Agent Control Plane: The Governance Layer Most Enterprise AI Stacks Skipped

On September 2, 2026, Boomi announced an Agent Control Plane: an AI-native control point that sits between any AI agent, model, or app - whether built on Boomi, third-party, or open-source frameworks - and the transactional systems that run the business (Boomi press release, September 2, 2026). The reason it matters is not the feature list. It is a number the same press release quotes: Gartner predicts that by 2027, 40 percent of enterprises will demote or decommission autonomous AI agents because of governance gaps identified only after production incidents occur. This article sells nothing. It takes that skipped governance layer apart and gives you something you can assemble this week.

The control plane sits between agents and systems of record

1. What Actually Shipped

Boomi's Agent Control Plane is deliberately vendor- and model-neutral: an agent built on Boomi, on a third-party platform, or on an open-source framework all pass through the same control point before touching systems of record. The enforcement layer is the Boomi AI Gateway, built on technology from Boomi's acquisition of Lunar.dev, which combines MCP gateway and LLM gateway functions in one control point. It deploys across public cloud, a customer's own VPC, or fully on-premises, and supports bring-your-own-models plus specialised small language models. Boomi lists six operating scenarios: governing agent sprawl, governed connectivity through more than 1,000 pre-built MCP servers and tools, running agents behind your own firewall, grounding answers in business definitions and end-to-end lineage, turning natural-language intent into multi-system workflows, and opening the platform to builders through APIs and agent skills.

# agents/refunds-agent.yaml - give every agent its own identity
agent: refunds-agent
owner: finance-platform
identity:
  type: workload                    # NOT a shared "agent-api-key" secret
  service_account: sa-refunds-agent
  scopes:                           # least privilege, per tool
    - read:orders
    - read:invoices
    - write:refunds:create
  denied:
    - write:refunds:approve
    - read:payments:card_data
  data_boundary: eu-central-1        # sovereignty + residency
budget:
  tokens_per_day: 2_000_000
  usd_per_day: 75
  on_exceed: halt_and_page_owner

One identity per agent, not a shared key

2. The Governance Gap, Quantified

The gap has two halves. The first is governance: Gartner predicts 40 percent of enterprises will demote or decommission autonomous agents by 2027 because governance gaps appear only after production incidents, and adds that applying uniform governance to all agents, regardless of autonomy level and scope, can itself cause enterprise AI agent failure (both quoted in Boomi's press release). The second half is access. Agents need deep access to Salesforce, SAP, Oracle, and Workday to deliver real value, and granting that access without dedicated policy enforcement and strict boundary controls exposes core intellectual property to public models. A control plane exists so that deep access and hard boundaries can both be true at once.

# policy.py - one file that answers "may this agent do this?"
RISK = {("write", "refunds:create"): "medium",
        ("write", "refunds:approve"): "high",
        ("read",  "payments:card_data"): "blocked"}

def decide(action, tool, agent, amount_usd=0):
    key = (action, tool)
    level = RISK.get(key, "blocked")
    if level == "blocked":
        return {"decision": "deny", "reason": f"{tool} is out of scope"}
    if level == "high" or amount_usd > 5000:
        return {"decision": "hold", "reason": "human_approval_required"}
    return {"decision": "allow", "reason": "within_policy"}

# The same function is called by the gateway, the CLI, and CI.
# One decision path means one audit trail, not three partial ones.

Bill by decision, not by token

3. Trust Is the Real Bottleneck

The Agentic AI Readiness Gap, a Forrester Consulting thought leadership paper commissioned by Boomi in July 2026, produced the most uncomfortable pair of numbers in this story: 86 percent of leaders said their organisations had moved beyond AI agent pilots, but only 34 percent said they trust the actions their agentic systems take. Organisations that deployed agents before they were ready reported an average of 2.1 million dollars in added cost. Read the order carefully. The blocker is not capability. It is that agents are running and nobody trusts them, which is exactly why demos pass and production approvals stall.

# gateway.py - per-agent rate limits and hard financial caps
from collections import defaultdict
SPEND = defaultdict(float)

def guard(agent, est_usd, est_tokens, budget):
    if SPEND[agent] + est_usd > budget["usd_per_day"]:
        raise BudgetExceeded(f"{agent}: daily cap hit")
    if est_tokens > budget["tokens_per_day"]:
        raise BudgetExceeded(f"{agent}: token ceiling hit")
    SPEND[agent] += est_usd
    return {"agent": agent, "spend_today": round(SPEND[agent], 2)}

# Caps are boring and they are the whole ballgame: an agent that cannot
# exceed its budget cannot produce a surprise invoice on the 28th.

4. Cost Is Now a Governance Problem

The FinOps Foundation's State of FinOps 2026 survey covered 1,192 practitioners representing more than 83 billion dollars in annual cloud spend. Ninety-eight percent said they now manage AI spend, up from 63 percent in 2025 and 31 percent in 2024, making AI cost management the most in-demand skill in the discipline (FinOps Foundation, February 19, 2026). Boomi's answer is unglamorous: per-agent rate limits and financial caps, real-time tracking of usage, performance, and token consumption across active agents, and flagging agents that burn excess tokens without producing results so budget can be reallocated before unmonitored calls become a financial surprise.

# approval.py - hold high-risk actions for a human, not for a retry loop
def execute(action, gateway):
    d = gateway.decide(action)
    if d["decision"] == "deny":
        return {"status": "rejected", "reason": d["reason"]}
    if d["decision"] == "hold":
        ticket = open_approval(action, evidence=action["payload_digest"])
        return {"status": "pending_approval", "ticket": ticket}
    return gateway.run(action)          # allow: inside policy, inside budget

# High-risk means: money moves, records are destroyed, or access changes.
# Everything else can run unattended.

5. A Control Plane You Can Build This Week

You do not need to buy a platform to start. The five code blocks below are the skeleton of a minimum viable control plane: give every agent its own workload identity with least-privilege scopes (code 1); collapse the question may-this-agent-do-this into a single policy function that the gateway, the CLI, and CI all call (code 2); enforce rate limits and hard financial ceilings at the gateway (code 3); hold high-risk actions for a human instead of a retry loop (code 4); and emit one reconstructable audit event shape (code 5). Together they are under a hundred lines, and they decide whether you can answer questions on the day something goes wrong.

{
  "event": "agent.action",
  "ts": "2026-09-16T04:12:07Z",
  "agent_id": "refunds-agent",
  "identity": "sa-refunds-agent",
  "requested": {"action": "write", "tool": "refunds:create"},
  "decision": "allow",
  "policy_version": "2026-09-14.3",
  "model": "frontier-coding-1",
  "tokens": {"input": 18422, "output": 612, "cached": 16000},
  "cost_usd": 0.0413,
  "data_touched": ["orders/8812", "invoices/2291"],
  "artifact_digest": "sha256:9f2c...c71a",
  "reconstructable": true
}

// If you cannot answer "who approved this, on what data, at what cost"
// six months later, you do not have an audit trail. You have logs.

6. Three Questions for Your Next Agent Review

Omdia chief analyst Michael Barnes framed the shift bluntly when commenting on the launch: the governance conversation has moved from model risk to execution risk. Enterprises are no longer primarily worried about what an agent says. They worry about what it does to a general ledger or a customer record, what that action cost, and whether anyone can reconstruct the decision six months later in an audit. So ask three questions in the review. What identity does this agent use, and where is its permission boundary written down? Which actions require a human signature, and in which system is that signature stored? Six months from now, can I reconstruct one decision and its cost from audit data alone? An agent that cannot answer all three has not earned write access.