Everyone means something else by a control plane
The question a client asks: we have built dozens of agents, on three platforms and with four models; am I in control of what they are all doing, and am I governing them properly? Six people in the firm answer it, and each answers with a different thing. The CTO means the agent platform: the harness, the gateway, the routing of calls to models. The CISO means guardrails and identity. The CRO means the risk framework and model risk. Compliance means the AI inventory, the risk classification, and decisions that can be explained. The business owner means the approvals and referrals a person handles. And the CFO means the cost of tokens against the value.
Each platform brings a control plane for its own agents. So the firm with three platforms has three. Each of the six is right about one part. Nobody can yet say how the parts fit together, and that is what the map is for.
Every firm decides inside an ecosystem
Before the map, the ground it stands on. The law and the regulators set what applies: conduct and consumer protection, prudential rules, data protection, operational resilience, AML and sanctions, and the AI Act. Supervisors and auditors examine what the firm decided and whether its controls held. And customers receive each decision with its reasons and can challenge it, and their complaints come back as evidence. Third parties run much of the technology, the cloud, the models, and the software, and the firm stays accountable for what they do on its behalf.
Authority comes down from the law into the firm's policy, limits, and controls. Evidence goes back up as the record of what was decided and why. So the firm answers for every decision taken on its behalf, whether a person, a system, or an agent takes it. With an agent, the firm has to prove that sentence in a new way.
Every firm governs delegated work at three altitudes
The same work is governed three times. At the enterprise altitude the board, the CRO, the CFO, and compliance decide how far the firm will go: the risk appetite, the policies, the ceilings on any delegation, and which work may be delegated at all. That takes the form of policy and ceilings, and it changes once or twice a year. In the workflow the business owner decides who may decide what in one process, for whom, and up to what amount. For a person that is a role with delegated authority and its limits, a handler who settles claims up to 5,000 euros. And it changes every day. On the platform the CTO, the CISO, and IT operations make the rules real where the work touches systems: access, enforcement, logs, and the ability to stop. That changes at every release.
But any of the three can change at once when something goes wrong. And two words firms often use as one come apart here. An entitlement lets someone reach a system; a mandate says what they may do there.
The essentials, each a question at every altitude
The altitudes locate responsibility: the enterprise, the workflow, the platform. Across them run the essentials, what must be governed at each altitude, and each is a question. Who is acting, and is it fit for this work? What may it rely on, and does it apply to this case? What may it decide, for whom, and up to what amount? May this exact act go ahead, now? What happened, on what basis, and who was affected? Should its authority change?
Take the third. At the enterprise it reads: how far may any delegation go. In the workflow: what may this actor decide here, for whom, and up to what amount. On the platform: which systems may it reach to do that. The first three questions must hold before the act. Then the fourth checks them at the act. The last two remember, and learn.
Every box, for people and for agents
Every question asked at every altitude makes a box. And for a person every box is filled today. The staff register, the procedure library, the delegated authority policy, the four-eyes rules, the files sampled by audit, the budget: the enterprise row. The trained employee, the manual in force, their delegated authority, the approval rule, the case file, the quality reviews: the workflow. User accounts and badges, the document system, access rights, workflow controls, system logs, quality sampling: the platform.
Click, and every box turns to its agent version. The agent portfolio, the knowledge estate, ceilings, the control standard, the evidence base, the investment decision. The agent, the knowledge that applies, the mandate, the check before the act, the decision record, narrow or widen. Harness and identity, index and retrieval, entitlements, policy enforcement, traces and logs, evaluations and drift. None of this is a new layer on top of the firm. It is the firm's own governance of delegated work, rebuilt so that an agent can be checked against it.
The words you already use, on the map
For the engineers in the room, the words you already use land on this map. Agent registry and AI inventory sit in e1. Data governance in e2, risk appetite in e3, AI governance in e4, AI assurance and audit in e5, FinOps and ROI in e6. The release, model risk, and validation are w1; grounding and hallucination are w2; human in the loop and the approval step are w4; explainability, the nearest word to w5, names the reasons and never the authority, so w5 keeps no engineering word. And the platform row takes most of the vocabulary: the harness, guardrails, the AI gateway, model routing, agent identity, sandbox, memory, context engineering, MCP, agent-to-agent protocols, the kill switch, and prompt injection, the attack that enters there, in p1; RAG, vector stores, embeddings, and the knowledge graph in p2; IAM, scopes, and least privilege in p3; the policy engine and policy as code in p4; tracing, observability, logs, and token cost in p5; evals, drift, LLMOps, rollback, and red teaming in p6.
Step one lights where the engineering words fall: the first essential and the platform row. Then step two marks the boxes with no engineering word yet: the mandate, the record, and the loop. Your words cover the agent and the platform. The mandate, the record, and the loop are the firm's to write.
What each essential holds, and who owns it
Each essential has its parts, and each essential has owners. Essential 1, the agent itself, belongs to the CTO and the platform team with the CISO. Essential 2, its knowledge, to the source owners, compliance, and the data teams. Essential 3, its mandate, to the business owner, challenged by the CRO. Essential 4, the check, is run by the CTO and the CISO on rules the business sets. Essential 5, the record, is kept by the CTO and read by risk, compliance, and audit. Essential 6, the loop, belongs to the business owner, the CRO, and the source owners.
A reader then knows what is inside each essential before part three opens them one at a time. And a firm can see at once which essential has no owner today.
Everyone sees part of the map
Back to the six people from the question. Each is placed on the map in turn, and each lights the boxes they think about. The CTO and the platform team light the platform row and the release. The CISO lights identity, entitlements, policy enforcement, logs, the portfolio, and the release. The CRO lights ceilings, the control standard, the evidence base, the mandate, the check, and the loop. Compliance lights the knowledge estate, the knowledge that applies, the record, and the evidence base, with the law above. And the business owner lights the workflow row. The CFO lights the investment decision and the cost.
Each view is right. But each leaves dark the boxes someone else lights. The map is all the boxes, and the links between them, and it is the first thing the six can agree on.
The control plane instructs, and can say no before the act
The rest of the set relies on this definition. A control plane instructs and can refuse; a management plane watches and reports. Platforms already instruct, for their own agents: identity, routing to a model, guardrails, access. That is the first group of boxes lit, on the platform row. For delegated decisions the plane also needs the part that can refuse an act before it happens: the mandate, the check, and policy enforcement, with the ceilings and the control standard behind them. That is the second group, in the centre of the map.
And the refusing part only works when three joins connect it to the rest: a versioned mandate the check can query, a record keyed to the mandate version and the build, and a return path from the record to the mandate. Most of the boxes on the map can be bought or already exist. The three joins that make them a control plane have to be built. Carry that into any conversation with a vendor.
What the map does not draw yet
Every box on the map is drawn for one agent taking one act under one mandate. The map does not yet draw delegation, where one agent hands work to another; cohorts, where several agents on one process, each inside its own limit, together go over a limit none of them holds; cascades, where one agent changes the state another reasons over; or other firms' agents, with two control planes, two mandates, two records, and nobody who can see both. Each lies above one act, and the research page takes these further.
Follow one decision through the essentials
Part one has drawn the territory with no case on it. Part two puts one decision on the map and follows it through the essentials, from the agent that acts to the loop that moves its mandate, and lets you choose the case: a motor claim, a payment held on a sanctions hit, an SME credit renewal, a corporate action, a collections conversation, a city renewing a housing allowance, or an SME renewal by a credit agent and its two delegates. The sixth is the first outside financial services, and shows that the map holds there too. The seventh is the first with one agent delegating to another.