The build-vs-buy scorecard for an AI control plane
The build-vs-buy argument usually collapses into a generic "we could build that". This scorecard replaces the argument with eight dimensions that have different answers: time to a first governed agent, who maintains the policy engine, how many tool protocols you must cover, and who holds the keys if you leave.
It is honest in both directions. Build genuinely wins when the surface is tiny and the protocols are few; assembling wins once auditors ask for one trail across several clouds.
What is inside
| Section | What it covers |
|---|---|
| Time to first governed agent | Months of design and engineering, versus weeks if the engine and adapters already exist. |
| Team | A dedicated team for years, versus a small owning team wiring it to your identity and logging. |
| Policy engine and adapters | Who writes and tests policy-as-code, and who maintains each tool-protocol adapter. |
| Audit evidence | Who builds signing and retention for the rules you actually face. |
| Human approval | Who builds the secure approval path and the reviewer tooling. |
| Keys and lock-in | Whether you hold everything and can leave with your policies and records. |
| Surface area | How many agents and tools you expect within twelve months — the variable that flips the answer. |
How to use it
- Weight each dimension 1–5 for your organisation, not generically. A regulated bank weights audit evidence and keys differently from an internal tools team.
- Score each side 0 (no), 1 (partly) or 2 (yes) for how well it fits your case.
- Multiply by weight and total. Do it with security, risk and the business owner in the room — separately, they will score the same rows differently.
- Re-score when the twelve-month agent surface changes; that is the dimension that moves.
Should you build an AI control plane or buy one?
When does building your own control plane make sense?
When the surface is small and stable: a handful of agents, one or two tool protocols, one cloud, and a platform team that will still be there in two years. Past that, the maintenance cost of adapters and policy tests is the part teams underestimate.
What does "assemble" mean here, as distinct from buy?
Using an existing engine and adapters while you own the policies, the approval routing and the records. It is the middle path most regulated enterprises end up on, and it is why the scorecard has per-side columns rather than a binary choice.
How is the scorecard weighted?
You weight it. The file ships with an empty weight column and a 1–5 scale, because a generic weighting produces a generic answer. The guidance row in the CSV explains the method.