Agent Control Plane authorizes, records, explains, and replays agent behavior before AI systems affect enterprise infrastructure. It is the runtime governance layer between an agent and the systems it acts on.
Traditional logging tells you what happened. It is written after the fact and describes events, not the authority behind them.
Traditional observability measures how systems behave. It reports on health and performance, not on whether an action was permitted.
Agent Control Plane governs what AI agents are permitted to do before execution, and preserves replayable evidence of the decision afterward.
As agents begin using tools, accessing data, triggering workflows, and making decisions across enterprise systems, organizations need more than policies and dashboards. They need a runtime record of what the agent proposed, what policy decided, why the decision was reached, what was blocked, what authority existed, what sources were relied on, and how the run can be reconstructed later.
Agents may propose or take actions without a structured pre-action record. Teams cannot distinguish what was proposed from what was executed.
Without a policy gate, agents may invoke tools or access systems beyond their intended authority scope.
When a proposed action is denied, the denial often disappears silently. There is no durable record of what was blocked or why.
Allow, block, and escalate outcomes are difficult to review when there is no trace showing which policy rule matched.
Agents act on data from tools, APIs, files, databases, user input, and model output. Without reliance records, provenance is unclear.
After an incident, teams need a structured record to reconstruct what the agent proposed, what was decided, what was relied on, and what was exported.
An agent control plane is the layer that authorizes an AI agent's proposed actions against policy before they execute, records the decision and its reasoning, and produces a replayable record of the run. It governs behavior at runtime — distinct from the systems that authenticate identity, observe health, or orchestrate work.
Identical inputs produce identical decisions and fingerprints.
Actions are evaluated and authorized before they can affect systems.
Outcomes are backed by recorded decisions and traces, not claims.
Every run yields a reconstructable record, not an optional export.
No dependency on a specific model, framework, or hosting provider.
Records are governed by public, versioned JSON schemas.
The pattern is reproducible across languages and runtimes.
Policies, adapters, and exporters are designed to be replaced.
Agent Control Plane sits between the agent frameworks that decide what to do and the enterprise systems those actions touch. It does not replace either — it governs the boundary between them.
Agent Control Plane is not an agent framework and not a model runtime. It sits beside an agent and governs the trail around each proposed action — from the policy decision through to the exported record.
Evaluates proposed agent actions against allowed tools, blocked tools, action type, and active authority scope. Identical inputs produce the same result and deterministic fingerprint.
Records the ordered policy-rule path behind each decision, including which rule matched and why the final result was allow, block, or escalate.
Creates a structured record when an agent action is denied, rather than letting blocked operations disappear from the audit trail.
Captures who or what authorized an action, under what scope, and whether the authorization is time-bound.
Records which tool, file, database, API, user input, or model output the agent relied on, preserving provenance across the run.
Checks internal consistency across run records and replay bundles, including run identifiers, action references, blocked-action links, trace relationships, and missing-output warnings.
Creates privacy-safer copies of run records and replay bundles by redacting payloads, targets, final output, and recorded reasons while preserving structure and fingerprints.
Adds optional HMAC-SHA256 export integrity metadata so replay bundles can be checked for modification after export.
Provides a minimal adapter pattern that executes a tool only after the control plane records the action proposal and the policy gate returns allow.
Exports a reconstructable run record containing the frame, proposed actions, policy decisions, evaluation traces, authority records, reliance records, blocked actions, and final output.
A replay bundle is a reconstructable record of a complete run. Because the decision path is deterministic, the same inputs reproduce the same outcome — which makes a run inspectable long after it finished. Replay turns a single record into practical leverage across the lifecycle.
Reconstruct exactly what an agent proposed, what was decided, and what executed.
Produce durable evidence of authorization and blocked operations for review.
Trace a decision back through the ordered rule path that produced it.
Replay historical runs against a revised policy before rollout.
Compare behavior across models against an identical framed task.
Detect drift when policies, tools, or adapters change over time.
Give oversight teams a consistent artifact to review and attest to.
Validate that changes to the control plane preserve prior behavior.
The Open Control Stack is a set of composable primitives for declaring, controlling, replaying, and evidencing agent behavior. Each is a distinct record type with defined inputs and outputs. Agent Control Plane is the runtime layer between them.
Declares the actions, tools, and authority an agent is permitted to use.
Agent definition, tool catalog, authority scopes.
A versioned manifest of declared capability.
Read by the control plane as declared authority.
Authorizes, records, and gates agent actions at runtime.
Action proposals, active manifest, policy configuration.
Policy decisions, evaluation traces, run records.
Consumes the manifest; emits replay bundles.
A reconstructable record of a complete agent run.
Run records, decisions, traces, reliance, blocked actions.
A portable, optionally signed bundle.
Produced by the control plane; feeds the evidence pack.
Aggregates replay bundles into audit-ready evidence.
One or more replay bundles and validation reports.
Redacted, signed evidence for governance review.
Built from replay bundles across runs.
The implementation is intentionally minimal. It demonstrates the control-plane pattern without trying to become a full enterprise governance platform.
The repository is public so teams can inspect the pattern, run the examples, adapt the schemas, test deterministic policy gating, validate exported records, redact sensitive fields, sign replay bundles, and experiment with controlled tool execution in their own agent workflows.
It exists to demonstrate an architecture pattern. It is intended to be forked, adapted, extended, and referenced — not simply consumed.
Need visibility into what AI agents are doing before they touch critical systems. Require structured records of proposed actions, authorized actions, blocked operations, and replayable runs.
Need blocked-action records, runtime authorization, validation reports, redacted exports, signed replay bundles, and replayable incident trails.
Need a lightweight control layer that sits beside existing agent frameworks without replacing them. Require a reference implementation they can adapt and extend.
Need evidence of what happened, what was allowed, what was blocked, what rule path was followed, what the agent relied on, and how the run can be reconstructed.
Need a small package that can be added beside existing agent code to record action proposals, gate tool execution, and export replayable run records.
This MVP is deliberately scoped. It is not:
A public reference implementation for deterministic policy gating, policy evaluation traces, semantic validation reports, redacted exports, signed replay bundles, controlled tool-adapter execution, and replayable agent-run records.
This is an early-stage reference project. The table below reflects current status; some fields are placeholders pending the first tagged release.
Agent Control Plane is an open, vendor-neutral reference for a missing layer of AI infrastructure. Everything is public and built to be adapted.
Record types, schemas, and the control-plane contract.
Source, examples, tests, and the CI workflow.
JSON-schema-governed run records and bundles.
How the agent, control plane, and export layers compose.
Open issues, discuss the spec, and contribute.
Questions on adoption, adaptation, or the stack.