AI Agents
The AI Control Plane: governing the agents you didn't build and can't see
Salesforce announced an AI Control Plane at Dreamforce, a layer to register, identify, and govern agents across Salesforce and other platforms, not just your own Agentforce fleet. Here is what it claims to do, how it composes with A2A and MCP, what exists today versus the FY28 roadmap, and the registry discipline worth building now whether or not you buy it.
You already have a way to govern your own Agentforce agents. The problem Salesforce is now pointing at is different: the agents you didn’t build, running on platforms you don’t own, that your teams turned on without telling anyone.
That gap is what the AI Control Plane is meant to close. Salesforce announced it on September 11 as part of a broader framework, and the pitch is a single place to discover, register, and govern every agent in the enterprise, whether it runs in Agentforce or on AWS, Azure, or Google.
My read: the idea is right and the timing is real, but most of what was announced is a direction, not a product you can switch on. The unified experience is a FY28 rollout. The registry discipline it assumes, though, is worth building today with what you already have. Do that first, and the Control Plane becomes a place to plug in rather than a project to start.
Why a control plane, and why now
By mid-2026 the question stopped being whether to build agents. Most enterprises already have, and rarely on one platform. A team builds a service agent in Agentforce, another wires a research agent on Vertex, a developer ships something on AWS AgentCore, and someone in IT turns on Microsoft Copilot Studio. None of them can see the others.
I wrote last year that agent sprawl is the new shadow IT. That piece was about a fleet inside one org. The sprawl got wider since. The agents now run across clouds, and the A2A protocol means your agent can delegate work to one you can neither open nor audit.
A control plane is the standard answer to that shape of problem. Networking solved it with a control plane over the data plane. Kubernetes solved it with a control plane over the workloads. The bet is that agents need the same: a management layer that sits above the runtimes and answers “what is running, who owns it, what is it allowed to do, and what is it costing.”
Salesforce is not alone in making that bet. Vendor-neutral agent-estate tools already market a single control plane over LangGraph, CrewAI, AgentCore, Copilot and Agentforce. Whoever owns the registry owns the governance, and that is the land being grabbed right now.
What the AI Control Plane claims to do
Salesforce describes five jobs for the Control Plane. Read them as the checklist any agent-governance layer has to cover, not as unique features.
- Discover and register agents, so every agent has an entry, including third-party ones, and the org holds one inventory instead of a guess.
- Establish identity and policy, so each agent has an identity and a set of rules for what it may touch and do.
- Manage lifecycles, so agents are created, changed, and retired on purpose, not left running after their owner leaves.
- Evaluate performance, watching whether an agent is doing its job and feeding the observability you already run.
- Control costs, attributing consumption per agent, so a runaway agent shows up as a line item and not a surprise on the invoice.
The interesting word in all five is “third-party.” Governing your own Agentforce agents is something you can already do with running-user identity, the audit trail, and Command Center. Extending the same registration, identity, and cost control to an agent running on someone else’s cloud is the new claim.
The trust framework it sits inside
The Control Plane was announced as one piece of a wider framework Salesforce calls the Trusted Enterprise AI Harness, built from six capabilities: Trusted Context, Trusted Agency, Trusted Action, Trusted Governance, Trusted Security, and Trusted Models.
Two of those are worth a builder’s attention.
Trusted Context is the grounding story under a new name. It brings together data, metadata, semantics, knowledge, real-time signals, and memory, which is Data 360 doing the job it already does, framed as the context every agent draws on.
Trusted Models is the routing story. It lets an org connect the right model for each job, with routing based on accuracy, performance, cost, and business requirements. That lever is the same as the per-subagent model override, now written as policy, and it is where a CRM-tuned model like Koa fits: the Control Plane is where you would say “route deterministic CRM actions to Koa, open-ended reasoning to a frontier model.”
The framework draws on Data 360, MuleSoft and Agent Fabric, Tableau, Agentforce, and the platform’s own security and governance. In other words, the framework is an assembly of pieces Salesforce already ships, repackaged as a control layer. That packaging is a strength for anyone already invested in the stack, and the reason to be sceptical of the timeline.
How it composes with A2A, MCP, and the runtime
A control plane does not run your agents. It governs the ones that run elsewhere, so the plumbing under it matters.
Think of the layers separately. MCP is how an agent uses a tool. A2A is how an agent delegates to another agent. Multi-agent orchestration is how a team of your own agents hands off inside Agentforce. The Control Plane sits above all three as the registry and policy layer, and the framework is described as open on exactly those interfaces: MCP, APIs, Skills, and Plug-ins.
The sharp edge is the trust boundary. When you register a third-party agent, you are cataloguing something you cannot open. You can attach an identity to it, write a policy for what it is allowed to receive and return, and meter what it costs. You cannot see its reasoning or guarantee its behaviour, because it runs on infrastructure you do not control. The Control Plane makes the boundary visible and governable. It does not dissolve it. Design as if the agent on the other side can misbehave, because you cannot prove it will not.
What exists today versus the roadmap
Here is the part the keynote soft-pedals. Salesforce says the foundation technologies are available now, but the unified Control Plane experience begins rolling out in early FY28, and final packaging, pricing, and availability are still pending.
FY28 for Salesforce begins in February 2027. So the honest status is: the components exist, the single pane of glass does not yet, and nobody has quoted you a price. Treating the AI Control Plane as something you will deploy this quarter would be a mistake.
That does not make it noise. It makes the work you should do now clear, because none of it depends on buying the product.
Build the registry yourself. Inventory every agent your org runs, on every platform, the way you would inventory integration users. For each one, record an owner, a scoped identity, what it can touch, and a retirement date. Attribute cost per agent. Decide the policy for what an agent may do before it does it, not after an incident.
All of that is achievable today with the tools in front of you: scoped identities and the audit trail in Salesforce, observability for the agents you run, and a spreadsheet for the ones you do not until something better exists. When the Control Plane ships, an org that already has this discipline plugs in. An org that does not will be building the inventory under deadline, which is the worst time to build it.
What I would tell a platform owner
The AI Control Plane is the right diagnosis. Ungoverned agents across multiple platforms is the real enterprise problem of 2026, and a registry with identity, policy, lifecycle, evaluation, and cost is the right prescription.
The prescription is also mostly filled with parts you own. If your Agentforce fleet is already governed and your data foundation is already the context layer, the Control Plane is an extension of your posture, not a new one. If it is not, no control plane will save you, because you cannot govern a registry you never populated.
So do not wait for FY28 to start. Populate the registry now. Buy the pane of glass later, from Salesforce or from whoever ships the best one, and buy it because it makes a discipline you already run easier, not because you hope it will create a discipline you skipped.
Understanding the basics
What is the Salesforce AI Control Plane?
The AI Control Plane is a management layer, announced at Dreamforce 2026, for discovering, registering, and governing AI agents across an enterprise, including agents that run outside Salesforce. Its stated jobs are agent discovery and registration, identity and policy, lifecycle management, performance evaluation, and cost control.
How is it different from Agentforce Command Center?
Command Center gives you observability for the Agentforce agents you build and run. The Control Plane is broader: it aims to register and govern agents across platforms, Salesforce and third-party alike, with observability as one of several functions rather than the whole product.
Is the AI Control Plane available now?
Not as a single product. Salesforce says the foundation technologies exist today, but the unified Control Plane experience begins rolling out in early FY28, which starts in February 2027, and pricing and packaging were not detailed at launch.
What is the Trusted Enterprise AI Harness?
It’s the wider framework the Control Plane belongs to, made of six capabilities: Trusted Context, Trusted Agency, Trusted Action, Trusted Governance, Trusted Security, and Trusted Models. It assembles existing Salesforce technologies, including Data 360, MuleSoft, Tableau, and Agentforce, into a common architecture for building and governing enterprise AI.
Start with the inventory
If you take one thing from the announcement, make it the registry, not the release date. List every agent your org runs, on every platform, with an owner and a scope, and you have done the hardest and most valuable part of agent governance before the vendor’s product ever ships. If you want help drawing that map, talk to us, or start with the org health scorecard and bring the result.
