Governing AI agents: the AI Control Plane

The question is no longer whether to let an AI agent automate an architecture or operations task — that's already happening, in most organizations, often without governance being fully aware of it. The open question is: who decides what an agent is allowed to do without human validation, and how does that decision stay traceable? That's the AI Control Plane's role in TEAF — and honestly, still an incomplete piece of work.

What the AI Control Plane covers today

The current baseline rests on principles already solid for a first-level framework: identity/authentication/authorization separation for every agent, secrets kept out of code, action provenance logged, human-in-the-loop on critical changes, and systematic rollback capability. The TEAF Light repository mechanically locks some of these principles in — not a statement of intent, but controls that apply by default.

The boundary between assisted and autonomous execution

The AI Control Plane's central role is keeping explicit the boundary between what an agent can execute alone and what requires human validation before it applies. That boundary isn't fixed: it depends on the criticality of the capability involved, the trust level established with the agent over time, and the regulatory context. What matters, structurally, is that this boundary is an explicit, documented decision — not an accidental consequence of what the tooling happens to allow technically.

What still needs building

A genuinely industrial AI-native architecture requires going beyond this baseline: continuous evaluation of the models used, resistance to prompt injection and data poisoning, model supply chain security (where models come from, how they're updated), agent-to-agent trust when multiple AI systems interact, model drift detection over time, inference cost control, agent-specific red teaming capability, and incident response procedures adapted accordingly — a compromised agent doesn't behave like a compromised server. TEAF has the framework to accommodate these dimensions — the loop, the roles, the AI Control Plane itself — but not yet the depth of a complete AI security framework.

Why say it rather than let it be assumed

A framework claiming to already cover everything in AI security would, on this particular subject, be actively misleading: the field moves too fast for a first-level baseline to remain sufficient for long. The open roadmap — deepening prompt injection, data poisoning, model drift and agent-to-agent trust across upcoming versions — isn't a weakness to downplay, it's the honest description of work in progress rather than a solved problem.

• The AI Control Plane today covers agent identity, secrets separation, provenance, human-in-the-loop and rollback.
• Its central role: keeping explicit the boundary between what an agent executes alone and what requires human validation.
• Prompt injection, data poisoning, model supply chain, agent-to-agent trust remain work still to deepen.
• TEAF has the framework to accommodate full AI governance, not yet all the depth — and says so explicitly rather than leaving it to be assumed.