The Execution Split: Why Production Agents Require a Control Plane

Most AI agents built this year will never make it to production. They look brilliant in a demo, but the moment they touch real customer data or system permissions, the architecture fails.

The problem isn't that the model is "too small" or "not smart enough." It is a structural failure. We are trying to cram reasoning and execution into the same black box. In the world of systems engineering, that is a recipe for disaster.

To move agents from the lab to the field, we must decouple the Data Plane (where the work happens) from the Control Plane (where the rules are enforced).

Key Takeaways

• The Demo Trap: Agents fail in production because there is no separation between reasoning ability and the authority to act.
• Three-Plane Architecture: A necessary split between the Build Plane, Orchestration Plane, and Control Plane.
• Verified Identity: Agents must act as specific, authenticated users, not via shared service accounts.
• Out-of-Band Governance: Oversight must sit outside the agent's execution loop to prevent the agent from bypassing its own constraints.

Why Agents Stall at the Prototype Stage

When I built the first automation systems at Aniccai, I saw this pattern repeat. A team builds a sophisticated agent using LangChain or the OpenAI SDK. It answers questions beautifully and parses documents with ease. But then, the business asks it to update an opportunity in Salesforce or issue a refund.

This is where the risk explodes. The agent is typically given an API key with broad permissions. If the model hallucinates, it might delete records or trigger unintended emails to clients.

The common fix is trying to "jail" the agent using system prompts. It doesn't work. You cannot manage enterprise risk through polite requests to a probabilistic model. You need a deterministic control layer that blocks unauthorized actions before they ever reach the target system.

The Three-Plane Architecture

In late 2025, Forrester formalized a model that changes how enterprises deploy agents. They decomposed the architecture into three distinct functional planes.

1. The Build Plane: This is where the agent is constructed. It includes the LLM, memory, and tool definitions. It defines how the agent thinks.
2. The Orchestration Plane: This is where agents are embedded into workflows. It handles the sequence of events and the handoffs between agents and humans.
3. The Control Plane: This is the independent oversight layer. It asks: Is this agent allowed to do this? Does it have the budget? Is the user it represents currently authorized?

This separation is critical. If your governance lives inside your build tool, you have no independent oversight. The Control Plane must be out-of-band to remain objective.

Probabilistic Reasoning vs. Deterministic Execution

Large Language Models are probabilistic. They guess the next best token. This is excellent for creative writing but dangerous for database integrity.

A Control Plane makes agent actions deterministic. Instead of an agent trying to figure out how to navigate a complex SAP API on the fly, it invokes an "Enterprise Skill" – a pre-defined, governed action within the control plane.

Verified User Authentication: The Foundation of Trust

One of the biggest mistakes is letting an agent act as a generic system user. When something goes wrong, you cannot trace which human actually initiated the request.

Modern architectures use Verified User Authentication (VUA). This ensures the agent doesn't act as an independent entity but as an authorized extension of a specific employee. If the employee doesn't have permission to delete a record, their agent doesn't either. This satisfies compliance requirements and ensures every action is logged against a real identity.

Sources

• Enterprise Agent Architecture: The Three Planes (Mercor)
• What Is an Agent Control Plane? Enterprise Guide 2026 (web)
• Control and Execution Plane for Enterprise AI (2026) (Workato)

FAQ

What is the difference between a control plane and orchestration?

Orchestration is about the "how" – the sequence and flow of the business process. The Control Plane is about the "whether" – enforcing permissions, identity, and safety rules regardless of the flow.

Can I build a control plane myself?

It is possible but resource-intensive. You need to build identity propagation, credential vaulting, and a real-time policy engine that sits between your agents and your APIs. Most firms find it more pragmatic to adopt a purpose-built platform.

Why can't I just use system prompts for governance?

Prompt injection is an unsolved problem. A clever user or a malformed input can trick the model into ignoring its instructions. Only an external, deterministic layer can provide a hard guarantee of safety.

Things to Remember

• Never rely on prompts to enforce security boundaries.
• Separate the reasoning engine from the execution infrastructure.
• Ensure every agent action is tied to a verified human identity.

Do you know exactly which AI agents are running in your environment right now, and what specific data they have the power to delete?