Series: Building the AI Foundation Part 4: Part 1: Stop Picking AI Tools laid out the seven-layer architecture. Part 2: The Context Layer covered how AI reaches your systems. Part 3a: The Developer Gate and Part 3b: The Operations Gate covered how changes get reviewed, for code and for plant records. This piece covers layer seven, the control plane. Part 5 covers how the tool-facing layers plug into all of it.
Here’s a question I’d like you to try on your own shop: which AI agent issued a customer credit last Tuesday? If you can’t say, you’re in good company. Most of us have logs. Very few of us have an answer.
Picture the morning. Your controller walks over and says a batch of customer credits posted overnight, $38,000 in all, and nobody in customer service remembers approving them. You pull the access log from Part 2 and see an agent read a customer’s order history at 2:07 a.m. You pull the change log from Part 3b and see a credit memo proposed at 2:11 and approved at 2:14. Now the real questions start. Which agent was it? Whose agent? Was that 2:14 approval a person thinking, or a person clicking? What did the run cost, and what else did it touch before it stopped?
“Let me get back to you” is where most of us land, and it can take a week.
The layer that turns that week into five minutes is the control plane. It’s layer seven, and if I were rebuilding my own stack from scratch, it’s the one I’d put in first.
Five jobs, no product
You can’t buy a control plane. It’s five jobs that somebody has to do: identity, policy, gateway, audit and cost. Skip them and you’ll still end up doing them, just one incident at a time and at a worse price. I’d rather we chose to do them on purpose.
Identity. Every request carries a person or a named agent. Never a shared key.
Policy. The data classification from Part 1 becomes rules a system enforces, not a PDF.
Gateway. One path for the model calls you own, where policy applies, sensitive fields get redacted and everything gets logged.
Audit. One record that joins what an agent read, what it proposed and who approved it.
Cost. Budgets and caps per team and per agent, with alerts that fire before the invoice does.
I’m not the only one who frames it this way. BCG tells CIOs to separate the control layer from the build layer, and Forrester now evaluates the agent control plane as its own market. It’s reassuring to see the idea has company. The work, though, still lands on us.
Start with who
Everything else on the list depends on identity, so let’s begin there.
Go back to the 2:07 a.m. story and suppose the agent ran under a shared service account. Part 2’s log says the integration account read the order history. Part 3b’s log says the integration account proposed the credit. Both statements are true, and neither helps. You still can’t tell which agent it was, which team owns it, or whether a human was anywhere near the request.
This isn’t only a tidiness problem. The worst agent-related breach I came across while researching this piece wasn’t a model going rogue. In the 2025 Salesloft Drift incident, attackers used stolen OAuth tokens tied to an AI chat agent to pull data out of customers’ Salesforce instances. The agent’s identity was the front door.
The rule I’d suggest is simple. When an agent acts for a person, that person’s identity travels with the request. When it runs on its own schedule, it gets a named identity of its own, scoped to what it needs, with a human owner on record. When that owner changes roles, the agent’s access gets reviewed the same day theirs does.
It’s dull work. It’s also the difference between a five-minute answer and a five-day one.
A policy nobody enforces is a wish
I’m fond of the one-page data classification from Part 1, because people actually remember it. But a page people remember still depends on people remembering it at 4:45 on a Friday, and none of us is at our best then.
So make each tier something a machine checks. Public and internal data can go to approved assistants. Confidential data goes only to tools under enterprise terms whose retention you’ve read yourself. Restricted data, meaning HR, payroll and customer personal information, stays on the private tier or stays out of AI altogether. The check lives in the gateway and in each tool’s admin settings, where it runs every time, whether anyone remembers or not. OWASP’s guidance on excessive agency lands in the same place: enforce authorization in the downstream system and don’t ask the model to police itself.
There’s a newer piece worth watching here. A new class of decision models returns a typed answer, such as a choice from a fixed list or a yes/no probability with a confidence score, instead of free text. TypeSafe AI’s Jev is one, and OpenAI has announced a Decisions API along similar lines. In a gateway, that kind of model could check a request against your data tiers and return an answer your audit log can store as-is. It’s early, the vendor claims aren’t independently verified, and I’d test any of them on your own data first. I’ll give it a full article in Part 5.
The gateway trap
This is the mistake I’d most like to save you from. A team builds a gateway, routes a few calls through it, feels covered, and quietly misses most of the real usage.
A gateway only sees what goes through it. ChatGPT Enterprise, Microsoft 365 Copilot and GitHub Copilot are hosted services with their own front doors, and you can’t route them through yours. You govern them from the admin side: single sign-on, the vendor’s console, and the audit export. The gateway earns its keep on everything you build or call by API, which means internal agents, the MCP servers from Part 2, scripts and local models.
Two paths, one destination.
Make Tuesday a five-minute question
Joining the logs takes one habit. Every event carries the same identity and a shared session or request ID. Once that’s true, the 2:07 a.m. mystery becomes a single thread you can pull: the agent pulled the customer’s order history (Part 2’s log), proposed a credit in the same session (Part 3b’s log), and at 2:14 an owner approved it. Or nobody did, which is also an answer.
I’d also keep a second record of your own rather than leaning on a vendor’s log alone. In 2025 a researcher reported that Microsoft 365 Copilot could be prompted to skip recording the files it had accessed, and Microsoft fixed it in August. That’s one researcher’s account, so I’d hold it loosely, but it’s a fair reason to cross-check.
If you run a regulated plant, the bar is already written down. FDA’s 21 CFR 11.10(e) calls for secure, time-stamped, computer-generated audit trails of operator actions. I haven’t found a public case of a manufacturer applying that to AI-made BOM or routing changes. That’s my argument rather than settled practice, and I expect we’ll see it asked for soon.
You don’t need a perfect system to start. You need three answers, fast. What did this agent read and change in the last week? Who approved each change? What did this person’s tools cost?
The invoice shouldn’t be your first alert
Pricing moved under all of us this year. OpenAI shifted Codex to token-based credits in April. GitHub moved Copilot to usage-based AI Credits on June 1. A seat price used to tell you roughly what you’d pay. Now it tells you the entry fee.
Agents turn that up a notch, since one unattended agent stuck in a loop can use more than a team of people typing. My suggestion: set a budget per team and per agent, alert at half and again at eighty percent, and use hard limits wherever the tool supports them. ChatGPT Enterprise workspace owners can set usage alerts and hard overage limits, and GitHub admins can set budgets with expiration dates on individual users. Turn them on day one. I’ve yet to meet anyone who regretted a cap that fired early.
Five ways this goes sideways
These are the patterns I’d watch for.
The shared account. Something breaks and the investigation ends at “the integration account did it.”
The gateway nobody uses. Engineers paste code into personal accounts that never touched it. The gateway was fine. The coverage wasn’t.
The PDF policy. The data policy exists as a document with nothing enforcing it, and the first audit finds three tools nobody approved.
Four logs, zero joins. The evidence exists, in four places. A five-minute question takes a week.
The surprise invoice. Someone learns what an agent cost from the bill.
What building this taught me
When I wrote the AI adoption plan for my own IT organization, single sign-on, the data policy, device management and repository rules all went into Phase 0, ahead of any broad rollout. People reasonably asked why we were doing the paperwork before the interesting part.
My answer was retrofits. Add identity after two hundred people already use a tool and you re-onboard two hundred people. Add it first and nobody notices it happened. Everything that feels like slowing down at the start becomes the reason we can say yes quickly later.
Where this leaves you
Nobody buys a control plane for the demo, and it never makes a keynote. It only gets noticed the day something goes wrong, and by then it’s either there or it isn’t.
Here’s a test you can run Monday. Pick one agent in your environment, any one, and try to answer four things: what it read, what it proposed, who approved it, and what it cost last week. Time yourself. If it takes more than a few minutes, you’ve found your first project, and I’d love to hear how it goes.
That’s the article. Subscribers have access to the working files below:
The Tuesday-question worksheet (fillable PDF)
Policy as rules: the data tiers
Budgets and alerts
What the hosted vendors keep, and where it runs out
The Phase 0 checklist (fillable PDF)
If you can’t see them, all you need to do is subscribe to menonstack.com using the button below.
Next in this series: Part 5, where small decision models earn a place in the gates and the control plane. After that, Part 6 covers how the tool-facing layers, the assistants, the editors and the delegated agents, plug into everything built so far.