Last week I watched a platform team deploy their first production agent to handle document summarization across 50+ departments. Three months later, it was disabled.
Not because the agent was inaccurate—the summaries were solid. Not because it was too expensive—cost was in line. The agent was disabled because the team couldn't answer a straightforward question from their security officer: "Exactly which agent instance processed the finance department's confidential filings, when did it run, what data did it access, and can you prove no one modified the agent's behavior between approval and execution?"
The team had built a capable agent. They had no way to operate it safely at scale.
This is the operational maturity gap, and it's why 79% of enterprises have adopted agents while only 31% actually run them reliably in production.
The Production Agent Reality
Here's what separates teams that operate agents sustainably from teams whose projects stall:
Stalled teams:
- Deploy an agent without per-agent identity and invocation logging
- Use the same LLM API key across 5 different agents
- Have no way to change tool permissions without redeploying code
- Cannot trace which specific agent instance performed which action
- Run observability post-mortems instead of real-time visibility
- Hit compliance questions they can't answer and disable the agent
Operating teams:
- Each agent has its own identity and credential scoping
- Every invocation is logged: agent ID, timestamp, tool called, input, result, cost, latency
- Tool permissions are declarative and enforceable at the invocation layer
- Policy changes propagate instantly without code redeploy
- Session state is queryable: what did this agent do, when, and why
- Audit trails satisfy security and compliance reviews immediately
The difference isn't in framework choice or model capability. It's in infrastructure.
The Missing Layer
Most teams jump from frameworks (LangGraph, CrewAI, Claude native) directly to deployment. Frameworks excel at agent logic—multi-step reasoning, tool calling, memory management.
Frameworks do not provide:
- Per-agent identity and credential scoping
- Invocation-level access control (tool allowlisting enforcement)
- Durable session observability across pod restarts
- Cost attribution per step and per agent
- Policy enforcement at runtime without code changes
- Audit trails that satisfy compliance requirements
These aren't nice-to-haves. When pilots move toward production, most teams aren't ready to answer what the agent can do without approval, who is liable for a wrong decision, or what happens when it fails.
The gap is operational infrastructure—a control plane that sits between your applications and your agent runtimes, managing agent lifecycle, session state, invocation logging, and policy enforcement.
What Control Plane Infrastructure Solves
A purpose-built agent control plane handles:
Identity and Credential Scoping: Each agent gets an identity, not a shared API key. Credentials are vaulted and scoped to specific destinations. One agent cannot impersonate another. If an agent is compromised, you revoke only that agent's permissions, not everyone's.
Invocation-Level Access Control: Tool permissions are declarative—a YAML file or UI form that says "agent X can call tool Y with these constraints." When an agent tries to invoke a tool, the control plane checks permissions before calling. No permission = call blocked, logged, alerted. No agent can learn to work around guardrails because there is no guardrail to learn around.
Durable Session Observability: Every turn is logged: input, model response, tool calls, tool results, tokens, cost, latency. Sessions persist across pod restarts. If your control plane crashes, agent sessions resume where they left off. You can query "show me every turn agent X executed between 2pm and 3pm last Tuesday" without digging through logs on five different systems.
Cost Attribution Per Step: You know exactly how much each agent spent, per session, per step. Budgets are enforced at invocation time, not after the fact. An agent that hits its daily budget gets blocked from further tool calls.
Policy Enforcement Without Redeployment: Change tool permissions, add agent constraints, update runbooks—all declaratively, all instantly. No code redeploy required.
Audit Trails That Answer Compliance Questions: When your security officer asks "what did this agent do, when, and was it authorized," the answer comes from queryable, immutable logs. Not from reconstructing inference traces.
Why This Matters Now
57% of organizations already deploy multi-step agent workflows, 16% have progressed to cross-functional AI agents spanning multiple teams, and 81% plan to expand into more complex agent use cases in 2026.
Scale drives visibility and control requirements upward. One agent in one sandbox is simple. Ten agents across three runtimes (Claude Managed Agents, Bedrock, Cursor, custom harnesses) with cross-team access is operationally complex.
Additionally, the compliance deadline for high-risk AI systems is August 2026 with respect to EU AI Act. Such agentic systems are classified as high-risk if they perform biometric identification, influence access to education, employment, credit, insurance or essential services, or operate in safety-critical environments. For most enterprise deployments in HR, finance, and healthcare, compliance is not optional.
Evaluation Framework for Control Planes
When evaluating whether your agent infrastructure is ready for production, ask:
Per-agent identity: Can each agent have its own credentials, or do they all share one key? If shared, one compromised agent compromises all.
Invocation-layer access control: Are tool permissions enforced by the infrastructure before the tool is called, or are they prompts that agents can learn to bypass?
Session durability across infrastructure changes: If your control plane pod is replaced during a deployment, does the agent session survive? If an agent is mid-workflow and the underlying Kubernetes node goes down, can it resume from the last checkpoint?
Queryable audit trail: Can you answer "what exactly did this agent do between 2pm and 3pm?" without reconstructing inference traces or checking five provider consoles?
Policy enforcement without code redeploy: Can you change tool permissions, update budgets, or modify agent constraints instantly, without redeploying code?
Cost visibility per step: Do you know how much each agent spent per session, per tool call, per step? Or only the aggregate bill?
If you answer "no" to any of these, your agent infrastructure is not production-ready. You're operating on hope, not guarantees.
The Pattern Winning Teams Follow
Production teams converge on a simple architecture:
- Agent Runtime (any platform: Claude Managed Agents, Bedrock, Cursor, etc.) handles agent logic and reasoning
- Control Plane (self-hosted) manages agent identity, session state, tool permissions, invocation logging, cost tracking, and policy enforcement
- Fast Data Plane (optimized for throughput and latency) handles credential swapping, tool routing, and provider translation
The agent runtime can be anything—the control plane abstracts the differences. Different teams can use different runtimes; the control plane provides one place to manage, observe, and govern them all.
This separation of concerns is not new. Distributed systems have been doing it for decades. The novelty is that agent deployments have become complex enough that the separation became necessary.
What This Means for Your Team
If you're moving agents from pilot to production, you have three paths:
Build it yourself: Implement per-agent identity, session durability, audit logging, policy enforcement. Timeline: 3-6 months of engineering. Risk: high, because you'll learn these requirements the hard way.
Use a framework with governance bolted on: Layers an access-control library on top of LangGraph or CrewAI. Usually insufficient for multi-runtime teams and high-compliance environments.
Use a purpose-built control plane: Designed for exactly this problem. Faster to production, lower operational risk, auditable from day one.
The path you choose determines whether your agent projects scale reliably or quietly become unmanageable liabilities.
Teams that close the gap between pilot and production—that build governance infrastructure alongside capability—are the ones operating agents reliably in 2026. Everyone else is debating whether agents are "ready" while those teams are already extracting value.
Your framework choice matters. Your infrastructure choice matters more.
Top comments (0)