to any of the three is no, it is not a control plane.
How does the control plane relate to platforms you already run?
Most enterprises already run data platforms, AI development tools, or governance products. The control plane is a distinct layer, and understanding how it relates to what you have clarifies where it fits.
Databricks positions itself as a unified data and AI platform, providing data lakehouse storage, model training, feature engineering, and inference serving. Databricks Unity Catalog governs data access and lineage within the Databricks environment. The control plane operates at a different boundary: it governs agent actions that reach outside Databricks, including tool calls to external APIs, writes to non-Databricks systems, and multi-hop workflows where one agent invokes another across runtimes.
Palantir Foundry provides a platform for integrating enterprise data, building workflows, and deploying AI applications, with governance built into the Foundry ontology. Palantir’s governance model ties permissions to the ontology’s objects and relationships. The control plane complements this by enforcing policy on agent actions that cross platform boundaries, including agents built outside Foundry, open-source runtimes, and tool calls that Foundry does not mediate.
IBM watsonx.governance offers AI model risk management, lifecycle tracking, and compliance reporting, with a focus on model cards, drift detection, and fairness metrics. watsonx.governance operates at the model layer, tracking which models are deployed, how they perform, and whether they meet compliance thresholds. The control plane operates at the action layer, enforcing policy on each agent invocation, tool call, and data access, regardless of which model the agent uses.
The pattern is consistent. These platforms govern the layers they own. The control plane governs the actions that cross those layers, and it does so without requiring you to rewrite agents or abandon the platforms you already run.
Should you build or buy an AI control plane?
The answer depends on six factors. The table below gives an honest comparison, including the conditions under which building makes sense.
Time to production. Building a control plane from scratch requires a dedicated team and six to twelve months. You must design the policy engine, implement the five control points, integrate with your identity provider, write adapters for every protocol your agents use, and build the audit log with tamper-evident signing. Buying a control plane compresses this to weeks, because the vendor has already built the policy engine, the protocol adapters, and the audit log.
Policy expressiveness. If you build, you can write policies in any language and enforce any rule your team can express. If you already run Open Policy Agent or Cedar and your platform team has deep investment in those tools, building may preserve that investment. Buying gives you attribute-based policies out of the box, with role, department, time, cost, and data sensitivity as first-class attributes.
Integration surface. A built control plane integrates with exactly the protocols and systems you choose to support. A bought control plane supports Model Context Protocol, REST, gRPC, JDBC, and the other protocols enterprises already use, so you do not write adapters.
Audit tamper-evidence. If you build, you must implement cryptographic signing, append-only storage, and retention policies yourself. If you buy, the vendor provides a tamper-evident log that meets the EU AI Act’s six-month retention requirement and SOC 2’s audit trail controls.
Ongoing maintenance. A built control plane is your team’s responsibility forever. Every new protocol, every policy change, every integration with a new agent runtime or model provider is work your team does. A bought control plane shifts that responsibility to the vendor, with an SLA.
Fits if. Build if you have a strong platform team, unusual constraints that no vendor addresses, and existing investment in OPA or Cedar that you want to preserve. Buy if you use standard protocols, need evidence in production now, and prefer a vendor SLA over internal maintenance.
What an AI control plane does not solve
The control plane enforces policy on agent actions. It does not write the policy for you, train the models, design the agents, or decide which actions your business should allow. It does not replace your data governance platform, your identity provider, or your model risk management process. It complements them.
The control plane does not prevent a model from generating harmful content in its response. It enforces policy on the actions the agent takes after the model responds: which tools it may call, which systems it may touch, how much it may spend. Content moderation is a separate layer, typically handled by the model provider or a content filter between the model and the runtime.
The control plane does not eliminate the need for design review. Agents still require architecture review, threat modeling, and business approval before they reach production. The control plane ensures that the agent in production behaves according to the policy that review established, but it does not replace the review.
The control plane does not make agents infallible. Agents will still make mistakes, misinterpret prompts, and call tools in ways you did not anticipate. The control plane bounds the damage by enforcing egress limits, spending gates, and audit trails, so mistakes are contained and visible.
How do you know if you are ready to deploy an AI control plane?
Run this seven-item checklist. Each item maps to one of the five control points or to the readiness of your organization.
1. Can you name the human or service identity behind every agent request in production today? If the answer is no, you do not have identity resolution, and the control plane cannot attribute actions to anyone. This is the first control point.
2. Do you have a written policy that says which roles may perform which agent actions, under which conditions? If the answer is no, the control plane has nothing to enforce. Authorization requires a policy, and the policy must exist before you deploy the control plane.
3. Can you list the systems each agent is allowed to touch, and the systems it must never reach? If the answer is no, you do not have egress boundaries, and the control plane cannot enforce them. This is the third control point.
4. Do you have a retention requirement for agent actions, either from regulation or from your own compliance team? If the answer is yes, the control plane must write an audit log that meets that requirement. If the answer is no, you still need the log, because the auditor will ask for it.
5. Can you stop an agent that exceeds its budget or breaches a boundary without redeploying code? If the answer is no, you do not have containment, and the control plane cannot enforce spending limits or circuit breakers. This is the fifth control point.
6. Do you have a platform team that owns the control plane, writes the policy, and responds to alerts? If the answer is no, the control plane will not succeed. It is a platform layer, not a product you install and forget.
7. Can you show an auditor, on a screen, which agent touched which customer record last Tuesday, under whose authority, and what it changed? If the answer is no, you do not have audit replay, and you will fail the next compliance review. This is the evidence test, and it is the one that ends projects.
Key takeaway
The AI control plane is the layer that decides whether an agent action may proceed, bounds where it can reach, and writes down what happened. It sits between the agent runtime and your systems of record, enforcing identity, authorization, egress, audit, and containment on every action. Moring built the first native AI control plane for enterprises that need evidence on a screen, not a dashboard that watches actions it never controlled. The layer is not optional if you plan to run agents in production past the next compliance review.
Sources and editorial note
This article synthesizes the following sources:
- Retool and Wynter survey, May 2026: 307 CTOs, CIOs, and CISOs surveyed; 93% concerned about AI-generated tools reaching production, 4% with controls reaching AI-written code. Cited for the governance gap statistic.
- Gartner press release, June 25, 2025: Prediction that over 40% of agentic AI projects will be canceled by end of 2027, causes named as escalating costs, unclear business value, and inadequate risk controls; 33% of enterprise software will include agentic AI by 2028, up from under 1% in 2024. Cited for project cancellation and adoption rate.
- EU AI Act, Article 12: Obligation for automatic event logging over a system’s lifetime, six-month minimum retention for high-risk AI systems. Cited for regulatory requirement substance; no application deadline stated in this article.
Editorial note: The five-layer enterprise AI stack, the five control points (identity, authorization, egress, audit, containment), and the three-question test (Deny-Attribute-Replay) are frameworks developed by Moring to structure the AI control plane category. These are not industry-standard terms, though they draw on established concepts from networking, identity and access management, and compliance. All other factual claims are sourced as noted above.
Ready to see where a control plane fits in your architecture? Book an AI control plane architecture assessment at moring.ai/contact.
Sources and further reading
- https://www.moring.ai/blogs/what-is-an-ai-control-plane-how-to-evaluate-one-moring
- https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
