The control plane is the product for autonomy

Autonomous writes to NetSuite, SAP, or a warehouse system require a control plane. Identity, least-privilege permissions, approval policy, observability, and audit have to govern every action. The ability to block or escalate a run is as important as the ability to complete it.

Administrative controls and exported logs are useful, but a control plane has to sit in the path of every action. It resolves the acting identity, limits the available tools, enforces approval requirements, records the transaction, and preserves enough evidence to reconstruct the run.

Five constraints on every action

• Permissions — least privilege per tenant, per function, per tool. A purchasing sequence does not inherit finance write paths.
• Approvals — policy-bound human checkpoints, not a chat that hopes someone is watching.
• Observability — live view of intent, tool sequence, and state—not a transcript dumped after an incident.
• Auditability — every action and system change reconstructable. If you cannot show it, it did not happen safely.
• Policy enforcement — constraints are executed and constraint adherence is scored for every run.

Tenant isolation, complete audit logs, and clear data-use boundaries are baseline requirements when an agent can change production systems. Compliance programs such as HIPAA, SOC 2 Type II, and CASA add domain-specific obligations, but the runtime still needs to enforce the corresponding identity, access, and evidence controls on each action.

An enterprise execution agent that cannot be refused, inspected, or reconstructed is not autonomous. It is unaccountable.

A model change should not alter the control plane. Permissions and policy remain executable constraints outside the prompt, so the same authorization and audit rules apply regardless of the inference provider.