{ "schemaVersion": 1, "id": "ai-agent-control-plane", "slug": "ai-agent-control-plane", "title": "What is an AI agent control plane?", "shortTitle": "AI agent control plane", "description": "An AI agent control plane inventories agents, joins evidence across systems, keeps authority explicit, and verifies consequential outcomes.", "targetQuestion": "What is an AI agent control plane, and what belongs in one?", "directAnswer": "An AI agent control plane is the operating layer that makes a collection of AI agents governable as one estate. It discovers agents across platforms, joins identity, ownership, capability, usage, cost, and risk evidence, turns supported evidence into findings, keeps approval authority explicit, and verifies the outcome of every consequential action.", "scope": "This is Celest's operating-model definition. It describes the controls an organization needs around agent runtimes; it is not a claim that every stage is commercially available in Celest today.", "evidenceLevel": "Celest operating model, informed by cited standards and primary platform specifications.", "author": { "name": "Celest", "url": "https://celest.dev/" }, "published": "2026-07-27", "updated": "2026-07-27", "sections": [ { "id": "why-it-exists", "heading": "Why an agent estate needs a control plane", "blocks": [ { "type": "paragraph", "text": "Organizations rarely operate every agent in one runtime. An agent's identity may live in an identity provider, its definition in an authoring platform, its tools in APIs or MCP servers, its work in business systems, and its cost and activity in still other sources. Each system can be accurate about its own record while no system answers who owns the whole agent or whether its authority is still justified." }, { "type": "paragraph", "text": "A control plane does not replace those execution systems. It joins their observations into an accountable estate, preserves conflicts and unavailable evidence, and provides one governed path from a supported finding to a verified outcome." }, { "type": "callout", "label": "Core distinction", "text": "The execution plane runs an agent. The control plane determines what exists, what is known about it, who may authorize change, and whether the intended result actually occurred." } ] }, { "id": "seven-stage-loop", "heading": "The seven-stage operating loop", "blocks": [ { "type": "paragraph", "text": "A useful control plane keeps observation, judgment, authority, action, and proof separate. Collapsing those states makes a recommendation look like an approval or an accepted API request look like a successful outcome." }, { "type": "table", "caption": "Seven distinct control-plane stages", "columns": [ "Stage", "Question", "Durable output" ], "rows": [ [ "1. Discover", "What agents and source observations exist?", "Evidence snapshot with provenance and source health" ], [ "2. Diagnose", "What does the available evidence support?", "Finding with rationale, severity, and unknowns" ], [ "3. Propose", "What bounded work could resolve the finding?", "Plan with scope, predicted effect, and rollback conditions" ], [ "4. Approve", "Who or what policy has authority for this exact work?", "Authority decision tied to actor, scope, and time" ], [ "5. Execute", "What provider-native action was attempted?", "Action record without assuming success" ], [ "6. Verify", "Did fresh observation show the intended effect?", "Execution receipt with postcondition evidence" ], [ "7. Reconcile", "Can the finding close, or must it reopen?", "Updated estate state and review history" ] ] } ] }, { "id": "minimum-record", "heading": "What belongs in the canonical agent record", "blocks": [ { "type": "paragraph", "text": "The record should be a provenance-preserving join, not a flattened guess. Every material value needs a source, observation time, and confidence or availability state. Contradictory source values should remain visible until a governed rule resolves them." }, { "type": "list", "items": [ "Stable identity and aliases across source systems", "Accountable business and technical owners, including an explicit unknown state", "Lifecycle state, publication state, assignments, and last meaningful activity", "Models, tools, connectors, MCP servers, credentials, and delegated permissions", "Data boundaries, environments, regions, and external dependencies", "Usage, cost, quality, safety, and security observations with source health", "Findings, proposed work, authority decisions, actions, receipts, and reconciliation history" ] }, { "type": "callout", "label": "Unknown is evidence", "text": "Missing ownership or unavailable cost data is not zero and should not be silently inferred. The gap itself is an operating finding." } ] }, { "id": "authority", "heading": "Authority must be data, not an assumption", "blocks": [ { "type": "paragraph", "text": "Agent tools can cross security and organizational boundaries. The Model Context Protocol authorization specification, for example, requires protected MCP servers to verify access tokens and audience rather than accepting tokens intended for another resource. That runtime check is necessary, but an estate control plane must also preserve why a particular actor or policy was allowed to approve a particular change.", "sourceIds": [ "mcp-authorization" ] }, { "type": "paragraph", "text": "An authority decision should bind the approver, proposed work digest, target scope, constraints, expiration, and rationale. Execution must fail closed when the decision is missing, expired, or does not match the requested work." } ] }, { "id": "evidence-and-risk", "heading": "Evidence quality is part of the risk model", "blocks": [ { "type": "paragraph", "text": "The NIST AI Risk Management Framework organizes AI risk work around Govern, Map, Measure, and Manage, and describes governance as a cross-cutting function. An agent control plane turns that idea into inspectable operating state: the estate being governed, the evidence available to measure it, the decisions made, and the result of risk treatment.", "sourceIds": [ "nist-ai-rmf" ] }, { "type": "paragraph", "text": "A source outage, stale observation, failed join, or inaccessible permission record changes what the system can responsibly conclude. Source health and collection time therefore belong beside the evidence, not in an internal log that disappears from the decision." } ] }, { "id": "not-a-control-plane", "heading": "What is not an agent control plane", "blocks": [ { "type": "list", "items": [ "A catalog that lists agents but cannot explain ownership, authority, or evidence provenance", "An orchestration framework that runs multi-agent workflows but does not govern the surrounding estate", "A dashboard that converts unavailable observations into reassuring zeros", "A policy document with no connection to live source evidence or execution receipts", "An automation layer that treats approval as a UI click and an HTTP 200 as proof of success" ] } ] }, { "id": "microsoft-estate", "heading": "How this applies to a Microsoft agent estate", "blocks": [ { "type": "paragraph", "text": "In a Microsoft-centered estate, relevant evidence can span identity, Microsoft 365, Copilot Studio, Power Platform, Azure, GitHub, Azure DevOps, and the business systems an agent can reach. Celest's current commercial entry point is a fixed-scope, read-only Agent Estate Review that gathers and normalizes available evidence before proposing any action." }, { "type": "paragraph", "text": "Celest currently has bounded development proof for discovery and deterministic diagnosis. Proposal is the next gate. Approval, execution, verification, and reconciliation describe the intended operating model and are not claimed here as current commercial execution capability." } ] } ], "limitations": [ "There is no universal industry definition of an AI agent control plane; this page states Celest's definition and design criteria.", "A control plane cannot repair incomplete source data by inference without changing evidence into speculation.", "Cross-platform inventory does not itself grant authority to modify any source system.", "Controls must be adapted to the organization's risk, regulatory, identity, and operating context." ], "sources": [ { "id": "nist-ai-rmf", "title": "Artificial Intelligence Risk Management Framework (AI RMF 1.0)", "publisher": "National Institute of Standards and Technology", "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf", "accessed": "2026-07-27", "supports": "The Govern, Map, Measure, and Manage framing and governance as a cross-cutting function." }, { "id": "mcp-authorization", "title": "Model Context Protocol authorization specification", "publisher": "Model Context Protocol", "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization", "accessed": "2026-07-27", "supports": "Resource-server token validation, audience binding, and protected-resource authorization behavior." } ], "related": [ { "title": "Explore the fictional product demo", "url": "https://demo.celest.dev/", "description": "See the evidence-first estate and lifecycle model using illustrative records." }, { "title": "Request an Agent Estate Review", "url": "mailto:founders@celest.dev?subject=Agent%20Estate%20Review", "description": "Start with a fixed-scope, read-only review of the agent estate you already operate." } ], "publication": { "canonicalUrl": "https://celest.dev/learn/ai-agent-control-plane", "sourceDigest": "sha256:9096d9b3485490f40e5e46ebcac384bbe788f248689a010de0ba271dd2b9f8b1" } }