AI agent control plane

A control plane sits beside the data plane: your agents keep talking to their model providers, and the control plane decides who they are, what they may spend, which tool calls they may make, who reviews the risky ones, and what record survives afterwards.

What it has to do

An agent that can call tools is a production system with a credential and a budget. The moment more than one person runs one, the questions get concrete and all of them are about control rather than capability: which agent made this call, whose provider account paid for it, is it over its limit, was this tool call allowed, who approved the destructive one, and can anyone reconstruct the sequence a week later.

A control plane answers those questions in the request path. Not in a dashboard after the invoice arrives, and not in a spreadsheet of keys — in the path, so the answer can change the outcome.

Identity: every request is bound to an agent, not to a shared key pasted on a laptop.
Budget: a spend or token limit that rejects the next request rather than reporting the overage later.
Tool policy: a decision on the tool call the model proposes, before the runtime receives it.
Approval: a named human decides the calls policy holds, and the decision is single-use.
Audit: a record that can be verified, not a log line that can be edited.

How Descles implements it

You change one thing: the base URL your agent already points at. Descles authenticates the request against an agent-bound key, attributes it, checks the budget, inspects the model response for structured tool calls, applies policy, records a trace, and forwards to the provider endpoint you configured. Streaming is preserved — a held or denied tool call is rewritten inside the SSE stream, not buffered until the end.

Provider credentials are yours in both modes: store them once encrypted at rest (AES-GCM) so agents only ever hold a scoped Descles key, or send them per request so nothing is stored at all.

# Keep your SDK. Change the endpoint and the key.
export OPENAI_BASE_URL=https://deepseek.gw.descles.com/v1
export OPENAI_API_KEY=<agent-descles-key>

The part most tools leave out

Enforcement in a gateway stops intent, not execution. Descles can strip a denied tool call from the model response or park it for approval, and the runtime never sees it. Whether a tool then runs is a property of the runtime you chose — so the honest design is to say where that line is and let you put a sandbox or an action gateway behind it for a hard boundary.

That is why the tool inventory tells you the status of every tool your runtime actually declares, and why a deny on a shell command string is labelled a speed bump rather than a wall.

Descles stops tool intent before the agent receives it. Runtime-reported tool results are execution evidence, not independent proof that a local action succeeded.

Questions

Do I have to replace my agent or SDK?

No. Any OpenAI-compatible or Anthropic client works, because the change is the base URL and the key. There is no SDK to adopt and no sidecar to run.

Is the control plane in the request path?

Yes for the hosted model gateway: budgets and tool policy are evaluated on each call, so an over-budget request is rejected rather than charted, and a denied tool call is removed before the runtime sees it.

Where does the control plane sit relative to my provider bill?

Between the two but not in the money. Your provider bills you directly for tokens and Descles adds no markup; what you pay Descles is for the control plane itself.

LLM gateway — One endpoint per provider, one key per agent, and a decision on every request: authenticated, attributed, budgeted, traced, then forwarded.
Agent approvals — Autonomy is fine until the tool call is `kubectl delete pod checkout-api` in production. Approval puts one named person in that gap, and only for the calls that need it.
Agent audit records — When someone asks why an agent did that, a log line in a bucket is not an answer. A record that names the actor, the decision, the approver and the outcome, in a chain that fails verification if it is edited, is.
Documentation — endpoints, provider keys, and the full policy reference.

Try it on one agent: 1,000 governed requests free, no card. Request packs add 25,000 more to the same workspace. Questions: outreach@descles.com. See also terms and privacy.