The Agent Framework Should Not Become the Control Plane

The agent framework should not become the control plane.

A pattern is emerging: teams select an agent framework and, quite naturally, begin asking it to carry everything around the agent as well — workflow control, approvals, identity, policy, auditability, production operations.

That instinct is understandable. Modern frameworks can support structured tools, validation, durable execution and human intervention. The issue is not whether such capabilities belong in a framework; they do. It is whether controls embedded in one agent implementation are enough to govern authority consistently across teams, tools, business systems and future framework choices.

This becomes essential when an agent stops assisting and starts acting. Consider an agent preparing a grid-connection work order. The framework manages the reasoning flow: it retrieves capacity data, applies rules and assembles the request. Once the agent can create the order, the relevant question is no longer merely whether the workflow completed, but whether this agent should be permitted to take that action in that situation, using that evidence.

The organisation needs to know whether the data was current, whether authority was limited to this task, which policy applied and how the action can be reconstructed afterwards. Those requirements should still hold if another team changes the model, the workflow or the framework.

Traditional access control tells us whether an identity may access a system. Agentic systems require a more specific decision: may this agent take this action, for this task, using this evidence, under this policy, at this point in time? That is delegated authority.

It is why I am increasingly focused on the Agent Gateway layer — not as a replacement for the framework, nor as a claim that a gateway can infer business intent. Its role is narrower: a shared enforcement point for agent calls that traverse it, where identity and task-scoped permissions can be checked, policy decisions invoked, and the evidence needed to explain an action correlated.

The strategic question is not which agent framework an organisation mandates. It is whether changing frameworks means rebuilding the controls that make agentic systems trustworthy.