Agentic Control Plane Solutions

Ask a large enterprise how many AI agents it is running and you will not get an accurate answer. You will get a number that is confidently wrong and almost certainly too low.

The count is wrong because agents did not arrive through a procurement process. They arrived embedded in SaaS products the company already licensed, as copilots switched on by a vendor update, as departmental builds nobody registered, as experiments that quietly went into production. Forrester's phrasing of the resulting problem is the cleanest summary of why this category exists: buyers cannot govern agents they cannot see.

An agentic control plane is the layer that makes them visible and then keeps them inside a boundary. It is the newest category in Forrester's agentic AI coverage and, at the time of writing, one of the least settled.

What the term is borrowed from

Control plane is not an AI concept. It comes from networking and distributed systems, and the borrowing is deliberate rather than decorative.

In a network, the data plane moves the packets and the control plane decides how packets should move. In Kubernetes, the control plane decides what runs where, how workloads communicate, and what resources they can reach, while the workloads themselves just run. In a service mesh, the control plane enforces traffic policy, authentication, and observability across services that know nothing about each other.

The defining property in every case is separation. The thing that decides the rules is not the thing that does the work. That separation is what lets you change policy without redeploying everything, and what lets you keep control when a workload starts behaving badly.

Apply that to agents and the category almost defines itself. The agents execute. The control plane inventories them, issues them identity, decides what each is permitted to do, watches what they actually do, and intervenes when the answer to those two questions stops matching.

Forrester's three planes

Forrester frames the whole agentic technology market as three functional planes rather than a stack, on the basis that vendors routinely span them and blur the boundaries, but that buyers need to treat them as distinct problems to design a coherent architecture.

The build plane answers how you create, deploy, and scale agentic systems. This is where AI platforms sit, providing model access, agent frameworks, tool integration, vector stores, and evaluation pipelines.

The orchestration plane answers how agentic and non-agentic components fit inside real business processes. Forrester calls this adaptive process orchestration, and it covers modelling processes, defining routing and decision logic, composing integrations, and moving tasks and data through a controlled and observable sequence.

The oversight plane is the third and newest. It answers a question that only becomes unavoidable once the first two have succeeded: how do you apply one consistent envelope of visibility, governance, and management across an agent estate that came from many vendors, runs on many runtimes, and serves many domains.

That progression is worth reading as a maturity model. An organisation with three agents does not need a control plane. An organisation with three hundred agents from eleven vendors has no realistic alternative.

Why governance has to sit outside the runtime

The strongest argument in this category is architectural rather than commercial, and Forrester makes it directly. Governance must sit outside both the build and orchestration planes in order to provide independent visibility, enforce consistent policy, and retain control when runtime environments behave unpredictably.

The phrase doing the work there is out-of-band. If the mechanism that is supposed to stop an agent lives inside the same system as the agent, then whatever causes the agent to misbehave may also compromise the mechanism. Oversight has to live outside the execution loop so that monitoring, enforcement, and intervention remain available precisely when the runtime is the thing that has failed.

This is not a novel principle and Forrester cites precedents from outside AI to make the point. Airbnb's experimentation platform uses independent guardrails that halt experiments automatically when metrics drift past acceptable thresholds, and those guardrails operate outside the service being tested. JPMorgan runs model risk governance that validates and monitors models independently of the product teams that build them. Singapore's FEAT principles, covering fairness, ethics, accountability, and transparency, require AI systems in regulated financial contexts to be subject to independent oversight, audit trails, and accountable human decision-making.

In each case the separation is not bureaucratic overhead. It is the thing that makes the assurance meaningful. A vendor telling you its agent platform governs itself is making the same claim as a trading desk telling you it audits itself.

There is a practical corollary that follows from this and that buyers should hold onto during vendor conversations. Every agent runtime vendor will offer governance features, and those features will be genuinely useful for agents running on that runtime. They cannot, by construction, provide the independent oversight the category is defined by, because they are inside the thing being overseen.

What these platforms actually do

Forrester describes an agent control plane as an enterprise platform that inventories, governs, orchestrates, and assures heterogeneous agents across vendors and domains. Five capability areas define it.

Agent inventory and identity, maintaining a single accurate catalogue of every agent along with a clear view of what each is permitted to do. This sounds administrative and is foundational, for reasons covered below.

Policies and guardrails, centralising business, risk, and technical policy and applying it consistently at runtime rather than as documentation.

Monitoring and insights, giving continuous visibility into agent behaviour, performance, and outcomes across processes and platforms.

Control and coordination, giving operations, risk, and engineering teams the means to manage how agents work together through shared protocols and playbooks across environments.

Risk, compliance, and auditing, recording decisions, interventions, and policy changes in an auditable form, and translating high-level risk frameworks into concrete controls on actual agent activity.

Note the ordering pressure between monitoring and enforcement. Monitoring tells you what happened after it happened. For autonomous software operating at machine speed, after the fact notification is reporting rather than governance. The platforms that matter evaluate actions against policy before they execute and block what violates it, which is a materially harder engineering problem and the main axis on which these products differ.

Inside The Agentic Control Plane Solutions Landscape, Q2 2026

The category was announced by principal analyst Leslie Joseph in December 2025, with research questionnaires going out in April 2026 and The Agentic Control Plane Solutions Landscape, Q2 2026 following in the second quarter, identifying thirty three vendors.

Forrester's definition in that report describes a common enterprise governance and control platform sitting above and across a heterogeneous estate of agents and agentic skills, applying a consistent envelope of oversight so the whole agent portfolio can be managed the same way regardless of platform, vendor, or use case.

Two things about the report structure matter for anyone citing it. First, a Landscape maps a market and does not score it, so there are no Leaders and no rankings, and any vendor implying otherwise is misrepresenting the document. Second, thirty three vendors in a category this young is a signal of enthusiasm rather than consolidation, and a large proportion of those names will not be independent in three years.

Publicly confirmable inclusions are thin so far, since the report is recent. Airia announced its inclusion in July 2026, with a profile covering cross-runtime agent management, compliance and regulatory audit, and change risk management. Fiddler AI also lists inclusion, alongside placement in Forrester's responsible AI landscape, which illustrates how much overlap exists between this category and AI observability.

Expect the confirmed list to grow quickly as vendors work through their analyst relations cycles.

Discovery is the whole problem

Forrester puts discovery and inventory at the foundation of any governance strategy, and this is the part most organisations underestimate.

The reason is that agent sprawl does not look like software sprawl. Traditional shadow IT involved someone buying a tool with a corporate card, which leaves a financial trace. Agent sprawl frequently involves no purchase at all. A SaaS vendor ships an agentic feature in a routine release and it is now running against your data. A team wires up a workflow inside a platform you already own. Someone builds something over a weekend that turns out to be useful and becomes load-bearing without ever being reviewed.

None of these generate a procurement record, an architecture review, or a line item. They generate behaviour.

Which means discovery in this category has to work from the outside in, inferring the agent estate from network traffic, API calls, identity provider logs, and SaaS configuration rather than from a registry someone maintained. The vendors that do this well are solving a problem closer to attack surface management than to traditional software asset management.

A useful diagnostic before you evaluate anything: ask three different teams how many agents the organisation runs and compare the answers. The spread between them is the size of the problem you are buying to solve.

What you are actually governing

There is a definitional trap here that Forrester's own analysts have named.

Leslie Joseph and colleagues coined the term agentish for the dominant pattern vendors have been selling as agentic: largely deterministic, flowchart-driven processes with language model components embedded at a few points. The agents in those systems have limited genuine autonomy. They follow a path somebody drew.

This matters for governance in a way that is easy to miss. A deterministic workflow with an LLM step is auditable by inspecting the workflow, and its failure modes are bounded by the paths that exist. A genuinely autonomous agent selecting its own sequence of tool calls has no such boundary, and the governance requirement is categorically different.

If most of your estate is agentish, a control plane is useful but the urgency is lower than the market implies. If you are running things that genuinely decide their own next action against production systems, the urgency is higher than most organisations have internalised. Work out which you have before you work out what to buy.

The standards problem

Forrester's own characterisation of where this market sits is unusually blunt. The agentic era is in its dial-up internet phase, with architecture emerging considerably faster than the standards needed to support it.

That has a direct consequence for buyers. A control plane's value depends on its ability to see and control agents built by other people, and that ability depends on interoperability standards for agent identity, capability description, tool invocation, and inter-agent communication. Those standards are being actively contested rather than settled.

Anything you buy today is therefore buying into a set of assumptions about how that shakes out. Some of those assumptions will be wrong. This is not an argument against buying, since the alternative is an ungoverned estate, but it is an argument for weighting adaptability heavily and for treating multi-year lock-in with suspicion.

Forrester's own expectation is that the market solidifies into clearer offerings, criteria, and value propositions over roughly twelve to twenty four months from the category's announcement. Existing control planes are described as early and uneven, largely embedded inside individual vendor ecosystems and constrained by platform-specific assumptions.

Who is competing for this layer

The thirty three vendors do not come from one place, and the origin tells you what each product is good at.

AI observability and evaluation vendors arrive with deep monitoring and testing capability and are extending into policy enforcement. They are strong on knowing what happened and comparatively newer at preventing it.

Identity and access management vendors arrive from the opposite direction. If an agent is a non-human identity that needs credentials, permissions, and revocation, then this is an extension of an existing discipline rather than a new one, and that argument is stronger than it initially sounds.

Governance, risk, and compliance vendors arrive with the policy frameworks, the audit machinery, and the relationships with the people who will ultimately be accountable, but frequently without the runtime depth to enforce anything in real time.

Security vendors arrive with discovery and enforcement instincts and a natural fit for the shadow agent problem.

And the agent platform vendors arrive with runtime control that is genuine but bounded to their own estate.

For a buyer, the practical question is which of those four disciplines your organisation is weakest in, because that is where the control plane needs to be strongest.

Identity is the primitive nobody prices

Of the five capability areas, agent identity is the one most likely to be underweighted in an evaluation and most likely to matter in three years.

An agent that acts on behalf of a person needs to be distinguishable from that person in every log, or your audit trail becomes meaningless. An agent that acts on its own behalf needs its own credentials, its own permission set, and a lifecycle that includes revocation. An agent that calls another agent needs to carry provenance so the chain can be reconstructed afterwards.

Get this wrong and every downstream control degrades. Policy enforcement cannot distinguish between actors it cannot tell apart. Audit cannot attribute an action to a decision-maker. Incident response cannot answer who did this, which is the first question anyone asks.

Most organisations already have a non-human identity problem with service accounts, and most have not solved it. Agents make that problem larger and considerably more dynamic, since agents are created and destroyed at a rate service accounts never were.

What to do now

Inventory before you procure. Whatever tooling you eventually choose, the discovery exercise is worth running immediately and independently, because the result determines whether this is an urgent purchase or a twelve month watching brief.

Separate oversight from runtime deliberately. If your control plane comes from your largest agent platform vendor, accept explicitly that you have chosen convenience over independence, and document why that is acceptable for your risk profile.

Test enforcement rather than monitoring. Ask a vendor to demonstrate an agent action being blocked before execution, not flagged after. That single demand separates the category's real participants from dashboards with governance branding.

Ask who writes the policy. Several vendors let risk and compliance teams express policy as intent rather than as code, which removes an engineering dependency that would otherwise make every policy change a sprint. If your GRC function cannot change a rule without a ticket, the control plane will drift out of date within a quarter.

And keep the contract short. In a market Forrester itself describes as pre-standards and unevenly formed, a three year commitment is a bet on assumptions that nobody has settled yet.

Forrester does not endorse any vendor named here, and inclusion in a Landscape report is not a rating or a recommendation to buy.