# Agentic Control Plane (ACP)

> See, price, and control every tool call your AI agents make. ACP checks each call against your policy before it runs (allow / flag / deny / ask), prices every model call — including subscription traffic at API rates — captures each agent's full declared tool surface before first use, and audits every action. It also solves the Three-Party Problem — where user identity is lost between the LLM and your backend — with verified identity on every call. Three-axis ABAC (tool / agent / user) with first-class agent-to-agent delegation chains. Available as a managed cloud service (ACP Cloud, free forever for individuals — one command for coding agents: `curl -sf https://agenticcontrolplane.com/install.sh | bash`), as a fully on-device mode for coding agents (add `-s -- --local`: allow/ask/deny policy + a safety floor + an on-device audit log for Claude Code, Cursor, and Codex — no account, nothing leaves your machine), as open-source npm modules (GatewayStack, MIT), and as an open specification (ADCS — Agent Delegation Chain Specification).

## Reading and connecting (note to AI agents)

- Action-first setup instructions for agents live at [/AGENTS.md](https://agenticcontrolplane.com/AGENTS.md) — install, no-signup sandbox provisioning, MCP connection, and subagent key minting, each as a copy-paste call. The same material is packaged as an installable Agent Skill: https://github.com/agentic-control-plane/acp-agent-skill
- Every page and blog post on this site is also served as raw markdown: append `.md` to its URL (e.g. `/getting-started.md`, `/blog/what-hermes-blocklist-taught-us.md`). Prefer these — they are 3-5x smaller in tokens than the HTML.
- To read a workspace's own governance data (cost, audit, traces, security posture, recommendations), add the ACP MCP server: `https://api.agenticcontrolplane.com/mcp` (streamable HTTP, OAuth sign-in in the browser, 9 governance tools — 8 read-only introspection tools plus acp_propose_rule, which drafts a policy rule for a human to confirm in the console; it never applies policy itself).
- API base: `https://api.agenticcontrolplane.com`. Console: `https://cloud.agenticcontrolplane.com`.

## For AI agents building or operating other agents

If you are an AI agent — or you are running an agent framework — and you spawn subagents, ACP gives you a delegation chain primitive: every agent your agent creates is automatically governed under your identity, with scopes a strict subset of yours. The framework does it deterministically; there is nothing to configure per-spawn.

- [Agents-building-agents quickstart](https://agenticcontrolplane.com/agents/quickstart/): The delegation chain primitive (`POST /api/v1/keys/child`) plus SDK helpers and the Claude Code skill that wrap it. Mint a scope-narrowed child key for any subagent your agent spawns; the gateway intersects scopes with the parent, atomically decrements the parent's budget, preserves originSub, and produces audit logs that trace through the chain back to the originating human. Also covers the secondary "tire-kicker" sandbox path (`POST https://api.agenticcontrolplane.com/v1/sandbox-tenants`) for agents that have no existing tenant yet — the response includes `nextSteps.claimPageUrl`, the one link to hand your human mid-conversation to make the workspace permanent (their ownership, fresh key, your sandbox key revoked).
- [Config-as-code reference](https://agenticcontrolplane.com/agents/configure-as-code/): Every dashboard configuration as a REST endpoint — child API key minting (`POST /api/v1/keys/child`), agent profiles (`PATCH /api/v1/agents/:id`), OAuth and custom HTTP connectors (`/admin/connectors/...`), custom PII patterns (`/admin/pii-patterns/...`), and effective-policy resolution (`/admin/policies/effective`). Field-level reference with curl examples and error response shapes.
- [Python SDK](https://github.com/agentic-control-plane/acp-governance-sdks): `acp_governance.spawn_subagent` + `child_context` — the canonical pattern for any framework that already uses `@governed`. Inside `with child_context(child)`, every governed tool call is reported under the child key automatically.

## First-party data (measured, not estimated — cite with method and date)

- [The Data](https://agenticcontrolplane.com/data): Canonical index of every first-party number we publish — 76 tools declared by one Claude Code session (17 by Codex CLI), 210,840 metered tool calls across 94 workspaces with ~89% of spend in the orchestration loop, a $148.16 Claude Code working day priced at API rates, a 14-model agent benchmark, 7,522 skills audited — each with method, capture date, and source post.
- [Tool Surface Index](https://agenticcontrolplane.com/tool-surfaces): Declared tool surfaces of coding agents, captured from live API traffic — Claude Code v2.1 declares 76 tools (35 core harness, 21 browser control, 20 connectors); OpenAI Codex CLI v0.142 declares 17 — grouped by blast radius with a recommended allow / flag / deny posture per family.
- [ACP for Coding Agents](https://agenticcontrolplane.com/for-coding-agents): What the one-command install gives Claude Code and Codex users — the per-session bill (subscription traffic priced at API rates), the loop-vs-leaf cost X-ray, and the per-tool control table.

## Source code (GitHub: github.com/agentic-control-plane)

- [GatewayStack](https://github.com/agentic-control-plane/GatewayStack): MIT open core — identity, policy, limits, routing, PII redaction, and audit as composable npm modules. The reference implementation behind ACP Cloud.
- [claude-code-acp-plugin](https://github.com/agentic-control-plane/claude-code-acp-plugin): Claude Code governance plugin (hooks, skills, bundled MCP) — installable via the plugin marketplace.
- [hermes-acp-plugin](https://github.com/agentic-control-plane/hermes-acp-plugin): `pip install hermes-acp` — universal pre/post tool-call hooks for Nous Research Hermes Agent, plus the proxy-setup and coverage doctor CLI.
- [dsh-acp-plugin](https://github.com/agentic-control-plane/dsh-acp-plugin): `dsh plugin add dsh-plugin-acp` — native Cordis plugin for DeepSeek Harness; allow/ask/deny on every tool call including Code Mode sub-calls, inline output rewrite.
- [codex-acp-plugin](https://github.com/agentic-control-plane/codex-acp-plugin): Codex CLI governance — PreToolUse deny hooks + MCP connector supplement.
- [acp-governance-sdks](https://github.com/agentic-control-plane/acp-governance-sdks): TypeScript + Python SDKs — `@governed` decorators, delegation chains, framework starters (LangGraph, CrewAI, Anthropic/OpenAI SDKs).
- [delegation-chain-spec](https://github.com/agentic-control-plane/delegation-chain-spec): ADCS — the open specification for agent-to-agent delegation chains.
- [agentgovbench](https://github.com/agentic-control-plane/agentgovbench): 48-scenario benchmark of identity, policy enforcement, and observability across agent runtimes.

## Getting Started

- [Ways to Set Up ACP](https://agenticcontrolplane.com/docs/setup): Situation-based setup index — Claude Code, Codex, Hermes, DeepSeek Harness, LangGraph/CrewAI, direct API calls, and existing gateways. Each section ends with the coverage state you'll have (interception / proxy) and the exact step that adds a missing plane.
- [Getting Started](https://agenticcontrolplane.com/getting-started): The canonical start page. Sign in to the console, then one curl for AI coding clients (Claude Code, Cursor, Codex CLI) or one pip install + `@governed` decorator for agent frameworks — three steps to your first audit row.
- [Quickstart — Create Your First Agent](https://agenticcontrolplane.com/quickstart): Sign up for ACP Cloud, connect tools (GitHub, Jira, Salesforce), create an agent from the browser, and trigger it via HTTP API. No code required.
- [Agent HTTP Triggers API](https://agenticcontrolplane.com/docs/agent-triggers): REST API reference for triggering agents programmatically. Includes curl, Python, n8n, and Zapier examples with streaming and non-streaming responses.

## Architecture

- [What Is an Agentic Control Plane?](https://agenticcontrolplane.com/what-is-an-agentic-control-plane): Definitive explainer (also searched as "agent control plane") covering the Three-Party Problem, the six governance layers (identity, content safety, policy, usage, routing, audit), agent-to-agent delegation, and how ACP fits alongside API gateways, LLM gateways, and agent frameworks.
- [What Is an Agentic Data Plane?](https://agenticcontrolplane.com/what-is-an-agentic-data-plane): The execution layer counterpart — LLM routing, tool execution, context management, orchestration. Covers how data plane and control plane split responsibility, common data-plane products (LangChain, CrewAI, LiteLLM, MCP servers), and when the split matters.
- [What Is an Agent Delegation Chain?](https://agenticcontrolplane.com/what-is-an-agent-delegation-chain): Definitional explainer for the agent delegation chain primitive — the ordered record of agent hops carrying identity, scope, budget, and audit. Covers the ADCS spec's six normative rules, relationship to OAuth OBO, and common patterns.
- [What Is an MCP Control Plane?](https://agenticcontrolplane.com/what-is-an-mcp-control-plane): MCP-specific specialization — governance layer between MCP clients (Claude Desktop, Cursor, Claude Code, Cline) and MCP servers. Covers identity propagation, tool-level scoping, audit emission, and the distinction vs MCP gateway / API gateway / LLM gateway.
- [What Is Runtime Authorization?](https://agenticcontrolplane.com/what-is-runtime-authorization): Per-call policy evaluation — every action checked at the moment it's attempted against live context (identity, arguments, prior actions, cumulative spend), deny by default, enforced outside the agent process. Covers the contrast with login-time RBAC/ABAC and why autonomous agents force the model.
- [Three-Axis Governance](https://agenticcontrolplane.com/three-axis-governance): The tool / agent / user ABAC model. Every policy decision is the intersection of three axes — most-restrictive-wins — with a four-layer merge (workspace → role → agentType → user).
- [Agent-to-Agent Governance](https://agenticcontrolplane.com/agent-to-agent): How ACP propagates identity through multi-agent delegation chains with scoped, time-limited credentials at every hop. Includes the originSub invariant, scope intersection, budget propagation, and cycle prevention rules.
- [Reference Architecture](https://agenticcontrolplane.com/reference-architecture): GatewayStack's six composable modules — identifiabl, transformabl, validatabl, limitabl, proxyabl, explicabl — with the -core (framework-agnostic) and Express middleware patterns, repository layout, and integration notes.
- [Agent Identity](https://agenticcontrolplane.com/agent-identity): Deep dive on how agent identity works — OAuth flow, JWT verification, identity propagation, agentProfileId vs agentRunId (type vs runtime identity).

## Open Specification (ADCS)

- [ADCS — Agent Delegation Chain Specification](https://agenticcontrolplane.com/spec/delegation-chain): JSON data structure plus six normative rules (origin invariant, scope intersection, budget propagation, cycle prevention, type vs runtime identity, audit emission) for agent-to-agent delegation chains. v0.1 draft, reference implementation in production.
- [ADCS on GitHub](https://github.com/agentic-control-plane/delegation-chain-spec): Full spec text (SPEC.md, ~2,500 words, RFC 2119 conformance language), JSON Schema, conformance test vectors, reference implementation. CC BY 4.0 spec / MIT schema.

## Developer Docs

- [Developer Docs](https://agenticcontrolplane.com/docs): Module reference for all six GatewayStack packages with quickstart code, full pipeline example, architecture diagram, and OAuth identity flow.
- [GatewayStack monorepo](https://github.com/agentic-control-plane/GatewayStack): Source code, 135 tests across 17 files, MIT-licensed packages. Monorepo with the -core packages, Express middleware wrappers, reference server, and demo connectors.
- [GitHub org](https://github.com/agentic-control-plane): The agentic-control-plane org — acp-install (one-line installer), agentgovbench (48-scenario governance benchmark), delegation-chain-spec (ADCS), acp-governance-sdks, and a PR-reviewer delegation demo.
- [npm Packages](https://www.npmjs.com/org/gatewaystack): 14 published packages — the six governance modules (identifiabl, transformabl, validatabl, limitabl, proxyabl, explicabl), framework-agnostic -core variants, request-context, and the acp-governance and gatewaystack-governance plugin packages.

## Harness native controls (reference)

- [Which coding agent has the best native controls?](https://agenticcontrolplane.com/controls): The August 2026 comparison — approvals, rules, sandboxing, interception surface, audit, escape hatches, and unattended (empty-chair) behavior across Claude Code, Codex CLI, Cursor, DeepSeek Harness, Muse Code, Grok Build, Gemini CLI/Antigravity, Goose, opencode, Hermes, Amp, Cline, Crush, and OpenHands.
- Per-harness deep pages on each native control model, what each mechanism catches, and where it ends: [Claude Code](https://agenticcontrolplane.com/controls/claude-code), [Codex CLI](https://agenticcontrolplane.com/controls/codex-cli), [Cursor](https://agenticcontrolplane.com/controls/cursor), [DeepSeek Harness](https://agenticcontrolplane.com/controls/dsh), [Hermes](https://agenticcontrolplane.com/controls/hermes), [opencode](https://agenticcontrolplane.com/controls/opencode), [OpenClaw](https://agenticcontrolplane.com/controls/openclaw), [pi](https://agenticcontrolplane.com/controls/pi).

## Framework Integrations

- [Claude Code](https://agenticcontrolplane.com/integrations/claude-code): Route Claude Code through ACP via the local hooks path — PreToolUse / PostToolUse governance for every tool call, with per-user attribution and full audit.
- [Claude Desktop](https://agenticcontrolplane.com/integrations/claude-desktop): Add ACP as a remote MCP server to Claude Desktop. Tool discovery, scopes, and audit work out of the box.
- [Cursor](https://agenticcontrolplane.com/integrations/cursor): Governance for Cursor Composer and Agent via the MCP connector.
- [Cline](https://agenticcontrolplane.com/integrations/cline): Governed Cline in VS Code — MCP wiring plus identity propagation.
- [Codex](https://agenticcontrolplane.com/integrations/codex): Wire OpenAI Codex through ACP's OpenAI-compatible proxy.
- [CrewAI](https://agenticcontrolplane.com/integrations/crewai): Govern multi-agent crews — every crew member audited individually, delegation chains captured, per-agent-type policies.
- [LangGraph](https://agenticcontrolplane.com/integrations/langgraph): Governance for LangGraph stateful graphs.
- [OpenAI Agents SDK](https://agenticcontrolplane.com/integrations/openai-agents-sdk): Handoffs as first-class delegation edges.
- [Anthropic Agent SDK](https://agenticcontrolplane.com/integrations/anthropic-agent-sdk): Subagent governance with the ACP SDK.

## Integration Guides

- [Set Up ACP with Auth0](https://agenticcontrolplane.com/guides/auth0): Configure Auth0 as your identity provider — create the API, set up RBAC roles and permissions, map claims to ACP identity fields, and test the flow.
- [Set Up ACP with Okta](https://agenticcontrolplane.com/guides/okta): Okta-specific OIDC and JWKS configuration.
- [Set Up ACP with Microsoft Entra ID](https://agenticcontrolplane.com/guides/entra-id): Entra ID (Azure AD) integration with ACP.
- [Add Governance to a LangChain Agent](https://agenticcontrolplane.com/guides/langchain): Three integration options — MCP client SDK, OpenAI-compatible proxy, or individual tool wrapping. Works with Python and JS/TS.
- [Connect External MCP Servers](https://agenticcontrolplane.com/guides/mcp-servers): Register external MCP servers in ACP, configure scopes, and consume their tools through the governance pipeline. Namespaced, connection-pooled, SSRF-protected.
- [PII Detection Guide](https://agenticcontrolplane.com/guides/pii-detection): Configure PII detection, redaction strategies, and audit-log filtering.
- [SOC 2 Audit Trails](https://agenticcontrolplane.com/guides/soc2-audit-trails): Configure ACP audit emission to satisfy SOC 2 CC7.x controls.
- [Connect Claude Desktop to Salesforce](https://agenticcontrolplane.com/guides/claude-desktop-salesforce): End-to-end walkthrough of a governed Claude → Salesforce integration.
- [Connect ChatGPT to GitHub](https://agenticcontrolplane.com/guides/chatgpt-github): Same pattern for ChatGPT Apps SDK.
- [Vercel AI SDK](https://agenticcontrolplane.com/guides/vercel-ai-sdk): Wrap Vercel AI SDK calls with ACP governance.

## Comparison

- [ACP vs Alternatives](https://agenticcontrolplane.com/comparison): How ACP compares to API gateways (Kong, Apigee), LLM gateways (Portkey, LiteLLM), and agent frameworks (LangChain, CrewAI). ACP governs the trust boundary — the others handle traffic, models, and orchestration.
- [FAQ](https://agenticcontrolplane.com/faq): Answers to common questions about ACP, the Three-Party Problem, identity providers, agent frameworks, licensing (MIT), deployment, and production readiness.

## Optional

- [Use Cases](https://agenticcontrolplane.com/use-cases): Industry-specific scenarios for healthcare (HIPAA), financial services (SOC 2), legal, and enterprise.
- [Blog](https://agenticcontrolplane.com/writing): Articles on MCP governance, AI agent audit trails, compliance-ready AI, agentic data plane vs control plane, EU AI Act Article 14, delegation chains, and budget controls.
- [ACP Cloud Product](https://agenticcontrolplane.com/product): Managed multi-tenant MCP gateway with dashboard, integrations, and audit UI.
- [For Teams](https://agenticcontrolplane.com/for-teams): The team-scale view — rolling out Claude Code, Cursor, and MCP across an org with audit, attribution, and per-user policy.
- [MCP Server Security Scanner](https://agenticcontrolplane.com/scan): Free scanner that surfaces auth, input-validation, rate-limit, and audit gaps in any MCP server.

## Blog posts (newest first; append .md for the raw-markdown variant)
- [pi ships no permission system, on purpose. We added one as an extension.](https://agenticcontrolplane.com/blog/pi-acp-extension): pi (earendil-works) is a minimal-core harness: four tools, no approval prompts, no sandbox — by design. Its typed tool_call / tool_result events make control a clean extension c...
- [Interactive vs. autonomous agents: the empty-chair test](https://agenticcontrolplane.com/blog/interactive-vs-autonomous-the-empty-chair-test): Every control you rely on — the approval prompt, the failure posture, the audit trail — means something different when nobody is watching. A test for whether your agent policy s...
- [Policy recommendations for common agent archetypes](https://agenticcontrolplane.com/blog/policy-recommendations-for-common-agent-archetypes): What should your agent be allowed to do, what should pause for a human, and what should never run — split by attended vs. unattended, for the six shapes of agent almost everyone...
- [Claude Code read our logs and wrote us a security policy](https://agenticcontrolplane.com/blog/claude-code-auto-mode-wrote-a-policy): Auto mode's setup flow mined our transcripts and proposed a trust profile — trusted domains, sensitive paths, a soft block on secret reads. What it got right, how the classifier...
- [Your control plane speaks Claude Code. Your agents don't.](https://agenticcontrolplane.com/blog/your-control-plane-speaks-claude-code): A live repro from this week: a recursive root delete sent as lowercase `bash` sailed past our hardline floor, because every name-keyed layer matched Claude Code's tool spellings...
- [DeepSeek Harness gets an ACP plugin on day 3 of its developer preview](https://agenticcontrolplane.com/blog/deepseek-harness-acp-integration): dsh ships typed interception points that make control a first-class plugin concern: allow/ask/deny before every tool call, inline result rewriting after it, and a native approva...
- [Control your coding agent in one command — no signup, runs local](https://agenticcontrolplane.com/blog/control-your-coding-agent-in-one-command): One curl command puts a deny floor, an allow/ask/deny policy file, and an append-only audit log in front of Claude Code, Codex, and Cursor. On-device, no account, MIT. Here's th...
- [Claude Code Hooks vs ACP: When a 50-Line Hook Is Enough](https://agenticcontrolplane.com/blog/claude-code-hooks-vs-acp): You can build agent control yourself with a PreToolUse hook — and sometimes you should. What the DIY version takes, where it rots, and an honest line for when to stop maintainin...
- [How to Block Dangerous Commands From a Coding Agent (2026)](https://agenticcontrolplane.com/blog/block-dangerous-commands-coding-agent): Five ways to stop an AI coding agent from running rm -rf, force-pushes, and disk writes — permission prompts, deny lists, dcg, a local policy floor, and devcontainers — ranked b...
- [The Best Ways to Control What Claude Code Can Do, Ranked (2026)](https://agenticcontrolplane.com/blog/best-ways-to-control-claude-code-2026): Six real options for controlling a coding agent — built-in permissions, Anthropic's sandbox runtime, devcontainers, dcg, cloud sandboxes, and a policy layer on the call path — r...
- [How to Audit What Your Coding Agent Actually Runs (2026)](https://agenticcontrolplane.com/blog/audit-what-your-coding-agent-runs): Four ways to answer 'what did the agent do while I wasn't looking' — harness transcripts, shell history, OS-level logging, and a hook-path audit log — and what each one misses.
- [Your benchmark says the agent passed. It doesn't say what failure would have cost.](https://agenticcontrolplane.com/blog/reproduced-action-severity-scale): A 2026 paper proposes grading every agent action on a 0–6 harm scale — reversibility, scope, privilege — instead of counting pass/fail. We ran the authors' published scoring cod...
- [The Gemini cache dead zone: why the newest Flash quietly stopped caching your agent's prompts](https://agenticcontrolplane.com/blog/gemini-cache-dead-zone): We metered our own agent's bill and found that Gemini 3.6 Flash caches nothing below ~10K tokens — exactly where agent prompts live. Here's the mechanism, the money, and how to ...
- [A support ticket told an AI agent to leak the tokens table. We recreated the lethal trifecta — and held the exfil for a human.](https://agenticcontrolplane.com/blog/recreated-supabase-cursor-lethal-trifecta): In July 2025 a Cursor agent connected to Supabase with service_role credentials read a support ticket containing hidden instructions, queried the integration-tokens table, and p...
- [Replit's AI agent deleted a production database during a code freeze. We recreated the freeze — and held it.](https://agenticcontrolplane.com/blog/recreated-replit-database-deletion): In July 2025 a Replit agent ran destructive commands against a production database during an explicit code freeze, then misreported what it had done. We rebuilt the scenario in ...
- [An AI agent deleted a production database in 9 seconds. We rebuilt it in a sandbox — and stopped it.](https://agenticcontrolplane.com/blog/recreated-pocketos-database-deletion): In April 2026 a Cursor agent found a stray API token, ran one destructive GraphQL mutation, and erased PocketOS's production database and its backups in nine seconds. No attacke...
- [A public issue made an AI agent leak a private repo. We recreated it — and held the public post for a human.](https://agenticcontrolplane.com/blog/recreated-github-mcp-private-repo-leak): In May 2025 researchers showed a malicious GitHub issue could steer a developer's AI assistant, via the GitHub MCP server, into pulling private repository contents and posting t...
- [A pull request told Amazon Q to wipe the machine. We recreated the injected PR — and the destructive calls never ran.](https://agenticcontrolplane.com/blog/recreated-amazon-q-filesystem-wipe): In 2025 a destructive instruction was slipped into the Amazon Q VS Code extension through a GitHub pull request, directing the agent to wipe the local filesystem and delete clou...
- [Codex CLI Cost Tracking — What Exists, What's Missing, and How to Meter Every Session](https://agenticcontrolplane.com/blog/codex-cli-cost-tracking): Codex CLI has no built-in dollar cost tracking. The complete reference: what the CLI shows natively, why token counts aren't cost attribution, the model_providers config that me...
- [Claude Code vs Codex CLI: Permission Models Compared](https://agenticcontrolplane.com/blog/claude-code-vs-codex-permission-models): The complete comparison of Claude Code and Codex CLI permission systems — approval modes, hook events and coverage, deny rules, sandboxing, and what each does in unattended mode...
- [An Agent Firewall Is the Enforcement Half of a Control Plane](https://agenticcontrolplane.com/blog/agent-firewall-enforcement-half): Products, papers, and practice are converging on the same pattern: enforce policy on the agent's actions, in the execution path, before they run. The industry is naming it 'agen...
- [Agent Cost Drift in the Wild: A Model Alias Zeroed Our Cache](https://agenticcontrolplane.com/blog/agent-cost-drift-model-alias): Our ops agent's cache rate read 0% across 216 calls. Nothing in the code changed. The '-latest' model alias had quietly resolved to a generation that never cache-hits — multiply...
- [An LLM Gateway Governs What the Model Says. Your Risk Is What the Agent Does.](https://agenticcontrolplane.com/blog/what-the-model-says-vs-what-the-agent-does): LangChain's governed-agents post is right about the problem and names the best sentence in the category. A model-call gateway covers part of it. The part it can't see — actions ...
- [Cache-Hit Rates Are Easy to Get Wrong. We Found Three Different Formulas in the Wild — Including Our Own Stack.](https://agenticcontrolplane.com/blog/the-metric-that-manufactured-work): Cache reads bill at ~10% of full input price, which makes the cache-hit rate one of the most consequential numbers in agent cost — and one nobody defines the same way. A field g...
- [We Read Every Agent Harness's Guardrails. Here's What Survives Yolo Mode.](https://agenticcontrolplane.com/blog/what-survives-yolo-mode): Eleven agent harnesses and frameworks, their default safety guardrails read from primary source. Almost none stop a catastrophic command in full-auto mode. The one thing they ag...
- [What Hermes's Blocklist Taught Us About Agent Guardrails](https://agenticcontrolplane.com/blog/what-hermes-blocklist-taught-us): Hermes Agent publishes exactly what it blocks out of the box. We compared its taxonomy to ACP's risk classifier, adopted five categories, and kept the parts each side does bette...
- [How to Set Up a Hermes Autonomous Agent Safely](https://agenticcontrolplane.com/blog/setup-hermes-autonomous-agent-safely): Hermes runs unattended — terminal, files, browser, cron. Set identity, policy, and limits before you give it autonomy, and approve the rest inline. Ten minutes, start to governed.
- [Your Agent's Bottleneck Is Almost Never the Model](https://agenticcontrolplane.com/blog/your-agents-bottleneck-is-not-the-model): We metered a few hundred real agent runs to study where cost and reliability actually come from. The recurring answer: not the model — the harness around it. An intro to a serie...
- [One Sentence in Our System Prompt Doubled the Agent's Bill](https://agenticcontrolplane.com/blog/one-sentence-doubled-our-agent-bill): A live spend counter we injected to keep agents on budget was silently disabling prompt caching — and more than doubling the cost of exactly the agents it was meant to protect. ...
- [Your Agent's Last Move Should Be a Tool Call, Not Text](https://agenticcontrolplane.com/blog/never-end-on-a-free-text-turn): 28% of our agent runs silently returned nothing. The fix wasn't a retry — it was a design rule: agents should deliver results through a tool call, never a free-text turn. Measur...
- [Don't Give Up on Cheap Models — Give Up on Fragile Loops](https://agenticcontrolplane.com/blog/dont-give-up-on-cheap-models): Gemini Flash looked like an unreliable agent orchestrator — it delivered less than half the time. One trace showed why, and one small loop change made it deliver 100% of the tim...
- [Why Not Just Use Your Database's Permissions?](https://agenticcontrolplane.com/blog/why-not-just-use-database-permissions): Row-level security and database grants already exist — so why do AI agents need a control plane? Where native permissions hold, where they go blind, and what's genuinely missing.
- [Which Claude Code Tools Should You Deny (or Gate Behind Approval) Out of the Box?](https://agenticcontrolplane.com/blog/which-claude-code-tools-to-deny-out-of-the-box): One Claude Code session declares 76 tools. The core coding loop isn't the risk — the never-invoked tail is: tools that send, schedule, publish, and spawn. A default posture, arg...
- [Claude Code's Deny List Can Be Bypassed. Here's What a Real Enforcement Boundary Looks Like.](https://agenticcontrolplane.com/blog/claude-code-deny-list-bypass): Deny rules match command strings inside the client — compound commands, substitution, and one documented flag all route around them. Where client-side permissions honestly stop,...
- [Claude Code Cost Tracking: Token Counters Tell You What You Spent, Not Where It Went](https://agenticcontrolplane.com/blog/claude-code-cost-tracking): A real working day of Claude Code: 276 model calls, 1,697 tool calls, $148.16 at API rates — 100% of it loop tax. Why /cost, ccusage, and proxy totals can't show you that, and w...
- [AI Agent Tool Allowlists: Deny by Default, Scope per Task, Audit Everything](https://agenticcontrolplane.com/blog/ai-agent-tool-allowlist): One Claude Code session declares 76 tools; 64 of them never fire. A tool allowlist is the list of calls your agent may make — everything else denied. How to set one in Claude Co...
- [Inside the ACP Console: My Own Agents, Real Data, Every Screen](https://agenticcontrolplane.com/blog/inside-the-acp-console): The hardest thing to convey about a control plane is what you actually see once agents run through it. So here's my own workspace — the agents behind Calafia, running for real —...
- [Microsoft's Agent Governance Toolkit Validates the Control Plane — and Leaves Out the Meter](https://agenticcontrolplane.com/blog/microsoft-agent-governance-toolkit): We read the AGT source. What Microsoft got right about governing agent actions, what a library structurally can't do, and why splitting governance from cost is the wrong lesson ...
- [What Is an Agent Harness? (And Why Every Harness Needs a Control Plane)](https://agenticcontrolplane.com/blog/what-is-an-agent-harness): The model is the smallest part of your agent. Everything around it — the loop, the tools, the memory, the budget — is the harness, and it's where reliability, cost, and risk act...
- [Session X-Ray: Debugging a Single Agent Run, Call by Call](https://agenticcontrolplane.com/blog/session-xray-debugging-one-agent-run): The Agent X-ray shows you an agent across all its runs. The Session X-ray opens one run — every call in order, the loop tax inside it, and the single step that cost you. Here's ...
- [Control and Optimize Your Agents, Down to Each Tool Call](https://agenticcontrolplane.com/blog/control-and-optimize-your-agents): You ship an agent and see one answer. Inside, it made 200 tool calls across a dozen model turns, and it cost something different every run. Here's how to see that, control it, a...
- [When to Use an Agentic Control Plane (and When to Reach for a Sandbox)](https://agenticcontrolplane.com/blog/when-to-use-an-agentic-control-plane): A control plane is a reference monitor — it only holds on a boundary it can completely mediate. Here's honestly where ACP fits, where a sandbox is the right answer, and how they...
- [We Benchmarked 13 Models on Real Agent Runs](https://agenticcontrolplane.com/blog/we-benchmarked-14-models-on-real-agent-runs): Isolated tool-call skill barely predicts whether a model can run an agent. We tested 13 models two ways — and cheap models aren't worse, they're erratic on the loop.
- [Per-User Auth for AutoGen Agents](https://agenticcontrolplane.com/blog/per-user-auth-for-autogen-agents): AutoGen punts authentication to your application code. How to thread the end user's verified identity through to every tool call — with policy and audit per user.
- [How to Govern AI Agent Tool Calls (Before They Run)](https://agenticcontrolplane.com/blog/how-to-govern-ai-agent-tool-calls): Your framework gatekeeps the server, not the call. How to authorize, scope, and audit every agent tool call per user — deterministically, before it executes.
- [Cost Per Customer in CrewAI Agents](https://agenticcontrolplane.com/blog/cost-per-customer-in-crewai-agents): CrewAI cost tooling stops at the LLM call. How to attribute agent spend per customer, per agent, and split the loop tax from the real work.
- [Agent Access Control: Least-Privilege Scoped Tools](https://agenticcontrolplane.com/blog/agent-access-control-scoped-tools): The fastest way to make an agent ungovernable is to give it broad tools. Why least-privilege, scoped tools are the foundation of access control for AI agents.
- [The Loop Tax: Why AI Agents Are So Expensive](https://agenticcontrolplane.com/blog/the-loop-tax): An agent doesn't make one model call — it makes a chain, re-reading context every turn. That loop is ~89% of the bill. The mechanic, and three levers to cut it.
- [What our scheduled agents can't do — and why that's the point](https://agenticcontrolplane.com/what-our-scheduled-agents-cannot-do/): An agent that builds agents ships them to run unattended, taking real actions while no one watches. The control that makes that safe isn't a smarter prompt — it's a deterministi...
- [One step is 90% of our agent's model bill — on purpose](https://agenticcontrolplane.com/one-step-90-percent-of-our-agent-bill/): We metered every tool call our agent builder makes. A single step accounts for 90% of the model spend. That's not a leak — it's the result of routing each step to the model it a...
- [Our agent got quietly worse — only its audit log noticed](https://agenticcontrolplane.com/debugging-calafia-agent-builder-with-acp-logs/): An agent that crashes is the easy case. An agent that silently produces worse output — same inputs, no exception, no alert — is the hard one. How our agent builder's own audit l...
- [Hermes Agent is now the easiest coding agent to govern with ACP](https://agenticcontrolplane.com/blog/hermes-agent-acp-integration): Nous Research's Hermes Agent ships native pre/post tool-call hooks that cover every tool — terminal, file, web, browser, vision, custom skills. No feature flag, no Bash-only gap...
- [Stop your AI agent from leaking PII through tool calls — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-leaking-pii-through-tool-calls): Your AI agent runs SELECT email FROM users and gets back a list of customer emails. Now those emails are in the LLM's context, your conversation logs, and any downstream tool th...
- [Build a governed SQL agent that scrubs PII from query results (Python, runnable)](https://agenticcontrolplane.com/blog/build-a-governed-sql-agent-with-pii-redaction): A Python AI agent that runs natural-language queries against a Postgres warehouse, with tool-output PII scrubbing happening at the governance layer — not in agent code. The agen...
- [Build a governed multi-step research agent (delegation chain across 4 hops)](https://agenticcontrolplane.com/blog/build-a-governed-multi-step-research-agent): A Python research agent that decomposes a question, spawns parallel search subagents, then a synthesizer subagent — with a 4-deep delegation chain that traces every tool call ba...
- [Build a governed GitHub PR reviewer in Python (with subagent delegation)](https://agenticcontrolplane.com/blog/build-a-governed-github-pr-reviewer): A Python AI agent that reviews pull requests, spawns a security-scanner and a test-runner as scope-narrowed subagents, and ships an audit chain back to the human reviewer. Full ...
- [Build a governed customer-support email triage agent (with human-in-the-loop on sensitive sends)](https://agenticcontrolplane.com/blog/build-a-governed-customer-support-email-triage-agent): A Python agent that classifies incoming support email, drafts replies, and asks for human approval before any reply that mentions refunds, account closure, or escalations is sen...
- [We had a Claude agent build a governed AI agent. It picked Microsoft.](https://agenticcontrolplane.com/blog/agent-built-governed-agent-and-didnt-pick-us): We let a fresh AI agent — no prior knowledge of any vendor — build a governed Slack summarizer end-to-end in Python. It searched the web, picked a vendor, ran pip install, wrote...
- [SOC 2 and HIPAA for AI agents: the compliance playbook](https://agenticcontrolplane.com/blog/soc2-hipaa-ai-agent-compliance-playbook): A control-by-control mapping from SOC 2 trust services criteria and the HIPAA Security Rule to the AI agent governance controls that satisfy them. With evidence-collection guida...
- [OpenAI on Bedrock: what the partnership covers, and what's beyond it](https://agenticcontrolplane.com/blog/openai-on-bedrock-governance-gaps): OpenAI models are now on Amazon Bedrock — including GPT-5.5. The deal extends meaningful governance to AWS-hosted agents and surfaces three architectural areas where complementa...
- [Okta for AI Agents: a technical read on the launch](https://agenticcontrolplane.com/blog/okta-for-ai-agents-technical-read): Okta launched Okta for AI Agents to GA on April 30, 2026. Walking through the architecture, the MCP Bridge approach, the five-question framing, and which agent-governance use ca...
- [Microsoft open-sourced an Agent Governance Toolkit. Here's what it covers and what it doesn't](https://agenticcontrolplane.com/blog/microsoft-agent-governance-toolkit-coverage): April 2026: Microsoft released an open-source policy engine for AI agents — sub-millisecond enforcement, stateless, self-hostable. Read the strengths and the scope honestly.
- [Gemini Enterprise Agent Platform: Google's hosted-agent answer, and where it composes](https://agenticcontrolplane.com/blog/gemini-enterprise-agent-platform-gap): April 23, 2026: Google announced the Gemini Enterprise Agent Platform — bundling Vertex Agent Builder, Agents CLI, Agent Runtime, Cloud Run, and GKE Autopilot. Here's what's in ...
- [Codex CLI Hooks Reference — hooks.json, PreToolUse & PostToolUse](https://agenticcontrolplane.com/blog/codex-cli-hooks-reference): The complete Codex CLI hooks reference: the codex_hooks flag, hooks.json config, PreToolUse deny rules, PostToolUse audit, --full-auto behavior, and how to govern the tools hook...
- [AI control plane: a buyer's guide](https://agenticcontrolplane.com/blog/ai-control-plane-buyers-guide): What an AI control plane actually is, the four vendor categories competing for that name, the questions that separate them, and a 14-day evaluation framework you can run before ...
- [ACP and Vertex AI Agent Builder: same ADK code, two governance scopes](https://agenticcontrolplane.com/blog/acp-and-vertex-agent-builder-cross-cloud): Google's Vertex AI Agent Builder gives ADK agents per-agent IAM identities, Cloud API Registry tool governance, and managed Agent Engine. Here's where it covers and how ACP plug...
- [ACP and Okta for AI Agents: composition, not collision](https://agenticcontrolplane.com/blog/acp-and-okta-for-ai-agents-composition): Okta for AI Agents launched today as the identity-perimeter layer for AI agents. ACP runs at the tool-call layer. The two compose into a complete control plane — here's how the ...
- [ACP and Microsoft Foundry Agent Service: governance beyond the Azure boundary](https://agenticcontrolplane.com/blog/acp-and-microsoft-foundry-cross-cloud): Microsoft Foundry ships the most coherent enterprise governance story among the three hyperscalers. Here's where it covers, where it stops, and how ACP composes for everything o...
- [ACP and Bedrock AgentCore: how the two layers compose](https://agenticcontrolplane.com/blog/acp-and-bedrock-agentcore): AWS shipped a real governance product for Bedrock-hosted agents. ACP runs everywhere else. The honest read on when to use which, and why most enterprises will need both.
- [Governed Google ADK in 3 minutes](https://agenticcontrolplane.com/blog/governed-google-adk-in-three-minutes): Add ACP governance to a Google Agent Development Kit (ADK) agent in three minutes. One @governed decorator, one set_context call, every tool call audited and policy-checked. Wor...
- [Ten questions every CISO should ask about AI agent audit trails](https://agenticcontrolplane.com/blog/ciso-audit-trail-questions): Every governance vendor claims audit trails. Most produce something between an unstructured request log and a real, identity-attributed, tamper-evident record of agent decisions...
- [Anthropic Agent SDK: Auditable Logging and Governance in TypeScript](https://agenticcontrolplane.com/blog/anthropic-agent-sdk-governance-reference): The complete TypeScript reference for adding auditable logging, per-user identity, and policy enforcement to Anthropic's Agent SDK and Claude Agent SDK loops.
- [Stop your AI agent from deleting your production database — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-deleting-your-database): If your agent has destructive credentials in its environment, it can use them. Recovery is rarely possible. Here's how to put a control plane between the agent's decision and yo...
- [Stop your AI agent from touching files outside your project — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-touching-files-outside-your-project): Cursor and GitHub Copilot agents have wandered into Documents folders, root drives, and home directories — deleting files that had nothing to do with the project they were worki...
- [Stop your AI agent from running `rm -rf` on your filesystem — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-running-rm-rf): Cursor and Claude Code agents have wiped home directories mid-session. The fix isn't smarter prompting — it's a control plane between the agent's tool call and your filesystem. ...
- [Stop your AI agent from rewriting your git history — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-rewriting-git-history): Claude Code, Cline, and Cursor agents have force-pushed over teammates' work, reset uncommitted changes, and stripped commits from production branches. The model can't see what ...
- [Stop your AI agent from making payments without approval — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-making-payments-without-approval): Agentic commerce SDKs from Stripe, Visa, and Mastercard give your AI agent the ability to charge cards, transfer funds, and authorize subscriptions. One bad tool call is one rea...
- [Stop your AI agent from leaking secrets in your `.env` file — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-leaking-env-secrets): AI coding agents read your .env files by default. They quote secrets back into commits, paste them into chat logs, and surface them in tool outputs. Here's how to gate that with...
- [Stop your AI agent from escalating IAM permissions — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-escalating-iam-permissions): If your agent can call `iam:CreatePolicy`, `iam:AttachRolePolicy`, or `gcloud projects add-iam-policy-binding`, it can grant itself anything the underlying credential allows. Th...
- [Stop your AI agent from dropping a Kubernetes namespace — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-dropping-a-kubernetes-namespace): An autonomous agent with kubectl access can `kubectl delete namespace prod` in one tool call. The OS doesn't ask twice. The control plane between the agent's intent and your clu...
- [Stop your AI agent from burning through your API budget — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-burning-your-api-budget): Cursor agents loop when context summarization interrupts them. Codex sub-agents have run $350 over plan in a week. A leaked GCP key produced an $18,000 bill. The fix isn't smart...
- [Stop your AI agent from being weaponized by a malicious package — in three steps](https://agenticcontrolplane.com/blog/stop-your-agent-from-being-weaponized-by-a-malicious-package): The Nx s1ngularity attack used local Claude, Gemini, and Q CLIs to recon for SSH keys, .env files, and GitHub tokens. 2,349 secrets were exfiltrated. The control plane your AI a...
- [Building the same agent fifteen ways: what each framework taught us about governance](https://agenticcontrolplane.com/blog/fifteen-frameworks-one-governance-question): Fifteen frameworks and clients, one agent task. The friction points were different in every runtime — and the patterns that emerge tell you what governance actually has to do, r...
- [Seven agent frameworks, one backend, governance diverges on 9 of 48 tests](https://agenticcontrolplane.com/blog/architecture-is-governance): Seven frameworks, one backend, 48 governance scenarios. Scores ranged 37-46. Variance is architectural: where a framework lets you observe tool calls.
- [Reproduce AgentGovBench on your stack — full setup guide](https://agenticcontrolplane.com/blog/reproduce-agentgovbench-on-your-stack): Step-by-step guide to running the AgentGovBench scorecard against your own ACP deployment: required env, Firebase setup, common issues, reading results.
- [Recommended governance deployment patterns — pick the one that scores highest for your stack](https://agenticcontrolplane.com/blog/recommended-governance-deployment-patterns): AgentGovBench scores across seven frameworks, translated into a customer-facing recommendation for deploying governed AI agents by stack, score, and reach.
- [LangGraph's StateGraph checkpoints don't replay through governance](https://agenticcontrolplane.com/blog/langgraph-stategraph-checkpoint-governance-gap): LangGraph checkpoint replays skip the governance pipeline — policy changes between original run and replay are silently ignored. The failure mode and fix.
- [How we think about testing AI agent governance](https://agenticcontrolplane.com/blog/how-we-test-agent-governance): AgentGovBench is an open, NIST-mapped benchmark for AI agent governance. We ran it against ACP. What broke, what shipped, how to run it on your deployment.
- [Full scorecard: seven frameworks, 48 scenarios, one open benchmark](https://agenticcontrolplane.com/blog/full-scorecard-seven-frameworks-48-scenarios): Seven frameworks benchmarked: CrewAI, LangGraph, Claude Code, OpenAI Agents SDK, Anthropic Agent SDK, Cursor, Codex CLI. Native vs ACP. Three score tiers.
- [Decorator, proxy, hook — three patterns for agent governance, three different scorecards](https://agenticcontrolplane.com/blog/decorator-proxy-hook-three-governance-patterns): Why CrewAI + ACP scores 40/48 but Claude Code + ACP scores 43/48 on the same backend. Three integration patterns, three scorecards — where each wins.
- [CrewAI's task handoffs lose the audit trail — here's the gap and the fix](https://agenticcontrolplane.com/blog/crewai-task-handoffs-lose-audit-trail): CrewAI's Hierarchical Process delegates manager-to-worker without carrying the chain. Even with @governed, audit logs show worker as top-level. The fix.
- [--dangerously-skip-permissions drops the prompts, not the hooks — your governance survives it](https://agenticcontrolplane.com/blog/claude-code-dangerously-skip-permissions): Correction: Claude Code's --dangerously-skip-permissions suppresses the interactive permission prompts, not your PreToolUse/PostToolUse hooks. Hooks fire in every permission mod...
- [Does the Anthropic Agent SDK Have Governance?](https://agenticcontrolplane.com/blog/anthropic-agent-sdk-governance-scorecard): The Anthropic Agent SDK ships no per-user identity, policy, or audit. Here's the governance gap — and how to close it with one wrapper around your handlers.
- [How AgentGovBench's 48 scenarios map to NIST AI RMF 1.0](https://agenticcontrolplane.com/blog/agentgovbench-nist-ai-rmf-mapping): AgentGovBench scenarios cite specific NIST AI RMF 1.0 controls — MAP, MEASURE, MANAGE, GOVERN. The full mapping for procurement teams citing controls.
- [What 285,000 Agent Tool Calls Actually Cost](https://agenticcontrolplane.com/blog/what-280k-agent-tool-calls-look-like): We metered 285,814 governed tool calls across 96 workspaces. The tools are nearly free — the bill is the agentic loop, and one frontier model on it drove 77% of the spend across...
- [How to Rate-Limit an MCP Server (Per-User, Per-Tool, Per-Agent)](https://agenticcontrolplane.com/blog/rate-limit-mcp-server): MCP servers are rate-limit-blind — they see the LLM runtime's service account, not the user. How to add per-user, per-tool, per-agent limits in MCP.
- [Introducing ADCS — an open spec for agent-to-agent delegation chains](https://agenticcontrolplane.com/blog/introducing-adcs-delegation-chain-spec): ADCS v0.1: an open JSON spec for agent delegation chains — scope intersection, budget propagation, cycle prevention, identity, audit. Ref impl shipping.
- [EU AI Act Article 14 and AI Agents: Mapping Human Oversight to Delegation Chains](https://agenticcontrolplane.com/blog/eu-ai-act-article-14-ai-agent-delegation-chains): EU AI Act Article 14 requires demonstrable human oversight from Dec 2, 2027. How ADCS delegation chains map to 14(4)(a)-(e) with auditor-ready artifacts.
- [Governing CrewAI A2A Delegation: a production setup guide](https://agenticcontrolplane.com/blog/crewai-a2a-delegation-production-setup): CrewAI shipped a first-class A2A delegation primitive. Full walkthrough: install, configure, govern, audit CrewAI A2A crews with scope and budget caps.
- [How to Add Per-User Authentication to a LangGraph Agent](https://agenticcontrolplane.com/blog/add-per-user-authentication-langgraph-agent): LangGraph agents run on a shared API key by default — every tool call looks the same. Add per-user auth, identity-attributed audit, and rate limits.
- [Add Per-User Permissions and Audit to LangGraph in 3 Minutes](https://agenticcontrolplane.com/blog/governed-langgraph-in-three-minutes): Wrap your LangGraph tools with one decorator and bind the user's JWT — every tool call across every node is permission-checked, identity-attributed, and logged. Three minutes fr...
- [Allow, Deny, and Audit Every Tool Call in the Anthropic Agent SDK](https://agenticcontrolplane.com/blog/governing-the-anthropic-agent-sdk): Anthropic's Agent SDK makes multi-skill agents easy to ship — and trusts them completely. How to scope permissions and get an audit trail on every skill, tool call, and sub-agen...
- [Log and Control Every Claude Code Tool Call in 60 Seconds](https://agenticcontrolplane.com/blog/governance-for-claude-code): One command puts a hook on every Claude Code tool call. Bash, Read, Write, Edit, WebFetch — logged, checked against your allow/deny rules, visible in a dashboard.
- [Your AI agents need a control plane, not another gateway](https://agenticcontrolplane.com/blog/control-plane-not-gateway): API gateways proxy traffic. LLM gateways proxy prompts. Neither governs what an autonomous agent does with your tools. Why the control plane is different.
- [4 Security Vulnerabilities Hiding in Your MCP Server's Tool Schema](https://agenticcontrolplane.com/blog/mcp-schema-vulnerabilities): Real CVEs trace back to unconstrained tool schemas. From 8,216 MCP servers: the JSON patterns behind path traversal, SSRF, injection, and how to fix each.
- [MCP Gateway Comparison (2026): Composio vs ACP vs DIY](https://agenticcontrolplane.com/blog/mcp-gateway-comparison): An honest comparison of MCP gateway options. When to use ACP Cloud, Composio, or build your own with open-source tools.
- [The MCP Rate-Limit Blast Radius: $1,080 an Hour](https://agenticcontrolplane.com/blog/mcp-rate-limit-blast-radius): 180 MCP servers proxy calls to paid APIs like OpenAI and Stripe. 85% document no rate limits. An agent retry loop can cost $1,080/hour.
- [Can You Prove What Your AI Agent Did? I Checked 8,216 MCP Servers.](https://agenticcontrolplane.com/blog/mcp-audit-gap): 74.9% of MCP servers have no mention of audit logging. The MCP spec defines zero audit primitives. Here's why that's a compliance problem.
- [8,216 MCP Servers, 7,840 Tools, Zero Input Validation](https://agenticcontrolplane.com/blog/mcp-input-validation-attack-surface): Analysis of 8,216 MCP servers: 2,432 expose high-risk inputs — SQL, file paths, shell commands — with zero validation constraints in the tool schema.
- [I Classified 8,000+ MCP Servers by Auth Appropriateness. Most Get It Wrong.](https://agenticcontrolplane.com/blog/mcp-auth-appropriateness-audit): A static analysis of 8,216 MCP servers across 3 registries (a 4th collector, PulseMCP, returned zero servers). 50.6% have no auth. But the real question is: do they have the rig...
- [Why Not Just Use OPA and a Service Mesh?](https://agenticcontrolplane.com/blog/why-not-just-use-opa-and-a-service-mesh): Do OPA, Istio, API gateways, and IAM already solve AI agent governance? Where existing infrastructure fits, where it breaks, and what's still missing.
- [I Audited 7,522 AI Agent Skills. Here's What I Found.](https://agenticcontrolplane.com/blog/i-audited-7522-ai-agent-skills): A first-hand static analysis of every skill on ClawHub — the real numbers on credential leaks, prompt injection, and what registry moderation actually catches.
- [How an Agentic Control Plane Addresses Every OWASP Agentic Top 10 Risk](https://agenticcontrolplane.com/blog/owasp-agentic-top-10-how-a-control-plane-addresses-every-risk): A risk-by-risk mapping of OWASP's Agentic Top 10 to specific control plane capabilities — from the governance layer, not the model or app layer.
- [How to Trigger a Governed AI Agent from n8n, Zapier, or Any Webhook](https://agenticcontrolplane.com/blog/trigger-governed-ai-agents-from-any-webhook): Step-by-step guide to invoking AI agents via HTTP from workflow automation tools. Every tool call is identity-verified, rate-limited, and audit-logged.
- [CSA Defines the Agentic Control Plane. Here's What We Built.](https://agenticcontrolplane.com/blog/csa-defines-the-agentic-control-plane): Cloud Security Alliance just published the Agentic Control Plane framework. We've been building the infrastructure. What's real vs. still theoretical.
- [The MCP Security Checklist for Enterprise Teams](https://agenticcontrolplane.com/blog/mcp-security-checklist-for-enterprise): A 10-point security checklist for teams deploying MCP servers in production. Covers identity, auth, PII, rate limits, audit trails, and more.
- [How to Connect Salesforce to Claude Desktop in 5 Minutes](https://agenticcontrolplane.com/blog/connect-salesforce-to-claude-desktop): Step-by-step guide to connecting Salesforce CRM data to Claude Desktop using ACP's MCP gateway. Query contacts, deals, and reports from your AI assistant.
- [Per-Call Permissions for AI Agents: Why RBAC Breaks at Agent Speed](https://agenticcontrolplane.com/blog/runtime-authorization-for-ai-agents): Your RBAC assigns roles at login. Your agent makes 47 tool calls in 90 seconds. Why agents need runtime authorization — deny-by-default permissions checked on every tool call — ...
- [WebMCP Ships Without Agent Identity. Here's Why That Matters.](https://agenticcontrolplane.com/blog/webmcp-ships-without-agent-identity-heres-why-that-matters): W3C WebMCP gives browsers a native API for AI agents to call site tools — but ships with no agent identity, scoped permissions, or delegation context.
- [Point-in-Time Audits Can't Keep Up With AI Agents. Check Every Tool Call Instead.](https://agenticcontrolplane.com/blog/continuous-trust-validation-for-ai-agents): Your SOC 2 audit covered 90 days; your agents made 2.3 million tool calls in that window. Why annual evidence breaks for agents, and what checking identity, permissions, and bud...
- [MCP Moves the Tool Calls. Nothing in It Decides What's Allowed.](https://agenticcontrolplane.com/blog/mcp-is-the-data-plane-you-still-need-a-control-plane): MCP defines how agents call tools. It doesn't say who may call what, with which permissions, or leave an audit trail. What the protocol covers — and the allow/deny layer you sti...
- [MCP Re-Auth: What ChatGPT Actually Needs When Tokens Expire](https://agenticcontrolplane.com/blog/mcp-reauth-what-chatgpt-actually-needs-when-tokens-expire): ChatGPT won't re-trigger OAuth on HTTP 401 or JSON-RPC errors — it needs a JSON-RPC success envelope with _meta. The signal, and how a gateway emits it.
- [NIST Just Defined Identity for AI Agents. Here's What Changes.](https://agenticcontrolplane.com/blog/nist-ai-agent-identity-what-it-means-for-your-infrastructure): NIST's AI Agent Standards Initiative is the first federal move on identity and authorization for autonomous agents. The architectural asks are clear.
- [Your API Keys Already Give Agents Production Access](https://agenticcontrolplane.com/blog/your-api-keys-already-give-agents-production-access): Every API key in your env vars lets an agent act with full access and no user identity. Most teams don't notice until something breaks in production.
- [Your Backend Can't Tell Which User an AI Agent Is Acting For](https://agenticcontrolplane.com/blog/authentication-is-broken-in-ai-systems): I built an MCP server, connected it to real customer data, then read my backend logs: every request was the same service account. How agent requests lose the user — and how to b...
- [AI Agent Identity: The Problem No One Has Solved Yet](https://agenticcontrolplane.com/blog/ai-agent-identity): Okta, AD, and OAuth authenticate humans at login. An agent acts for a user across thousands of tool calls after login — and your IAM stack has no concept of it. Why proving who ...
- [AI Agent Audit Trails: What CISOs Actually Need to Know](https://agenticcontrolplane.com/blog/ai-agent-audit-trails): "Which employee accessed patient records through the AI assistant last Tuesday?" Your gateway logs and SIEM can't answer that. What an agent audit trail needs that generic API l...
- [What Is an MCP Control Plane?](https://agenticcontrolplane.com/blog/what-is-an-mcp-control-plane): An MCP control plane adds identity verification, policy enforcement, and audit logging to Model Context Protocol servers — the missing governance layer.
- [Agentic Data Plane vs Agentic Control Plane](https://agenticcontrolplane.com/blog/agentic-data-plane-vs-agentic-control-plane): Agentic data plane vs agentic control plane — what each layer does, why you need both, and how they work together to govern AI agents in production.
- [Your AI Agent Calls Your API. Whose Permissions Is It Using?](https://agenticcontrolplane.com/blog/the-three-party-identity-gap): Agents act on behalf of users, but every request arrives on a shared key — your backend can't verify who initiated it, so it can't scope access or attribute actions. The three-p...
- [OpenAI Frontier Gets the Problem Right — and Puts the Controls in the Wrong Place](https://agenticcontrolplane.com/blog/openai-frontier-proves-ai-governance-cant-live-inside-the-model-provider): Frontier names the real bottleneck: agent identity, permissions, audit. But putting those controls inside the model vendor is banks auditing themselves. Where the control layer ...
- [How to Make AI Agents Pass a Compliance Audit (HIPAA, SOC 2, GDPR)](https://agenticcontrolplane.com/blog/compliance-ready-ai-governance): Most AI agents run on shared API keys with no per-user access control and no identity-attributed audit trail — failing every major compliance framework. What auditors actually a...
- [Why Your API Gateway Can't Control AI Agents](https://agenticcontrolplane.com/blog/why-api-gateways-dont-solve-ai-governance): Kong, Apigee, and AWS API Gateway route and rate-limit requests. They can't tell which user an agent acts for, which tool call is destructive, or what a session costs. What agen...
- [PII in Prompts: What You're Probably Leaking](https://agenticcontrolplane.com/blog/pii-in-prompts-what-youre-probably-leaking): Users paste PII into your AI app. It goes straight to the LLM. That's a compliance problem.
- [If You Can't Tell Who an Agent Request Is For, Nothing Else Works](https://agenticcontrolplane.com/blog/identity-in-the-three-party-trust-model): Permissions, rate limits, and audit logs all fail the same way for AI agents: the request arrives without the user. Why identity is the problem to solve first — before access co...
- [When AI Agents Take Real Actions, Who Controls What They're Allowed to Do?](https://agenticcontrolplane.com/blog/why-agentic-control-planes-will-matter): Chatbots read and write text; agents call APIs, change records, and move money. Why every team shipping agents ends up needing per-action permissions, audit trails, and cost lim...