Networking solved the chaos of untrusted packets with a split: a data plane that forwards traffic fast, and a control plane that decides what is allowed to exist. Agent platforms need the same surgery — and the teams that make it are the ones whose autonomy features survive their security review.
The data plane is the agent doing work: reading files, calling tools, invoking models, producing artifacts. It should be fast, disposable, and assume nothing about policy — every request it makes is evaluated against rules it did not write. The control plane is everything that governs: which tools exist, which paths an agent may write, what budgets apply, which actions need approval, what gets logged where. Policy lives only there — versioned, tested, auditable — and reaches the data plane as enforcement points, not as paragraphs in a system prompt.
The split pays immediately. Prompt-injection resilience becomes structural: a malicious payload that tricks the agent into "requesting" a dangerous action hits the control plane's evaluation, where the payload does not exist and the policy cannot be flattered. Audits become tractable: reviewers read one policy repository instead of reverse-engineering scattered prompt clauses. And iteration accelerates — you can change governance without touching agent code, the way you reconfigure an ingress without recompiling the service behind it.
What Belongs Where
- Control plane: tool registries, permission grants, budget limits, approval workflows, logging sinks, model routing tables — anything that must be true for every run.
- Data plane: the run loop, prompts, retrieval, scratch work — anything disposable.
- Never in the data plane: "please don't touch production" written in a prompt. Requests are not policy. Prompts are requests.
The failure the split prevents has a name in every postmortem collection: the agent that worked flawlessly in the demo and deleted something real in staging, because the constraint lived in the same context as the instruction to be helpful. Policy must be a different material than persuasion. That is the whole pattern.