The Control Plane Is the Org Chart

Two years of agent frameworks have solved the wrong problem well. MCP, A2A, the tool-invocation schemas — they answer how agents talk to each other. None of them answer who decides which agent does the work, on what basis, under what constraint. That question doesn’t sound like infrastructure. It is the only infrastructure that matters.

It gets skipped because of a category error sitting in plain sight: the frameworks treat agents as deterministic components. Set the parameters, deploy, verify. But an agent given the same prompt twice won’t hand you the same quality twice — it varies with context length, prior state, decoding dynamics, the domain you’ve pushed it into. The thing being allocated isn’t compute. It’s cognitive capacity, and cognitive capacity is variable, domain-dependent, and drifts. You don’t manage a probabilistic resource with a config file. You manage it the way you manage people: measurement, calibration, governance, recovery. You give it a control plane.

Here’s the part the deck-builders skip. The failure modes of a multi-agent system aren’t new. They’re the failure modes of every organization that ever lost the plot — standards nobody audits, governance that’s mandatory on paper and optional in practice, confidence uncorrelated with competence, a briefing so complete no one can find the signal in it. The literature on how these systems fail is old and enormous. We call it organizational design. The control plane is that literature, compiled to software.

But before we get to architecture, I need to own my own failure mode. I’ve described this framework more than one way across a year of writing, and if you’ve read more than one description you’ve seen they don’t line up. A control plane that can’t state its own structure precisely has no standing to govern anyone else’s. So we start where the discipline demands — with the vocabulary — and we don’t build until it holds.

First, the vocabulary

The word “layer” has been doing three jobs, and the letter “L” two. Untangled, they stop competing — they were never answers to the same question.

There are three axes here, not three rival models.

Position answers where the control plane sits. This is a stack — six layers, and the control plane is one of them. Infrastructure at the bottom: model endpoints, tool servers, runtimes. Transport above it: MCP, A2A, the invocation protocols. Then the identity index, where agents and tools are registered. Then the control plane itself. Then orchestration above that, which sequences the work. Then the consumers at the top, where tasks enter. It’s the same shape as every managed-infrastructure diagram you’ve ever read — the same idea one tier up.

Function answers what the control plane does. Reduce it to verbs and there are four: it identifies, it allocates, it governs, it recovers. An earlier note in this series named four controls off a security incident — identity, authority, gating, recovery. The full control plane keeps identity and recovery, folds authority and gating into a single verb, govern, and adds the duty a security incident never needed: allocate. Four duties, discharged by six concrete components — task classifier, calibration loop, intelligent router, context assembler, governance engine, provenance tracker. The duties and the components aren’t two competing schemes. They’re one axis at two resolutions: the four are the obligations, the six are the machinery that carries them.

Maturity answers how far a given deployment has gone. This is a ladder, L0 through L5, and it’s the only place the letter L belongs. The echo is deliberate: the automotive world numbers autonomy L0 to L5, from hands-on-the-wheel to no wheel at all, and the parallel is instructive right up until the top rung, where it breaks.

That’s the whole reconciliation, and it costs nothing but discipline: layers get names, controls get verbs, only levels get L-numbers. Wherever an earlier draft numbered the controls L1 through L4, or numbered the stack L0 through L5, those numbers come off. The ladder keeps them. Everything else is spoken by name. A framework about governing probabilistic systems can’t afford ambiguity in its own terms.

Held in one frame:

Duty	Machinery	The failure it prevents
Identify	identity index, task classifier, calibration loop	capability blindness; stale, self-declared identity
Allocate	intelligent router, context assembler	misrouting; context collapse
Govern	governance engine, provenance tracker	ungoverned action; false provenance
Recover	no component of its own — the above, acting together under failure	thrashing; runaway unattended action

Recovery has no box, and that’s not an omission. It’s the property that falls out when the other components act together under failure — the same way resilience in an organization isn’t a department.

Where it sits: the missing layer

Most agent architectures follow a simple stack. A request flows to an orchestrator, which delegates to an agent runtime, which invokes tools. MCP lives at the boundary between agents and tools. A2A operates between agents. And nowhere in that picture is anything responsible for allocating cognitive work. Routing is made by convention. Tool selection is made by the model, from an unfiltered manifest. Governance is enforced nowhere. There’s a hole in the middle of the stack exactly where the decisions live.

You wouldn’t know it from the marketing, where the hole is already spoken for. “Control plane for AI agents” is suddenly on every vendor’s slides — the observability companies, the identity companies, the guardrail companies, the hyperscalers. But look at what each one means by it. One means telemetry: what the agents did. One means identity: who they are. One means policy: what they may not do. Every one of those watches, records, routes by rule, or forbids — and what none of them does is earn. They take an agent’s declared capability at its word and schedule against it; not one distrusts the résumé and calibrates it against what the agent actually delivered. So the hole didn’t get filled. It got wallpapered. The part everyone now calls the control plane is the part that inspects and gates; the part that decides who’s genuinely good at the work — and knows because it watched, not because it was told — is still missing under the branding. That part is the cognitive control plane.

The name is inherited, not invented, which is why everyone reached for it. Networking has drawn the line between control plane and data plane for decades: the data plane moves packets, the control plane decides where they go. Kubernetes drew it again for compute: the runtime executes containers, the control plane schedules them, admits them, and watches them. In both cases the decision layer is a distinct thing, above the transport, and in both cases the system didn’t become manageable until that layer existed. Agent systems are at the same inflection point, and the mapping is direct. The router is the scheduler. The governance engine is the admission controller. The calibration loop is the metrics server, feeding observation back into scheduling. The identity index is the registry. Kubernetes didn’t win because containers needed a nicer API. It won because container ecosystems needed governance, scheduling, and resource management at a layer above the runtime. This is the same move, applied to cognition instead of compute.

But the Kubernetes analogy breaks in exactly one place, and that break is the point. Kubernetes can schedule on declared specifications because containers don’t lie: a pod that requests two cores and four gigabytes needs two cores and four gigabytes, and the scheduler treats that as ground truth. Agents lie. Not by intent — by drift. Declared capability and delivered capability diverge, and the gap is invisible at scheduling time. So five of the six components have a clean Kubernetes analogue and one doesn’t: the calibration loop, which exists precisely because there’s no cognitive equivalent of a truthful resource request. Kubernetes’ metrics server measures a load that’s already real. The calibration loop has to manufacture the ground truth by observation, because the resource being scheduled misrepresents itself by default. That’s the move Kubernetes never had to make — and it’s the exact point where scheduling cognition stops being scheduling compute.

We need to make sure we’re clear on a delineation of roles, or the whole design fails. The control plane doesn’t decompose tasks or sequence workflows. That stays at the orchestration layer above it. A planner decides what steps to run and in what order. The control plane decides who runs each step, with what context, under what constraint. Orchestration decomposes; the control plane allocates. Collapse the two and you’ve rebuilt the monolithic bottleneck the architecture exists to prevent — the software equivalent of the leader who can’t delegate, the single point every decision waits on.

The objection that says don’t build it

There’s a serious version of the counterargument. The bitter lesson of the last decade is that general methods beat clever architecture, and its adherents will tell you this entire layer is scaffolding. Give it eighteen months and a single model — strong enough at everything, cheap enough to run on anything, with a context window large enough to hold every tool at once — and routing, calibration, and context assembly all dissolve. Why build a scheduler for cognitive work if one worker does all of it well?

Let’s unpack that. If one model wins everything, the router does degenerate, but it doesn’t disintegrate. It degrades to a cost-and-difficulty tier-selector, because heterogeneity was never only about capability. It’s about economics. You won’t spend frontier-model inference on a task a cheap call handles, so “which tier, at what cost, for this difficulty” remains a routing decision no matter how few distinct models exist. That’s the router surviving in reduced form, not disappearing.

The other three duties don’t even flinch. Governance doesn’t care how many models you have: a single perfect model still has to be gated over which tools it may touch, under which authority, in which jurisdiction, because the danger lives in the tools and the data, not in the model count. Context assembly doesn’t care: context collapse is a property of saturated windows, and windows saturate regardless of how capable the model behind them is, so curation survives the bitter lesson intact. And calibration is the least model-count-dependent of all, because one model is still non-deterministic and still drifts across domains — observed-versus-declared is exactly as necessary for one model as for fifty.

So the honest accounting: if the maximalists are right, you lose part of one duty and keep three whole. The control plane isn’t a bet that you’ll have many models. It’s a bet that you’ll have heterogeneous cost, heterogeneous and dangerous tools, non-free context, and non-deterministic actors — and every one of those survives model consolidation. Even if one model does swallow everything, the control plane still stands — and scaffolding doesn’t survive its own worst case. Structure does.

Identify: earning the score

Traditional services advertise capability through an API. Two services with the same signature do the same thing. Agents break that assumption. Two can expose an identical interface and behave nothing alike — different reasoning depth, different latency under load, different cost, different behavior under ambiguity. To delegate rationally, the system has to treat agents as measurable resources rather than interchangeable endpoints, which means each publishes a structured identity card: model family, reasoning profile, cost, trust domain, and for tools, the things that actually matter under pressure — how dangerous the tool is, whether it demands a human in the loop, what jurisdiction its data must stay inside.

But a card an agent writes about itself is a résumé, and résumés lie — not always by intent, sometimes just by drift. A tool that declares a quality of 0.85 may deliver 0.62 in the field. An agent that calls itself a reasoning specialist may fold under ambiguity. So the control plane runs a calibration loop beneath the card. Declared capability is recorded at registration. Observed capability is tracked on every execution — actual quality, actual latency, actual failure rate. The effective score is a decaying blend of the two, and it feeds back into allocation: underperformers are quietly downgraded, overperformers promoted. Over time the system develops something close to institutional knowledge about its own workforce — which agents deliver under which conditions, which fail in which domains — built from observation rather than assertion. Identity stops being claimed and starts being earned. This is the difference between a talent review that reflects last year and one that reflects last week — and, like a talent review, it’s only as good as the honesty of the observations feeding it.

Allocate: agents, and the attention they get

Allocation is two scarce resources, not one. The obvious one is the agent: who does the work. The one everybody forgets is attention: what the chosen agent is allowed to see. The control plane rations both, and the second turns out to matter more than the first.

Start with the agent. Once agents are measurable, routing becomes real scheduling rather than a chain of if-statements. The router queries the index with a classified task and ranks candidates across dimensions that actually trade against each other — calibrated quality weighted by difficulty, predicted latency, cost, trust alignment, specialization. The scoring strategy is configurable per workflow, because a latency-critical path and a research pipeline want different things: one wants a deterministic weighted score, the other wants to explore. None of this is new; it’s borrowed, deliberately, from optimization and online learning, because the contribution here isn’t a new algorithm but the layer that lets you plug the right known algorithm into the right path.

Now attention, which is where the silent damage lives. Every MCP connection dumps a full tool manifest into the context window whether or not those tools are relevant. Fifty tools can burn eight thousand tokens a turn just announcing themselves. That’s the visible cost, and it’s the smaller one. The real injury is context collapse — the quiet degradation of a model’s reasoning as its window saturates with irrelevance. It doesn’t crash. It doesn’t refuse. It just gets worse: looser tool selection, more hallucinated parameters, weaker chains of reasoning. The outputs still look like outputs. They’re simply, undetectably, degraded — which is exactly why most systems never catch it. It’s the silent performance tax that compounds with every tool added and every schema injected — the precise machine analogue of the executive briefed on everything and able to prioritize nothing.

So the control plane treats tool selection as a retrieval problem and rations attention the way it rations agents. Identity cards are embedded in a semantic index; when a task arrives, the context assembler retrieves only the relevant tools, gated by policy, and injects them in tiers — a fifteen-token summary first, the full schema only after the tool clears governance, execution detail only on demand. Fifty tools at two hundred tokens each becomes three relevant tools plus one selected schema. The token reduction is real and large. But the reduction isn’t the point. The model shown three relevant tools reasons better than the model shown fifty, even when both have context to spare. The saving and the quality gain are the same intervention. This isn’t compression. It’s the difference between a leader with a clear desk and one buried in everything anyone ever sent. Turns out allocating attention well is the larger half of allocating cognition at all.

Govern: the mandatory path

Agent systems inevitably span data environments. Some agents reach internal systems, some hit external APIs, some touch regulated information, and without structural governance every agent can potentially reach every tool — which means a single prompt injection can escalate potential into breach. The answer is a governance engine that sits on every routing decision as the primary path, not as middleware beside it. Every tool call and every delegation flows through it. Governance that’s optional isn’t governance. It’s a suggestion, and systems, like organizations, learn quickly which suggestions can be ignored.

So the checks run inline, before the model ever sees the tool. Trust-domain validation, so a general research agent can’t invoke a restricted production tool. Jurisdiction, so regulated data routed to the wrong region reroutes or halts. Budget, so cost is enforced rather than discovered. And a human-in-the-loop trigger on anything marked dangerous — the agent can’t approve its own irreversible action, for the same reason no organization lets a single person authorize their own wire transfer. That last one isn’t an analogy of convenience; it’s the same control, separation of duties, the four-eyes principle that predates software by centuries, enforced in a new medium. Every check the governance engine runs has a named ancestor in the audit and compliance literature, which is what “compiled to software” actually means: not a metaphor, an implementation. The provenance tracker is the audit trail underneath all of it — recording who was authorized to do what, so that in a regulated environment the system can prove not just that the right agent did the work but that it was allowed to.

The structural benefit falls out for free: a prompt injection that talks an agent into reaching for a dangerous tool fails at the gate, because the gate is enforced outside the agent’s reasoning. Fool the agent all you want. The dangerous call still has to clear a gate the agent never touches.

But be precise about what that buys, because it’s the easiest thing here to oversell — and the place a hostile reader should press hardest. Structural enforcement removes one failure mode and installs a smaller one in its place. What it removes is unbounded: you can no longer reach a dangerous action by persuading the agent, because the agent’s reasoning isn’t what the gate consults. What remains is bounded but real: the gate only fires on what it has been told to check. A tool nobody labeled dangerous, a jurisdiction the session metadata failed to carry, a restricted action the classifier didn’t recognize as restricted — these pass clean, with the gate working exactly as designed, because the wall is solid but the sensor in front of it is fallible. And here’s the trap inside the trap: if that sensor is itself a model — an LLM asked to classify intent or tool risk — then you haven’t removed the probabilistic component from the gate, you’ve moved it. The same prompt injection that couldn’t talk the agent past the wall may talk the classifier into mislabeling the call as safe, and the wall never fires because it was never told to. Structural enforcement is only as structural as its trigger. The wall can be deterministic. The sensor must be pushed toward rules and away from inference wherever the stakes justify it, because every probabilistic inch in the sensor is an inch of the injection surface you thought you’d sealed. Governance moves the failure surface from “can the agent be talked into it,” which is unbounded and unauditable, to “is the check correctly specified and the call correctly classified,” which is bounded, inspectable, and improvable. That’s a real gain. It isn’t the same as safety, and the discipline is refusing to let the strength of the wall stand in for the reliability of the sensor.

Recover: what happens when it goes wrong

Recovery has no component of its own. It falls out of the other three under failure — and that it has to be assembled rather than boxed is the sign the taxonomy is real, not just tidy.

The characteristic failure of a multi-agent system is thrashing — the cognitive version of thread thrashing. Tasks enter delegation loops, bouncing between agents that each decide the work belongs to someone else. Or allocation oscillates, picking one agent on this run and another on the next because their scores sit inside the noise, producing behavior downstream systems can’t depend on. Neither has a dedicated fixer. Calibration damps the first by converging scores until the gap between candidates is either clearly real or clearly negligible — and when it’s negligible, the discipline is a stable arbitrary choice rather than a fresh coin-flip every turn. Provenance damps the second: if an agent’s already touched a task and passed it along, the trace records that, and the governance engine can refuse the circular re-delegation. Recovery here isn’t a mechanism. It’s calibration and provenance and governance doing their jobs at the moment the system would otherwise spin — the same way an organization breaks circular escalation not with a de-escalation office but by remembering who already owns the thing.

The harder recovery case is the human gate. When a dangerous action trips the human-in-the-loop trigger, execution has to suspend — and suspension is its own engineering problem, because the work doesn’t politely pause. Downstream orchestrators are waiting, timeouts are ticking, state has to be held without being lost. A control plane that halts for human judgment but lets the halted work time out or thrash the systems waiting on it hasn’t recovered; it has failed more slowly. So the gate has to freeze state cleanly, escalate asynchronously, and resume without restarting the whole chain from scratch — the difference between a system that asks a person for a decision and one that falls over while waiting for the answer. This is the least glamorous duty in the control plane and the one that decides whether the other three survive contact with an actual human on an actual schedule.

The same problem, one tier up

Set the failure modes side by side. The resemblance is a design constraint.

Ambiguous standards: agents claiming capability they can’t deliver, and performance reviews no one audits. Optional governance: policy checks as bypassable middleware, and compliance that lives on paper and nowhere else. False confidence: a high-certainty score on an uncalibrated output, and a clean deck about a messy situation. Context overload: full manifests in every prompt, and a leader briefed on everything. Centralized bottleneck: a control plane that insists on making every decision, and the manager who can’t let go. Stale identity: capabilities indexed once and never revisited, and a talent map that reflects who people were a year ago.

These are the same failures in two media, and the correspondence is mechanical, not poetic. Separation of duties is separation of duties whether the actor is a vice president or an agent. A moving average of observed performance is the same statistical object whether it scores a supplier or a model. The protocols that hold an organization together and the protocols that hold an agentic system together are the same protocols at different scales. Clear direction. Enforced standards. A shaped environment where the right work is easy and the dangerous work is gated. The control plane is the organizational design problem, solved in software.

The stability stack

One principle sits underneath all of it, and it’s the reason the architecture stabilizes some things hard and lets others move freely.

A multi-agent system operates in irreducible uncertainty. You can’t predict what a probabilistic agent will produce, and no amount of better modeling collapses that to zero — the variability is a property of the terrain, not a defect to be engineered away. The instinct is to fight it: pin the agents down, make them deterministic, reduce the uncertainty until coherence feels safe. That instinct is the failure. It’s premature convergence — forcing resolution on a problem that’s structurally unresolvable — and in a domain where conditions shift faster than plans can be updated, it isn’t caution. It is fragility wearing the costume of rigor.

The alternative is to stabilize at the layers that can actually bear it, and let the rest flex. Intent — what a workflow is trying to shape — is the most stable thing in the system and rarely changes. Values — the lines that won’t be crossed — are stable, and the governance engine is where they are enforced. Constraints — the boundaries that are structurally real — are acknowledged and held, not wished away; this is the layer an earlier note in this series was entirely about, because constraints live in the substrate whether or not the diagram admits them. Direction — where cognitive resources are committed — is the allocator’s job, committed but adaptable. And the next action, the specific invocation, is immediate and never permanent. The control plane holds intent, values, and constraints. Everything below flexes.

Most systems reduce uncertainty to preserve coherence. This one preserves coherence without reducing the uncertainty — it holds direction without pretending to hold the outcome. That’s the coherent-irreducibility discipline the rest of this series runs on: coherence you can hold, irreducibility you can’t wish away. You don’t need complete information to have clear direction. You need to know which layers deserve to be stable, and the discipline to leave the others alone. Don’t stabilize what can’t be stabilized. Stabilize what actually can.

The ladder

The maturity ladder is better than a marketing gradient: each rung is a statement about how many of the duties are actually discharged.

L0 is ad hoc — no control plane, static routing, hardcoded chains, the state most systems are in right now. L1 is identified: an identity index exists, and agents and tools are described resources instead of opaque endpoints. L2 is assembled: attention is rationed, context is curated rather than dumped, and the silent tax is paid down. L3 is governed: the governance engine is the mandatory path, with trust domains, jurisdiction, budget, and human-in-the-loop enforced inline — the rung that matters the moment you’re in a regulated environment, where the question is not only whether the right agent did the work but whether the system can prove it was authorized to. L4 is calibrated: the loop is running, identity is earned, allocation adapts to observed performance. L5 is unattended: the full set, running without continuous human attention.

The duties don’t switch on cleanly, one per rung. Allocate arrives in two installments — attention-curation at L2, agent-routing at L4 — because the ladder tracks when the machinery appears, not when a whole duty does. A duty can straddle rungs. That’s not a crack in the taxonomy; it’s the taxonomy being honest: capability arrives in the order the components come online, not in the order the verbs are listed.

You adopt this the way you’d adopt any infrastructure that matters — progressively, not in a big bang. The first two rungs deliver value in days on existing vector-database infrastructure and require no governance at all. Governance is the enterprise inflection point. Calibration is what you add when the pool is large enough that allocation quality has measurable consequences. Each rung stands on its own and builds on the one below without a rearchitecture. Nobody has to arrive at the top to get paid.

And this is where the automotive echo breaks, deliberately. SAE L5 is defined by an absence: no driver, no wheel, nobody accountable in the seat. The control plane’s L5 is defined by a presence. Unattended is a claim about attention, not about accountability. The seat never empties — not at L5, not at any rung. This isn’t a moral flourish; it’s an architectural requirement, enforced the way this series has argued accountability must be: the accountable signatory is a required field, not an optional one — a person the provenance trace resolves to, established before the run rather than reconstructed after it. A system can run without a human watching it in the moment and still have a human who answers for it, and the entire architecture only earns the word “governed” if that binding holds when no one is looking. Unattended is not unaccountable. If the ladder ever lets those two words blur, it’s failed at the one thing it was built to protect.

Toward infrastructure for cognitive systems

Distributed computing has run this pattern before. Early systems obsess over communication protocols. Later ones add schedulers and orchestration. Eventually those mature into full control planes governing infrastructure nobody could run by hand. Agent systems are early in the same arc, and the destination isn’t in doubt — protocols alone have never managed large networks of anything, and cognitive actors aren’t the exception.

The architecture is clear. The engineering isn’t finished, and hiding that would be the same move this whole essay accuses everyone else of. So, precisely: this is an argument about shape, not a benchmark. I’m saying the control plane is the right place to put these decisions — not that any given implementation’s numbers beat what you already run. Those are the implementation’s to earn; this essay sits upstream of them. What’s still open is real. Whether the benefits hold at production scale with large, heterogeneous pools. Whether identity should be self-declared, measured, or externally certified. Whether calibration converges or oscillates under real load — the identity duty rests on that, and it rests in turn on enough honest observations per agent per domain to mean anything, which the sparse early pool doesn’t have. Whether governance overhead stays a fraction of the savings as complexity grows. These are engineering questions, not conceptual ones — unanswered, and naming them is the price of claiming the rest is solid.

What isn’t open is the shape. The infrastructure being built for multi-agent systems has a hole in it exactly where the decisions live — a hole the branding has papered over without filling — and the hole has the shape of a thing we’ve built twice before: once for packets, once for containers. The third time is for cognition, and it’s harder than either, because the resource being scheduled is the first one that misrepresents itself. Protocols connect agents. Control planes decide what they do. And the discipline that makes a control plane trustworthy is the same discipline that makes an organization trustworthy: name what you depend on, enforce what you won’t cross, and keep a person in the seat even when no one is watching it.