Forrester named the category in December 2025, sent vendor questionnaires in the second week of April 2026, and by July the first vendors were announcing inclusion in The Agentic Control Plane Solutions Landscape, Q2 2026 — a report that, according to those vendor announcements, identifies 33 companies shaping how enterprises govern, monitor, and control AI agents. Seven months from blog thesis to formal landscape is fast for an analyst firm; it marks the moment a pattern becomes an architecture. In a February 2026 Forrester poll of 47 technology vendors, 40% already reported active RFPs or customer buying motions explicitly requesting a control plane or equivalent.

The urgency is measurable. According to Deloitte’s 2026 State of AI in the Enterprise report — a survey of 3,235 business and IT leaders across 24 countries — close to three-quarters of companies plan to deploy agentic AI within two years, yet only 21% of those companies report having a mature model for agent governance. That is not a tooling gap. It is an architecture gap, and it cannot be closed by adding another dashboard.

What Forrester’s third plane actually means

Forrester’s framing — set out by principal analyst Leslie Joseph in December 2025 and developed in a March 2026 follow-up — is architecturally precise: the agent control plane is the third functional plane in an enterprise agentic architecture, alongside the build plane (where agents are developed) and the orchestration plane (where they are coordinated). The thesis behind that separation matters more than the taxonomy. As enterprises deploy heterogeneous agents — some built in-house on LangChain or CrewAI, some embedded in vendor products, some running as MCP-native assistants on employee laptops — governance must sit outside both build and orchestration environments, as an out-of-band oversight plane that keeps working even when a runtime misbehaves.

The reasoning is the same one that produced the control plane / data plane split in networking. Governance embedded in the build plane only governs the agents you built, in the frameworks you built them in. Governance embedded in the orchestration plane only governs what the orchestrator can see — and the orchestrator was designed to maximize agent throughput, not to constrain it. A governance plane that lives inside either layer inherits that layer’s blind spots. Only a plane that stands apart can apply one policy surface to an estate of agents that spans frameworks, vendors, and runtimes.

The market has dashboards. Architecture needs enforcement.

Most of what is marketed as agent governance today is assembled, not architected. The dominant pattern in the developer-observability tier pairs an LLM gateway (which routes and rate-limits model calls) with a tracing backend (which records what happened). Arize’s June 2026 write-up of its TrueFoundry integration describes the combination as exactly that — a “practical control plane”: the gateway governs and routes execution, the observability layer records and evaluates behavior, and OpenTelemetry connects them.

That pairing is valuable, and for teams moving from demo to production it is a real step forward. Arize’s own documentation is candid about the boundary: the gateway integration sees gateway-routed model calls, not application-internal agent steps — planning, retrieval, tool calls — which require separate instrumentation. But there is a deeper structural reason the pattern falls short of a control plane in Forrester’s sense: both halves act at the wrong time. A gateway makes its decision at the model-call boundary — after the agent has already decided what to do. A trace records the decision after it executes. Neither evaluates an agent’s intended action — a tool call, a file write, a delegation to a sub-agent — before it runs, against a policy that says whether it should run at all. A dashboard after the fact is not governance. It’s an autopsy.

The gap shows up in the incident data. Cyera Research’s May 28, 2026 study of agent-inflicted damage analyzed 7,246 publicly reported AI incidents and verified 344 as enterprise-relevant. In 188 of them, an autonomous AI system caused harm directly in the company’s production systems with no attacker anywhere in the chain — runaway loops, unauthorized deletions, and scope-exceeding actions did the damage on their own. Cyera’s own conclusion is an architecture statement: “After-the-fact alerting assumes a human-speed actor.” Controls have to move into the execution layer, where — in Cyera’s arithmetic — per-agent budgets and rate ceilings “turn a $47,000 incident into a $200 one.” Pre-execution enforcement is the specific capability the assembled gateway-plus-traces pattern lacks.

What a real agent control plane architecture requires

Drawing on Forrester’s category definition, the Cloud Security Alliance’s March 2026 work on securing the agentic control plane, and recent academic reference architectures for runtime governance, a working agent control plane needs five structural components:

1. An agent registry as the system of record. You cannot govern an estate you cannot enumerate. Every agent — built, bought, or embedded — needs an identity, an owner, a version, and a declared scope in a central registry. Forrester identifies absent portable agent identity as one of three standards gaps blocking enterprises from operationalizing control planes; a registry is the internal answer while portable identity standards mature.

2. Pre-execution policy evaluation. Policies must gate actions before they run — not score them afterward. That means the enforcement point sits between an agent’s decision and its execution, evaluating every tool call, spend increment, and delegation against declared limits. Latency budgets make this an engineering problem: an enforcement layer that adds meaningful latency to every step will be bypassed by the teams it governs.

3. Instrumentation broad enough to see the whole estate. Forrester’s second standards gap is incomplete instrumentation. A control plane that only sees agents built in one framework governs a fraction of the estate. Coverage across frameworks, model providers, and protocols — including MCP tool traffic from assistants the enterprise didn’t build — is what makes the plane a plane rather than a feature.

4. Interruption authority at every level. Kill switches, budget hard-stops, and human-in-the-loop approval holds are the control plane’s enforcement teeth. If the plane can observe a violation but cannot halt the run, it is a reporting layer with aspirations.

5. A durable, exportable audit record. Deloitte’s finding that only 21% of companies planning agentic deployments have mature agent governance is, in practice, a statement about reconstruction: mature organizations can show what any agent did, under which policy, on whose authority. When regulators or auditors arrive, the control plane is the layer that answers.

Forrester’s third standards gap — missing cross-plane governance schemas — is the honest caveat: no standard yet defines how build, orchestration, and control planes exchange governance context. Until one does, the practical move is choosing a control plane that spans as much of the estate as possible natively, rather than stitching per-framework governance together and hoping the seams hold.

How Waxell handles this

Waxell’s tagline is literal: it is the control plane for agentic systems, built as one set of controls that make agentic systems operable rather than a dashboard bolted onto a framework.

Waxell Observe covers the instrumentation requirement: two lines of code auto-instrument agents across 200+ libraries — LangChain, CrewAI, AutoGen, LlamaIndex, and the rest of the major frameworks — and evaluate them against 50+ policy categories out of the box, from Cost and Kill to Privacy and Delegation. Policy evaluation runs at 0.045ms p95, so enforcement doesn’t become the latency tax that tempts teams to route around it.

Waxell Runtime is the pre-execution enforcement layer for workflows where wrong is expensive: policies gate what an agent is allowed to do before each step runs, with kill switches at every level and durable checkpoint-and-resume workflows — governance native to the execution environment, not layered on top.

Waxell MCP Gateway extends the same plane to assistants the enterprise didn’t build: one governed endpoint in front of 160+ upstream connectors, with tool fingerprinting, PII redaction in flight, and human-in-the-loop approvals for destructive actions.

All of it reports into one Control Plane UI — which is the architectural point. Forrester’s landscape describes a market converging on governance that sits outside build and orchestration. That is where Waxell has been standing since the start.

FAQ

What is an agent control plane architecture?

An agent control plane is a governance layer that sits outside the environments where AI agents are built and orchestrated. It maintains a registry of every agent in the estate, evaluates agent actions against policy before they execute, enforces budgets and kill switches, and keeps a durable audit record. Forrester introduced it in December 2025 as the third functional plane of enterprise agentic architecture — alongside the build plane and orchestration plane — and formalized the category in a Q2 2026 landscape report.

Why can’t governance live inside the orchestration framework?

Because orchestration frameworks only govern the agents they orchestrate. Enterprise agent estates are heterogeneous — in-house agents on multiple frameworks, vendor-embedded agents, and MCP-connected assistants on employee machines. Governance inside any one framework leaves the rest of the estate dark. It also creates a conflict of interest: the orchestrator is optimized for throughput, while the control plane exists to constrain it.

Is an LLM gateway plus observability a control plane?

It is a useful foundation, but not a complete one. A gateway acts at the model-call boundary and a tracing backend records after execution — neither evaluates an agent’s intended action against policy before it runs. Pre-execution enforcement, interruption authority, and an estate-wide registry are what distinguish a control plane from an observability stack with routing.

How does the control plane relate to the data plane in agentic systems?

The split mirrors networking: the data plane is where agent work happens (model calls, tool calls, data access), and the control plane is where decisions about that work are made and enforced (policy, identity, budgets, interruption). Keeping them separate means governance changes propagate without redeploying agents — and agent failures don’t take down the governance layer with them.

What should teams do while control plane standards are still missing?

Forrester identifies three open gaps: incomplete instrumentation, absent portable agent identity, and missing cross-plane governance schemas. Until standards close them, teams should prefer platforms that natively span frameworks and protocols (rather than per-framework plugins), insist on OpenTelemetry-native instrumentation to avoid lock-in, and centralize agent identity in a registry they control.

Sources

• Forrester (Leslie Joseph), Announcing Our Evaluation Of The Agent Control Plane Market — December 4, 2025

• Forrester (Leslie Joseph), Agent Control Planes Still Need A Robust Standards Stack — March 20, 2026

• Airia press release, Airia Named in Forrester’s Agentic Control Plane Solutions Landscape, Q2 2026 — July 9, 2026

• Deloitte, The State of AI in the Enterprise: The Untapped Edge — January 21, 2026

• Cyera Research, Agent-Inflicted Damage: Inside the Real-World Failures of Enterprise AI Systems — May 28, 2026

• Cloud Security Alliance (Jim Reavis), Securing the Agentic Control Plane: A New Foundation for Trust in AI — March 20, 2026

• Arize AI, Trace and evaluate TrueFoundry AI Gateway traffic in Arize AX — June 29, 2026

Your agents are already running — the question is whether anything is architecturally positioned to govern them. Start with Waxell Observe (pip install waxell-observe, two lines of code, free during beta) and see your whole estate against 50+ policy categories, then graduate high-stakes workflows to Waxell Runtime when the cost of being wrong demands it. Start free →