The CIO's Agent Control Plane

Koko: The model is the part of the AI stack a CIO should refuse to bet on. That is the first sentence of the piece. Not a caveat buried in paragraph nine. The opening line.

Sam: Which, if you've spent the last two years watching enterprises run model bake-offs, lands like a small grenade.

Koko: Right — because that's been the job. Pick the platform, standardize on it, integrate it. And the argument here is: that job is ending.

Sam: Or more precisely, it ended and nobody sent the memo.

Koko: The reasoning is pretty tight actually. Three facts about the model layer. Capability converges — whatever edge one vendor had this quarter is table stakes across all of them by next quarter. Price falls — token prices follow every commoditizing input down and to the right, steeply. And switching is only expensive if you let it be.

Sam: That third one is the one I keep turning over. The cost of moving between models isn't inherent to the models — it's a function of how tightly you wired your workflow to one. Hard-wire a provider, a swap is a re-engineering project. Abstract it behind a gateway, a swap is a configuration change.

Koko: Which means most enterprises have been making a problem for themselves that was entirely optional.

Sam: Voluntarily. Enthusiastically, even.

Koko: So let's name the thing. The piece is called The CIO's Agent Control Plane, and the central claim is that the durable architecture work has moved one layer out from the model — to a control plane that sits between enterprise intelligence and enterprise action.

Sam: Model-agnostic, policy-driven, observable, integrated through governed tools. Those are the four adjectives the piece keeps coming back to.

Koko: And it's arguing that the primitives of that plane are no longer science projects. These are enterprise-architecture standards now.

Sam: Which is a meaningful claim. There's a big difference between 'here's an interesting emerging pattern' and 'this is load-bearing infrastructure you should be building this year.'

Koko: The piece is firmly in the second camp. And it has a very specific image for what happens if you don't build it. The CIO who spends 2026 running a model bake-off is optimizing the one layer that will be a commodity before the integration pays back.

Sam: Ouch.

Koko: The CIO who spends 2026 building the layer that makes the model swappable is building the part that compounds.

Sam: I'll be honest — that framing is doing a lot of work. It's essentially saying: the model is a depreciating asset, the control plane is the appreciating one. And your job is to figure out which one you're actually investing in.

Koko: The piece puts it almost exactly that way. The harness treats the model as disposable and the control plane as the asset. That is the whole shift in one sentence.

Sam: Okay, so what does this control plane actually consist of? Because 'control plane' can mean anything from a Confluence page to a full platform program.

Koko: Seven primitives. And the piece is very specific about what each one prevents, not just what it does.

Sam: I like that framing. What it prevents is the honest version.

Koko: Start with the model gateway — provider abstraction, routes each call by cost, latency, capability, risk tier, and client preference. What it prevents: lock-in and rewriting workflows when the frontier moves.

Sam: Five routing axes is more specific than I expected. Cost, latency, capability, risk tier, client preference. That last one is interesting — a regulated client or a data-residency constraint gets satisfied by a routing rule, not a separate codebase.

Koko: Which for anyone who's built separate deployments for different clients because of compliance requirements — that's a real pain point addressed.

Sam: Okay, what's next?

Koko: Tool registry. Register every tool, every MCP server, every API and data product, with permissions and audit requirements attached at registration. What it prevents: ad hoc, invisible integrations, permission surfaces no one is tracking.

Sam: And this is where MCP comes in, right? Model Context Protocol — the open standard that's rapidly becoming the way agents connect to tools and data.

Koko: Yes, and the piece has a sharp take on it. MCP is genuinely useful — it means the registry has one protocol to govern rather than a dozen bespoke connectors. But it also lowers the cost of connecting an agent to a system to nearly zero.

Sam: Which sounds good until you think about it for ten seconds.

Koko: Any developer on any team can wire any agent to any data source in an afternoon. Each connection is a permission surface and an audit obligation. Do it ad hoc and you've got the classic shadow-IT failure, re-run with agents that act rather than merely read.

Sam: That line is in the piece and it's worth sitting with. Shadow IT used to mean someone installed Dropbox. Now it means an agent with tool access that security never reviewed.

Koko: The piece puts it bluntly: a CIO who adopts MCP without the registry has simply made sprawl faster to create.

Sam: So the protocol is open, the connection is cheap, but the governance has to be centralized. Got it. What are the other five primitives?

Koko: Policy engine — encode approval rules, restricted actions, data-sensitivity classes, role-based access, segregation of duties, materiality thresholds. What it prevents: governance living in the heads of the team that built the agent.

Sam: Which does not scale and cannot be audited. Two very different problems that both matter.

Koko: Approval service — route a material action to a human to approve, reject, modify, or escalate before it commits. Evidence ledger — capture the prompt, sources, retrieved context, tool calls, approvals, outputs, and model versions for every run. Observability — trace each run on latency, cost, failure rate, acceptance and override rate, policy exceptions. And value telemetry — attribute revenue, margin, working capital, productivity, and risk impact by agent and by process.

Sam: That last one is the one CFOs are going to care about most. Agents measured by usage instead of outcome — that's a budget that cannot be defended.

Koko: The piece groups them into three jobs. The gateway and registry make an agent able to act. The policy engine, approval service, and evidence ledger make it safe to act. Observability and value telemetry make it legible — to the CIO, the CFO, the auditor.

Sam: And then it lands the diagnostic. Most enterprises have built the first job — agents that can reach models and tools — and skipped the second and third. No governed, evidence-producing, value-attributed way to let those agents act in production.

Koko: Which is exactly why pilots stall on the way to deployment. The missing five primitives are the difference between a thing that can act and a thing the enterprise is willing to let act.

Sam: Here's where I want to push back a little. The piece frames sprawl as the alternative to a control plane. But some of what it calls sprawl — teams moving fast, making local decisions, connecting tools — that's also just how organizations ship things.

Koko: Fair. And the piece doesn't disagree that that's what's happening. The argument isn't that teams shouldn't move fast. It's that without a common layer underneath, you end up with four specific costs.

Sam: Walk me through them.

Koko: Duplicated spend — three copilots doing the same thing, each with its own contract and its own integration, because no one can see what already exists. Drifting quality — no two agents evaluated the same way, no shared eval, no shared bar. Blurred ownership — when an agent moves money or sends a customer the wrong message, no one can say who owned the outcome. And an expanding, invisible security surface — every ungoverned MCP server is a permission surface security never reviewed.

Sam: The ownership one is the one that makes lawyers nervous.

Koko: Accountability dissolved the moment the agent was stood up outside any common layer. That's a quote.

Sam: And here's where I think the piece is actually quite careful. It says sprawl is not a discipline problem to be solved with a memo about best practices. It's an architecture vacuum.

Koko: Right. And the only thing that fills an architecture vacuum is architecture. That's the counter to my pushback, honestly — it's not about slowing teams down, it's about giving them a governed substrate to move fast on.

Sam: One thing that struck me: the piece notes that none of the five principles are actually new to enterprise architecture. Model-agnostic, evidence-first, policy-driven, observable, human-accountable. These are disciplines already applied to identity, data governance, change management.

Koko: Extended to a new class of actor — one that reasons and takes action, not merely stores or serves.

Sam: Which is actually a reassuring frame for a CIO. You don't have to invent new governance. You have to recognize that an agent is an actor, and extend what you already trust to a thing that now acts.

Koko: That's probably the most accessible version of the argument in the whole piece.

Sam: Okay, so a CIO finishes reading The CIO's Agent Control Plane. What do they actually do on Monday?

Koko: The piece gives a very specific sequencing. Gateway first.

Sam: Why first?

Koko: It's the cheapest primitive to deliver and it immediately ends model lock-in and starts the cost routing that pays for the rest. You're not waiting eighteen months for a platform program to deliver value — the gateway earns its keep the day it ships.

Sam: Then the registry.

Koko: And make registration the only sanctioned way to expose a tool or an MCP server. So sprawl has nowhere to start — that's the exact language.

Sam: Then policy engine and approval service, so the first agent to take a material action does so under rules and with a human in the loop.

Koko: Then evidence ledger and observability — without which nothing in production is defensible. And value telemetry closes the loop back to the CFO, who funds the next agent against the proven impact of the last.

Sam: That last part is doing real work. The CFO loop. You need to demonstrate value from agent one to get budget for agent two. Value telemetry is what makes that conversation possible instead of speculative.

Koko: The piece ends on a pretty sharp note. The CIO who builds this spends 2026 compounding an owned, governed estate while peers are still running model bake-offs on a layer that will be a commodity before the comparison finishes.

Sam: So the choice isn't really control plane versus no control plane. It's: do you own the part that compounds, or do you own the part that depreciates?

Koko: That is the whole argument in one sentence, yes.

Sam: Which the piece actually says. Almost verbatim.

Koko: Almost.

Sam: I'll say this — the thing I'm sitting with after reading this is the evidence-first principle. A run that produced no evidence record did not happen in a way the enterprise can defend. Build it first, not after the first incident.

Koko: Which is backwards from how most teams think about it. Logging and audit trails are usually the last thing you add. The piece is saying they're the first condition of an action counting at all.

Sam: The forward question I keep landing on is: what does the model layer look like in three years if the control plane becomes standard infrastructure? Because if every enterprise is model-agnostic, the competitive pressure on model providers gets intense in a very specific direction.

Koko: Cheaper, faster, and they're competing on API quality and reliability rather than on enterprise lock-in. Which is actually good for CIOs who built the gateway.

Sam: And bad for the ones who bet on a specific horse.

Koko: The piece doesn't say which horse wins. It says don't bet on any of them.

Sam: Which is either the most vendor-neutral take in enterprise tech, or the most honest one.

Koko: Probably both. If you want the full, source-verified argument — all seven primitives, the MCP governance case, the five principles, and the specific sequencing — The CIO's Agent Control Plane is on Koko Knows. Everything we cited today is in there, with the sourcing intact.

Sam: Go read the thing you just listened to a very enthusiastic summary of.

Koko: That's the pitch.