Salesforce, Microsoft, WSO2 and Alation all sell an AI agent control plane now. Do you need one, and what to build if you are not buying

The week before Dreamforce, Salesforce announced an architecture it calls the Trusted Enterprise AI Harness and, above it, an AI Control Plane: one place to discover and register agents, give them identities and policies, manage their lifecycles, evaluate them, watch what they do, and control what they cost, across Salesforce products and third-party AI alike. Microsoft has been selling Agent 365 as the control plane for its estate since it went generally available in May. WSO2 released an Agent Manager for what it calls agent sprawl. Alation added six products to its platform, including live compliance monitoring and lineage tracing for agents. Airrived shipped agent observability with ownership, permissions and cost in one view.

Four vendors converging on the same product in the same month usually means the same customer conversation is happening everywhere. VentureBeat's reporting on the Salesforce launch put a number on it: companies already run three agent platforms on average, and 53 per cent expect their main control plane by the end of 2026 to be a hybrid of provider-native and external tooling. EY's survey of senior AI executives, published the following week, found 91 per cent of organisations using agentic AI in pilot or production, and governance that had not kept up. The control plane is the product category that grows in the gap between those two numbers.

What does an AI agent control plane do?

A control plane is the layer that knows every agent you run, what each one is allowed to do, what it is doing, how well, and at what cost, regardless of which platform built it. Salesforce's description of its own is a fair definition of the category, and it lists six functions.

Discovery and registration: an inventory of agents and AI capabilities, with an owner for each. Identity and policy: every agent has an identity of its own, distinct from the person who launched it, and a policy that says what it may read, write and spend. Lifecycle: agents get versioned, promoted, paused and retired the way software does. Evaluation: performance measured against a standard before and after changes. Observability: a record of behaviour and outcomes that someone can read after the fact. Cost control: spend attributed per agent and capped.

None of these six is new. What the vendors are selling is the six in one place, across platforms, and the hard part of that is the word "across". A control plane that governs only the agents built on the vendor's own platform is a feature of that platform. The value the category promises is governing the Copilot agents, the Agentforce agents, the ones a developer built on the Claude API last quarter and the one in the finance team's spreadsheet macro, from one register.

Salesforce's version is not available yet. Salesforce Ben reports the new capabilities and the unified experience arrive in early fiscal 2028, which is February 2027 at the earliest, and the company has said pricing, packaging and upgrade paths will be announced closer to general availability. Microsoft's is live. The rest are new. If you are being sold one this quarter, ask which of the six functions works today for agents that do not run on the seller's platform.

When do you need an agent control plane?

You need one when you cross any of three thresholds: more than one platform building agents, any agent that writes or spends, or a regulator who will ask. Below all three, a register and a habit are enough.

The first threshold is plurality. One team building agents on one platform can govern them inside that platform. The moment a second platform appears, and it does, because the sales team bought Agentforce while engineering used the Claude API and the CFO's office turned on Copilot agents, nobody has a single list. VentureBeat's average of three platforms per company suggests most mid-sized firms crossed this line in 2025 without noticing.

The second is consequence. An agent that reads and summarises can embarrass you. An agent that writes to a system of record, sends a message to a customer or moves money can cost you, and the controls for it, identity, policy, approval and audit, are exactly the middle four functions on the list. We set out how to scope those permissions in August; a control plane is where the scoping gets enforced rather than documented.

The third is scrutiny. From 13 May 2027 India's DPDP Rules require a data fiduciary to show its security safeguards and report a breach within 72 hours, and the EU AI Act's transparency obligations have applied since August. Both assume you can list the systems processing personal data and say who is accountable for each. An agent you cannot find on a register is a system you cannot account for. Microsoft's push for an agent inventory, which we covered in June, was an early version of the same pressure.

What should you build if you are not buying one?

Build the six functions with the tools you already have, in the order they pay off, and buy a product later if the maintenance becomes a job. A company can have a working control plane in a month. Here is the minimum for each function.

A register. One table, in whatever your engineering team already uses, with a row per agent: name, owner, platform, model, what it reads, what it writes, what it may spend, when it was last reviewed. Nothing gets a production credential without a row. This is the discovery and registration function, and it is a document with a rule attached.

An identity per agent. Every agent gets its own service account, API key and, where the platform allows it, its own user in the systems it touches. Never a person's credentials, never a shared key. This makes every other function possible, because a log line that says "the finance agent did this" is worth ten that say "the integration user did this".

A gateway. Route every model call through one proxy, whether a commercial one or an open-source one, so there is a single place to enforce the policy, attach the identity, record the request and meter the spend. If you already route through OpenRouter or a similar service, half of this exists; the missing half is your own policy layer in front of it.

Policy in the gateway and the tools. Read-only by default. Write access to named systems by named agents. Spend caps per agent per day, enforced by the gateway rather than by a dashboard someone checks. A human approval step, shown the raw action and not the agent's summary of it, for anything irreversible.

Logs that a person can read. For every run: the input, the tool calls with their arguments and results, the model and version, tokens, cost, latency, and any approval. Kept for as long as your data retention policy allows and no longer, because those logs will contain personal data. This is observability and it feeds the next function.

Evaluations that gate change. A golden set of cases per agent, run before any change to model, prompt or tool, with a threshold that blocks the change if the score drops. We described the harness in April. Add cost per task to the metrics and you have the cost control function too.

That is six functions, none of them a product, all of them something a competent engineering team can stand up with a spreadsheet, a proxy, a logging pipeline and a test suite. Anthropic disclosed in September that around 30,000 agents run on its internal platform at any time, that every action passes a real-time monitor, and that about 0.002 per cent of more than a billion agent decisions in August were blocked. The scale matters less than the sequence: the monitor existed before the agents did.

When does buying beat building?

Buy when the register has more than a few dozen rows, when the agents span platforms whose native controls you cannot reach from your gateway, or when an auditor wants a report you would otherwise assemble by hand. At that scale the maintenance of the six functions is a full-time role, and a product that does discovery across Copilot, Agentforce and your own code, with a lineage view and an export for the regulator, earns its licence.

Buy carefully. A control plane from a platform vendor will govern that vendor's agents best and everyone else's adequately, and the vendor's incentive is to make its own platform the place your agents live. Check what the third-party coverage means in practice, whether the identity and policy functions enforce or merely display, and what leaves with you if you stop paying. And keep your register and your gateway regardless. They are the parts of the control plane you will need to migrate to the next one.

Frequently asked

What is the Salesforce Trusted Enterprise AI Harness? The Trusted Enterprise AI Harness, announced on 10 September 2026, is Salesforce's architecture for giving AI agents shared business context and letting them act within controls. It combines Data 360, Informatica, MuleSoft, Agent Fabric, Tableau, Agentforce and Salesforce Guardian into six capabilities covering context, agency, action, governance, security and models, plus an AI Control Plane to register, police, observe and meter agents across Salesforce and third-party AI. The unified experience is due in early fiscal 2028, around February 2027, and pricing has not been announced.

What is an AI agent control plane? An AI agent control plane is a management layer that gives a company one place to see and govern every AI agent it runs, whichever platform built it. It typically covers six functions: discovering and registering agents, assigning each an identity and a policy, managing their lifecycle, evaluating their performance, observing their behaviour and outcomes, and controlling their cost. Vendors offering one in 2026 include Salesforce, Microsoft with Agent 365, WSO2 with Agent Manager, Alation and Airrived.

Can a company build its own agent control plane? Yes, and for most mid-sized companies that is the right first step. The minimum is a register of agents with owners and permissions, a separate service identity per agent, a gateway that every model call passes through, policy enforced in the gateway and tools with human approval for irreversible actions, per-run logs of inputs, tool calls, cost and approvals, and an evaluation suite that blocks changes which lower quality or raise cost. Buying a product makes sense once the register grows past a few dozen agents or an auditor needs cross-platform reporting.

Related reading

• Microsoft wants an inventory of your agents. Build the registry before your CISO asks for one
• Agent permissions: how to decide what an AI agent may read, write and spend
• Building evaluation harnesses for production AI systems
• The EU AI Act's transparency rules apply from today
• The AI governance checklist for enterprise teams

Every vendor selling a control plane this autumn is selling the same six functions, and four of the six are things a company should own whoever it buys from. Standing them up, and deciding which product, if any, to put on top, is the work we do in a governance engagement.