Cortex SkillsThe companies that win with agents will not be the ones with the most pilots. They will be the ones that make the governed path the fastest path.
AI agents are moving into the enterprise faster than most companies can decide who is responsible for them.
That is the real story behind the latest wave of agent governance products and frameworks. Microsoft says it now has visibility into more than 500,000 agents inside its own organization. BCG argues that platform-by-platform governance is producing duplicated work, rising security risk, and exploding costs. And a new warning from the enterprise security market is increasingly hard to ignore: identity and permissions tell you what an agent can reach, but not whether it should take a particular action at a particular moment.
The industry is starting to call the answer an enterprise AI control plane.
The name sounds abstract. The operating problem is not. A control plane is the layer that answers five practical questions before an agent acts:
- Who owns this agent?
- What workflow is it approved to run?
- What data and tools can it use for this step?
- What requires a person to approve or review?
- How do we stop, reverse, or retire it?
If a company cannot answer those questions quickly, it does not have an agent strategy. It has a growing collection of software with access.
What changed
The first generation of enterprise AI governance was built around tools and users. Security teams reviewed applications. Identity teams assigned permissions. Business teams approved use cases. Employees were expected to follow policy.
Agents break the comfortable assumptions underneath that model.
An agent does not merely open a file when asked. It can search broadly, chain tools together, interpret what it finds, and act at machine speed. A human may technically have access to a folder and never look inside it. An agent can inspect every reachable document in pursuit of a task, then move information somewhere else because a prompt, file, or downstream instruction told it to do so.
That is why “the agent had permission” is becoming an inadequate incident report.
Recent enterprise guidance is shifting the control question from access to execution. The important distinction is no longer only whether an agent may read a finance folder. It is whether it may copy thousands of payroll files, write them to a broadly shared destination, or trigger an irreversible action during this specific workflow step. [VentureBeat’s August 31 analysis](https://venturebeat.com/security/identity-and-permissions-arent-enough-to-govern-ai-agent-behavior) captures the shift from standing access toward bounded, contextual action.
Microsoft’s own Agent 365 implementation points in the same direction from the operations side. The company describes a shared registry for agents across platforms, ownership and lifecycle metadata, risk signals, and coordinated responsibilities across AI administration, identity, security, compliance, and governance. It is not treating agents as isolated experiments owned by whichever platform created them. [Microsoft’s account of its Customer Zero deployment](https://www.microsoft.com/insidetrack/blog/implementing-agent-365-how-were-governing-and-managing-ai-agents/) is effectively a blueprint for turning an agent population into an operable estate.
BCG’s framing is even more direct: an enterprise control plane should unify identity, policy enforcement, visibility, and governance without forcing every team through a bespoke review process. The recommended “golden path” is a pre-governed starting point where registration, monitoring, and policy enforcement already exist. [BCG’s control-plane analysis](https://www.bcg.com/publications/2026/how-cios-govern-ai-agents-at-scale) makes the business case: governance should accelerate deployment by removing uncertainty, not merely slow deployment by adding approvals.
Why it matters
The obvious risk is security. The less obvious risk is operational sprawl.
When every team builds its own agent, permission model, logging convention, approval process, and cost controls, the company eventually pays for the same governance problem dozens of times. No one has a complete inventory. Owners change jobs. A prototype becomes production by accident. A useful workflow is copied into a new department with its old permissions attached. A finance team discovers the token bill after the workflow has already become business-critical.
The result is a bad choice between two extremes:
1. Let teams move quickly and accept invisible risk. 2. Centralize every decision and turn the security team into a queue.
Neither scales.
The control plane is valuable because it changes the unit of governance. The unit is not “AI” or “the model.” It is the workflow execution.
A low-risk agent that summarizes an internal meeting can run with broad autonomy if its inputs are trusted, its output is reversible, and its activity is logged. An agent that changes a customer record, moves regulated data, approves spending, or deletes files needs a narrower capability set and a clearer review boundary. The same model can be safe in one workflow and unacceptable in another.
That is an operating-model decision, not a model-quality decision.
My take: the control plane should be a product team, not a dashboard
Most companies will initially buy or build a dashboard. They will count agents, display risk scores, and congratulate themselves on visibility.
Visibility is necessary. It is not control.
A real control plane must own the boring connective tissue that makes an agent reliable in production:
- a registry with a named business owner and technical owner;
- an explicit workflow purpose and allowed consequence;
- permissions that narrow or expand by task step rather than remain permanently broad;
- policy checks at tool-call time, not just in a launch document;
- approval tiers for autonomous, monitored, and irreversible actions;
- logs that show the inputs, decisions, tool calls, outputs, and human interventions;
- rollback and retirement rules that someone can execute under pressure.
That list is not a compliance appendix. It is the product.
The best control plane will also make the sanctioned route faster than the unsanctioned route. Builders should be able to start from approved workflow templates, inherit the correct identity and logging, test against known boundary cases, and request only the capabilities their task needs. If the safe path requires six meetings and a 30-page form while the unsafe path takes an afternoon, employees will route around governance. This is not a moral failure. It is predictable system design.
The control plane therefore needs a service-level promise: a small, low-risk workflow can move quickly; a high-consequence workflow gets more scrutiny; every workflow has a visible owner and a reversible next step.
A practical starting point for operators
Do not begin by inventorying every possible AI use case. Begin with the agents already touching consequential systems.
For each one, create a one-page operating record:
1. Workflow: What specific job is the agent performing? 2. Owner: Which person is accountable for its outcome? 3. Inputs: What data may it read, and what data is untrusted? 4. Actions: Which tools may it call at each step? 5. Boundaries: What must make it stop or escalate? 6. Evidence: What will a reviewer be able to reconstruct later? 7. Release level: Is it autonomous, monitored, or human-approved? 8. Rollback: How is the last action reversed or contained?
Then test one normal case and one boundary case. If the team cannot explain what the agent did, why it was allowed to do it, and who can stop it, the workflow is not ready for more volume.
This also gives leadership a better adoption metric. Stop asking only how many agents exist or how many employees used them. Ask how many workflows have earned a documented release decision, how many exceptions were resolved, and how long it takes to revoke or narrow an agent’s authority.
Those numbers describe an operating capability. Prompt counts do not.
The bottom line
AI agents are not creating a new version of the old software stack. They are turning the company’s permissions, workflows, data boundaries, and decision rights into a live operating system.
The winning companies will not simply deploy more agents. They will make it easy to deploy the right agent, with the right authority, for the right step, under the right owner—and easy to stop when the evidence changes.
That is the control plane.
Treat it as infrastructure, governance, and product design at the same time. If it is only a dashboard, the agents will still be running the company. The dashboard will just be watching.