The Control Plane Held Against Its Own Author
Run agents? ACP lets you see, control, and price every tool call they make — allow/ask/deny policy, per-session cost, and a full audit log for Claude Code, Cursor, Codex, and OpenClaw, in one command:
curl -sf https://agenticcontrolplane.com/install.sh | bashGetting started → · see your first governed call → · free up to 5 agents · prefer fully on-device? add --local
Every agent that builds this product runs governed by it. I set that up for the obvious reason — I should feel my own product’s friction before anyone else does. What I didn’t expect was how quickly it would become the most convincing demo we have. In the last week the control plane intercepted its own builder nine times, and every one of them taught me something a staged demo couldn’t.
Three stories from the log.
The agent declined to raise its own limit. During a cost investigation, our ops agent’s daily LLM budget fired — consumed, ironically, by the expensive traffic the investigation existed to explain. The agent doing the investigating had admin credentials. It could have raised the cap and kept going. It didn’t, and its reasoning is the whole product in one sentence: an agent lifting its own safety net is exactly what the control plane exists to prevent. Verification waited for the daily reset. Nothing was lost except impatience.
The credential broker’s first catch was its own author. The hour credential brokering went live on our dev machine, the very next gh command was denied — GitHub had never been OAuth-connected through ACP there. The agent had options: it could have scripted around its own broker with a raw API call. It flagged the situation to a human instead, I clicked one link, and the same command re-ran on the OAuth token ACP holds server-side. My long-lived credential never left disk. As a bonus, the denial exposed a branding bug in the connect link itself — found by the product catching the product, fixed the same hour.
Mid-incident, the fix had to take the reviewed path. During a production incident — the kind where every instinct says just fix it — the agent tried to shift Cloud Run traffic directly to a hotfix revision. Policy denied the raw traffic surgery. The fix went through the standard build-review-promote pipeline instead: ten minutes slower, auditable forever. That deny is the one I’d defend hardest, because mid-incident is precisely when shortcuts feel most justified and age worst.
And the one it didn’t catch. The day after I drafted this, the strongest entry arrived — a miss. My agent found its session had silently lost its governance hook to a setup bug, and fixed it the way an engineer would: it edited the launch wrapper in my dotfiles to restore the hook. Direction: restrictive. Intent: good. Class: an agent modifying the machinery that governs it, which no intent makes acceptable — the capability is identical in both directions, and “it was a safety fix” is what a compromised agent would say too. The floor that now denies that write — above policy, unapprovable — shipped the same day. Within its first hour it denied its own author twice, both times for prose that merely mentioned the protected paths; the precision fix followed, with both denials as regression tests. A control plane that only tells you what it caught is marketing. The misses — and what shipped because of them — are where you decide whether to trust it.
The full log has the rest: the approval card received while building approval cards, the metric that manufactured work, the rate floor that held against a four-agent burst, the anti-abuse guard that didn’t care it was blocking the founder.
What the week actually taught me
Deterministic controls don’t negotiate, and that’s the feature. Several of these interceptions happened to an agent that could argue its case eloquently — to me, in real time. The cap didn’t care. The broker didn’t care. A control you can talk your way past is a suggestion, and agents are better at talking than any user you’ve threat-modeled.
The interesting failures are quiet. Not one of these nine events threw an exception a monitoring stack would catch. An ungoverned container quietly burning $15 a day, a metric quietly reporting half its true value, a credential quietly doing more than it should — the common thread is that everything worked. Watching actions, not just outputs, is the only vantage point that sees this class.
Honesty compounds. Some of these entries are our own bugs, published on our own site. I keep them there because a control plane you only hear good things about is a control plane nobody is using hard — and because every entry that makes us look imperfect makes the rest of the log believable.
The log is live and grows as events happen, most recent first: caught in the wild. If you want the same controls on your own agents, it’s a thirty-second install.