AI agent control plane

A control plane sits beside the data plane: your agents keep talking to their model providers, and the control plane decides who they are, what they may spend, which tool calls they may make, who reviews the risky ones, and what record survives afterwards.

What it has to do

An agent that can call tools is a production system with a credential and a budget. The moment more than one person runs one, the questions get concrete and all of them are about control rather than capability: which agent made this call, whose provider account paid for it, is it over its limit, was this tool call allowed, who approved the destructive one, and can anyone reconstruct the sequence a week later.

A control plane answers those questions in the request path. Not in a dashboard after the invoice arrives, and not in a spreadsheet of keys — in the path, so the answer can change the outcome.

Identity: every request is bound to an agent, not to a shared key pasted on a laptop.
Budget: a spend or token limit that rejects the next request rather than reporting the overage later.
Tool policy: a decision on the tool call the model proposes, before the runtime receives it.
Approval: a named human decides the calls policy holds, and the decision is single-use.
Audit: a record that can be verified, not a log line that can be edited.

How Descles implements it

Descles splits the two. The data plane is the Descles edge, an open-source gateway you run in your network: it authenticates each request against an agent-bound key, checks the budget, applies tool policy, holds calls for approval, records what happened, and forwards to the provider you configured with the key only it holds. Streaming is preserved — a held or denied tool call is rewritten inside the SSE stream, not buffered until the end.

For teams, the control plane runs in your network too: identities, delegation and policy, signed into a time-limited bundle the edge pulls. Nothing is hosted by Descles, and the edge reports nothing to it.

# Keep your SDK. Point it at your edge, with an agent key.
export OPENAI_BASE_URL=https://descles.internal/v1
export OPENAI_API_KEY=<agent-key>

The part most tools leave out

Enforcement in a gateway stops intent, not execution. Descles can strip a denied tool call from the model response or park it for approval, and the runtime never sees it. Whether a tool then runs is a property of the runtime you chose — so the honest design is to say where that line is and let you put a sandbox or an action gateway behind it for a hard boundary.

That is why the tool inventory tells you the status of every tool your runtime actually declares, and why a deny on a shell command string is labelled a speed bump rather than a wall.

Descles stops tool intent before the agent receives it. Runtime-reported tool results are execution evidence, not independent proof that a local action succeeded.

Questions

Do I have to replace my agent or SDK?

No. Any OpenAI-compatible or Anthropic client works, because the change is the base URL and the key. There is no SDK to adopt, and the gateway is one edge your organization runs, not a sidecar per agent.

Is the control plane in the request path?

The data plane is: the edge in your network evaluates budgets and tool policy on each call, so an over-budget request is rejected rather than charted. The control plane is not; it signs identities and policy into a bundle the edge enforces, and an edge that cannot reach it stops when that bundle expires.

Where does the control plane sit relative to my provider bill?

Between the two but not in the money. Your provider bills you directly for tokens and Descles adds no markup; what you pay Descles is for the control plane itself.

LLM gateway — One endpoint for every agent, one key per agent, and a decision on every request: authenticated, attributed, budgeted, recorded, then forwarded to your provider with a key only the gateway holds.
Agent approvals — Autonomy is fine until the tool call is `kubectl delete pod checkout-api` in production. Approval puts one named person in that gap, and only for the calls that need it.
Agent audit records — When someone asks why an agent did that, a log line in a bucket is not an answer. A record that names the actor, the decision, the approver and the outcome, in a chain that fails verification if it is edited, is.
Documentation — endpoints, provider keys, and the full policy reference.

Try it: run the open-source edge, or apply as a design partner. Questions: outreach@descles.com. See also terms and privacy.