Nobody adopts a control plane in the abstract. You adopt it because an agent can refund the wrong 200 customers, delete the wrong table, or email the wrong person's data — and your hand-rolled checks won't hold when you're not watching. Here's the failure mode by failure mode version.
An agent misreads a policy and starts refunding customers — each one valid on its own, catastrophic in aggregate. Flat daily caps don't help; the agent cheerfully spends them to zero. ACP gates money tools on the outliers: unusual size asks a human, the Nth call in an hour trips, everything routine keeps flowing.
Stop your agent from making payments without approval →
rm -rf, DROP TABLE, repo.delete — the calls you can't undo. Prompt rules are advisory; the model ignores them under pressure or a poisoned tool response. ACP enforces policy on destructive operations at the call itself, outside the model, scoped by agent and by who it's acting for — audit-only until you configure deny-by-default for those tools.
An agent acting for user A pulls something only user B should ever see — because the backend saw a valid service token, not a person. ACP binds every call to the identity of the user the agent is acting for, scopes access to what they can touch, and redacts PII before it reaches the model.
The three-party identity gap →A loop that retries, re-plans, and re-reads until the invoice arrives. ACP meters every tool and model call, shows you which step is actually burning the money (it's usually one), and enforces hard budgets that warn the agent before cutting it off mid-task.
The loop tax: why agents are expensive →A poisoned web page or tool response instructs your agent to do something it shouldn't — and anything that lives in the prompt can be talked past. ACP's enforcement sits outside the model: whatever the agent was convinced of, the call still hits deterministic policy on the way through.
What's actually inside 7,522 agent skills →
The question you can't answer when your logs say service_account: 200. ACP logs the decision, not just the action: who asked, which agent acted, which rule allowed it, what it touched, what it cost — per call, exportable.
The failure modes above don't care what business you're in — only the data changes. A few concrete shapes:
Diagnostic assistants query patient records with the physician's identity verified on every call, access scoped by license type, PII redacted before the model, every query logged — the audit trail HIPAA asks for.
Credit queries scoped to each officer's assigned borrowers, SSNs masked before the model, per-officer rate limits on data pulls, identity on every row.
Every tool call arrives with the customer's verified identity, tenant isolation enforced at the gateway, per-customer budgets that catch abuse — ship the AI integration without building the control layer first.
SSO identity through every request, tool access scoped by role, per-user spend limits, every action attributed — the answer to “what did the copilot just do, and as whom?”
Self-host with the MIT-licensed modules, or use ACP Cloud — one install, and your next agent run shows up governed in the console.