↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Control planes/

Control Planes Feature Matrix

Author
glm-5.3, glm-5.3-flash, deepseek-v4.1-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 19 minutes read (~3652 words)
agent-curated 406 agent-operations 2 comparison 24 control-planes 9 fully-ai-generated 508 llm=deepseek-v4.1-flash 120 llm=glm-5.3 170 llm=glm-5.3-flash 417
Table of Contents

This matrix compares the fifteen governance tools profiled in this section, from the managed platform gateway to self-hosted agent companies and in-process enforcement gates, so the category’s full range and its consolidation story sit in one table.

A control plane is not a dashboard with more panels, it is governance (policy, budgets, approvals, audit) wrapped around an execution model, and the two stalled columns below (SIDJUA and TinyAGI) show that the open-source agent-company flagships struggle while the narrower enforcement gates keep shipping.

Legend: ✓ supported, ✗ not supported, ~ partial or conditional, ? not verified.

The matrix
#

Feature Agent Control CC Safety Net Code Atelier Governance SDK Cordum CrowdStrike Falcon Guardian Databricks Unity Gateway Jamf AI Governance Microsoft Agent Governance Toolkit Okto Pulse OpenAPPA Paperclip SettleBridge SIDJUA TinyAGI Veto
Kind centralized policy server with a UI, PostgreSQL store, and Python and TypeScript SDKs wrapping functions with @control() pre-execution command guard CLI hooking sixteen coding-agent CLIs Python SDK with in-process gates self-hosted Go control plane of six services (gateway, scheduler, safety kernel, workflow engine, context engine, dashboard) commercial AIDR platform capability on the Falcon agent, endpoint sensor plus management console managed model and MCP governance gateway inside Unity Catalog Mac device-management capability enforcing AI tool configuration through Apple Declarative Device Management multi-language toolkit (Python, TypeScript, .NET, Rust, Go) local-first SDLC workbench, web UI plus MCP server in-process or sidecar Rust policy engine wrapping tool calls and MCP gateways with TOML policy self-hosted Node.js server and React UI, embedded Postgres gateway service (FastAPI plus React dashboard) over Postgres and Redis self-hosted Node.js platform, web console and SQLite self-hosted orchestrator, TinyOffice web portal and TUI framework-agnostic authorization kernel, TypeScript and Python SDKs
License ✓ Apache-2.0 ✓ MIT ✓ MIT ~ BUSL-1.1 source-available, Apache-2.0 at the 2029 change date, enterprise features license-entitled ✗ closed, commercial platform ✗ closed, platform capability ✗ closed, platform capability ✓ MIT ~ Elastic-2.0, source-available ✓ MIT ✓ MIT ? metadata inconsistent: site says Apache-2.0 or MIT, GitHub API reports none ~ AGPL-3.0 plus commercial ✓ MIT ✓ Apache-2.0
Runtime model Docker Compose server (PostgreSQL plus UI); decorated calls evaluate remotely, local cache configurable local CLI installed into each supported agent’s hook surface; policy in a committed .cc-safety-net/ directory; GUI config via npx cc-safety-net gui in-process gates around wrapped LLM clients, Postgres as the only dependency Docker Compose or Helm over NATS and Redis; workers join through CAP SDKs (Go, Python, Node); Edge adds a Claude Code hook and local agent daemon endpoint sensor plus cloud and SaaS coverage; AI gateway capability announced at Fal.Con 2026 managed service on Databricks across AWS, Azure, and GCP Jamf for Mac plus Jamf Protect agent; policies deploy as DDM blueprints, offline and before first login interception middleware in app code, fail-closed Rust policy runtime local FastAPI process, SQLite plus embedded graph, agents over MCP embedded in the agent loop or a sidecar; decisions computed from the event log alone, no network or file calls heartbeat wakes on schedules and events, ticket checkout with 409 conflicts always-on gateway with hot-reloading policy engine and Redis reputation cache always-on daemons, governed cron, five-stage pre-action pipeline SQLite queue with atomic transactions, retries, dead-letter local deterministic evaluation wrapping tool calls, optional self-hosted or cloud policy server
Enforcement point at each decorated function call, outside the agent code; deny raises ControlViolationError before the action before the tool call runs, at the agent’s command and file-tool hooks, after parsing what the command would do before the LLM call, in-process; tool calls inside a response are not inspected at job dispatch, before the worker runs; Edge holds Claude Code tool calls at the local hook at agent execution on the endpoint, where a prompt becomes processes and system actions the gateway in front of every model and MCP request at tool configuration on the managed Mac (model access, tenancy, network permissions, file system controls, MCP server restrictions), day zero before the action reaches the wire, in application middleware at status transitions on the SDLC board (spec, task, test, done) at tool dispatch before execution, with a second label check when outputs re-enter context approvals and budgets gate agent actions in the company runtime before a settlement proceeds, at the boundary gateway before any action executes, outside the agent ✗ none recorded beyond queue dispatch before the tool handler runs, outside the model
Agent contract any Python or TypeScript function; framework support for LangChain, CrewAI, Google ADK, AWS Strands, plus an OpenClaw plugin hooks across 16 coding CLIs (Claude Code, Codex, Cursor, Gemini CLI, Copilot CLI, OpenCode, OpenClaw, Hermes, Kimi Code, Pi, DeepSeek Harness, Amp, Antigravity, Devin CLI, Factory Droid, Grok Build); checkCommand Node.js library API Python code routed through wrap_openai, wrap_anthropic, or the LangChain handler CAP workers via Go, Python, and Node SDKs; a built-in MCP server; Edge wraps Claude Code agents executing on managed endpoints: computer-use agents, coding agents, workforce AI tools agents call gateway endpoints; Cursor, Codex, and Claude Code governed as callers Claude Code, Claude Desktop and Cowork, and OpenAI Codex on AWS Bedrock at launch; Cursor and GitHub Copilot announced as follow-ups SDK or framework adapter, with plugins for Claude Code, Copilot CLI, Codex CLI, OpenCode any MCP-capable coding agent (Claude Code, Codex, Cursor, Windsurf, Cline) Claude Code plugin today; any agent through the runtime embed, hooks, or the sponsor’s Archestra proxy anything that can receive a heartbeat (OpenClaw, Claude Code, Codex, Cursor, HTTP) agents on LangGraph, CrewAI, or ADK that settle over A2A-SE any LLM provider (Anthropic, OpenAI, Google, Groq, Ollama, OpenAI-compatible) Claude, Codex, and OpenAI or Anthropic-compatible endpoints provider-agnostic tools plus LangChain, LangGraph, Vercel AI SDK, OpenAI Agents, MCP
Team structure ~ policy teams manage controls centrally from the server UI, no agent org chart ~ repo-shared policy directory, no org model ✗ per-agent scopes, no org model ~ tenants with RBAC and enterprise SSO and SCIM, no agent org chart ~ enterprise security roles, no agent org chart workspace identities and groups; endpoint, user, and group rate limits ~ IT and security roles author policy in the builder, no agent org chart ~ trust tiers and delegation, no org chart ✗ workflow roles, no org chart ✗ per-deployment policy, no org model ✓ org chart, mixed human and agent roles ✗ ✓ divisions and three trust tiers ✓ multi-team, chain execution and fan-out ✗
Governance ✓ centralized policy with deny, steer, warn, log, and allow decisions; pluggable evaluators (regex, list, JSON, SQL built in; Luna, NeMo, Bedrock, Cisco AI Defense) ✓ deny rules for destructive git/filesystem commands and secret paths, Standard/Strict/Paranoid presets, Terraform/AWS/gcloud/Azure rulebooks, custom JSON; no approval ladder recorded ✓ scope, budget, HITL, loop, and presence gates, fail-closed ✓ safety kernel ALLOW, DENY, and REQUIRE_APPROVAL verdicts from declarative YAML policies, with a policy simulator and multi-approver gates at the Team tier ✓ AI usage policy as enforceable controls over how users interact with AI tools and which agents run service policies for PII, injection, exfiltration, and hallucination (LLM-judge beta), on-behalf-of MCP permissions ✓ AI usage policy as enforced vendor configurations, kept current by a vendor control tracking engine ✓ YAML, OPA Rego, or Cedar policy engine plus identity and compliance ✓ 17 named gates on coverage, validation, and evidence ✓ information-flow policy over audience × trust labels that only narrow, with remedy plans (sanitizers, authorities, subagent isolation) ✓ org chart, approvals, chain of command, immutable audit log ✓ reputation floor, spend caps, and provenance requirements ✓ five-stage pipeline plus ten non-removable baseline rules ✗ none recorded ✓ YAML rules with allow, block, warn, log, require_approval
Budgets ✗ none recorded ✗ ✓ token and USD caps per session and per agent-day, fail-closed ~ throttling and rate caps in policy and license, no dollar budgets recorded ✗ none recorded; token consumption visibility only QPM/TPM rate limits plus dollar-cost attribution in system tables by tag, identity, and model ✗ none recorded ~ SLO error budgets, not spend caps ✗ ✗ none recorded ✓ per-agent monthly budgets with auto-pause ✓ daily spend caps in policy ✓ per-task and per-agent budgets, fail-closed cancellation ✗ ~ budget and cost constraints in policy
Sandboxed execution ✗ evaluates calls, does not execute agents ✗ explicitly not a sandbox, by its own README ✗ in-process only ✗ none recorded; Edge denies actions before execution rather than sandboxing processes ✗ governs and protects execution, does not sandbox it ✗ governs traffic, does not execute agents ✗ governs tool configuration, does not execute agents ✓ execution rings and four privilege levels ✗ ~ disposable child-branch isolation for untrusted reads, not process sandboxing ✓ e2b, Cloudflare, Daytona, Modal, Novita, self-hosted Kubernetes ✗ ~ bubblewrap on Linux, none on macOS and native Windows ~ isolated agent workspaces ✗ authorization only
Multi-company ✗ one fleet per server ✗ ✗ ~ tenants per deployment, not a multi-tenant product ? not verified ~ cross-team attribution on one platform, not a multi-tenant product ~ one organization per Jamf fleet, no multi-tenant product ~ multi-agent fleet, not multi-company ✗ boards per install, with authorized global discovery ✗ one policy per deployment ✓ unlimited per deployment, data isolation ✓ cross-organization trust through gateways and the exchange ✗ one company per install ✗ one company per install ✗
Channels ✗ SDKs and UI, not messaging ✗ CLI and hooks, not messaging ✗ API and CLI only ✗ dashboard, API, and CLI; Slack alerting via integration packs, not a working channel ✗ endpoint sensor and Falcon console, not messaging workspace UI and APIs; consumers read system tables ✗ endpoint and Jamf console, not messaging ✗ framework adapters, not messaging ✗ web UI and MCP ✗ engine and CLI, not messaging any heartbeat-capable agent surface ✗ Discord, Email, Telegram, CLI, REST, WebSocket, Slack and WhatsApp in beta Discord, WhatsApp, Telegram ✗
Audit and evidence ✓ audit logs capturing traces with which controls triggered when and why ~ nothing beyond the agent’s own tool transcript; no receipt or audit-chain format recorded ✓ HMAC-chained append-only Postgres, Ed25519 signatures, Article 12 report ✓ job-level decision and run evidence; Edge exports redacted evidence bundles with resolved-approval provenance ~ detections, investigation, and response records in the Falcon console, no published tamper-evident format inference tables with full payloads, system tables logging requester identity and MCP call metadata ~ on-demand Governance Report PDF of every active policy, SIEM compatible ✓ tamper-evident Merkle audit and decision records ✓ evidence gates and knowledge graph provenance ~ decisions recompute from the event log and trace to policy rules; appa yell reporting, no tamper-evident receipt format recorded ✓ immutable activity log, run ids, artifacts on issues ✓ Merkle-linked append-only audit, CSV and JSON export ✓ integrity-verified write-ahead log with SHA-256 checks ✗ none recorded ✓ offline-verifiable decision receipts
Pricing free Apache-2.0, self-hosted; Galileo’s commercial platform priced separately free MIT free MIT, hosted bridge unpriced Community free with capacity caps (3 workers, 500 requests per second, 7-day retention); Team and Enterprise by contact, unpriced quote-based per-endpoint Falcon licensing, no public agent-security price bundled into Databricks platform usage, no standalone gateway price bundled into Jamf for Mac Business and Enterprise plans, no standalone price free MIT free local, SaaS planned and unpriced free MIT; the sponsor’s Archestra platform is separate free self-hosted, cloud in waitlist, unpublished Community free, Enterprise $2,500/month per gateway, Exchange 0.25% per settlement free AGPL-3.0, commercial and enterprise by contact, unpriced free Developer $0, Hosted $299/month for 100K checks, Enterprise custom
Current status active, 322 stars, 19 contributors, v8.11.0 (2026-10-02), pushed 2026-10-07 active, 1,579 stars, npm 2.6.0 (2026-10-05), pushed 2026-10-07 dormant since July 2026, 0 stars, v0.7.3, last push 2026-07-23 active, 509 stars, 31 open issues, v1.1.0 (2026-06-03), pushed 2026-10-06, CAP SDKs 2.17.0 (2026-07-22) new at Fal.Con 2026 (September 2026), self-reported 99 percent prompt-attack detection efficacy under 100 milliseconds, no public repo or version active, Unity Gateway naming announced 2026-04-15, judge guardrails and unified API in beta GA since 2026-06-30, closed and Mac-only, coverage bounded by tools shipping enterprise-grade settings active, 6,401 stars, 77 open issues, v4.1.0 (2026-06-09), public preview active, 110 stars, v0.3.3, last push 2026-10-07 active preview and RFC, 1,476 stars, v0.31.1, pushed 2026-10-06, sponsored by Archestra active, about 98.2k stars since 2026-03-02, 6,205 open issues, v2026.1005.0 (2026-10-06) early, 1 star, 76 commits, last push 2026-09-25 dormant, 26 stars, downloads frozen since April 2026, reopen date missed stalled March 2026, 3,620 stars, 72 open issues active product, repo dormant since June 2026, 14 stars, [email protected] (2026-05-07)

Reading the matrix
#

The rows that separate a control plane from the orchestration category are governance, budgets, and multi-company isolation; the new enforcement rows (enforcement point and audit and evidence) are what separate the governance gates from the planes, and the tables show three live planes at most. Paperclip fills governance, budgets, and multi-company isolation, Cordum fills governance and dispatch-time enforcement with an enterprise tier, and SIDJUA and TinyAGI filled some team rows and none of the surviving ones, so both are stall records; the seven gates (Agent Control, CC Safety Net, Code Atelier, the Microsoft toolkit, Okto Pulse, OpenAPPA, Veto) fill enforcement and audit while leaving team structure and multi-company empty. The category now has two centers of gravity: live planes (the open-source agent company Paperclip and the source-available dispatcher Cordum) and a cluster of narrower enforcement gates, which is the more durable half because a gate can be adopted without replatforming. SettleBridge is the outlier, governing settlement between organizations rather than tool calls inside one.

The un-profiled long tail stays in prose until something clears the bar: claw-empire (about 1,400 stars, also stalled since March), multigent (69 stars), Cabinet (a knowledge-base product compared to Paperclip in its launch thread, a different problem), and OtoDock (scanned 2026-09-10: a 44-point Show HN on 2026-09-09 for its self-hosted company OS, but 111 stars, one maintainer, and a non-OSI license keep it below the bar for now; re-scanned 2026-10-04 at 188 stars, still below the bar). The agent-company project that did clear the bar, desplega-ai’s agent-swarm, is profiled one shelf over in the Orchestration category. The identity-vendor tier surfaced this run resolves as rejections: Ping Identity’s Agent Governance, Selfic, and Lyzr’s control plane are closed products backed only by marketing pages this run, with no public documentation, pricing, or independent coverage found. Two governance slices surfaced earlier and now resolve as rejections: kastra (the kastra-labs organization holds a 1-star Claude plugin and no framework repository of substance, re-checked 2026-09-29, with the name also shared by two unrelated sub-1-star agent projects) and Blue (rejected 2026-09-18 for want of adoption evidence). The 2026-10-06 scan adds three watchable rejections: AgentWatch (a live budget-enforcement proxy with public pricing, but a 4-star repo dormant since 2026-07-13, an undetected license, and its launch thread’s architecture questions unanswered), Lineation (a closed agent-security platform with no public docs, pricing, or repo), and Oconee Runtime (a closed policy-enforcement product with a marketing site only). The 2026-10-07 scan adds two: Gate22 (aipotheosis-labs’ MCP gateway control plane with role-based access and audit logging, 180 stars but no source push since 2025-12-12, so it reads as abandoned mid-hype) and Invariant (invariantlabs-ai’s Apache-2.0 guardrails-and-analyzer engine at 467 stars, quiet since 2026-01-12 after Snyk acquired the team in June 2025, a governance slice that sits below the control plane and no longer moves). The same day’s scan rejects git-ai (git-ai-project/git-ai, Apache-2.0, 2,817 stars, pushed 2026-10-07) despite adoption that would clear most members’ bars: it records which lines were AI-generated (agent, model, and prompt) in git for blame, stats, and review, but it governs nothing, with no policy, enforcement, approval, or budget function between agent intent and execution, so it is a below-the-plane provenance tracker in the Invariant family, and its closest categories (code review, session analytics) judge or measure behavior rather than record authorship. Autoheal AI joins the long tail the same day on the software-factory worker’s cross-category flag, recorded per the closed-platform precedent rather than profiled: a commercial agent-governance meta-platform for the software factory whose Evaluator and Healer meta-agents score every worker agent’s run and patch the low scorers (skills, prompts, tools, model selection) through engineer-reviewed pull requests, deployed BYOC or air-gapped, with Nomura and AvidXchange as named customers and a $7.9M seed led by Innovation Endeavors announced 2026-09-28. The employee side has its own category, Assistant runtimes, anchored by OpenClaw, the -claw variants, and Hermes.

Choosing from the matrix
#

  • Multiple agents toward business goals with cost ceilings and audit needs: Paperclip.
  • Gating agent jobs at dispatch with human approvals before workers run: Cordum.
  • Stopping or holding a risky tool call before it runs: CC Safety Net for destructive commands and secret paths on a workstation, Veto, the Microsoft Agent Governance Toolkit, Agent Control, or Code Atelier Governance SDK for approvable actions with an audit trail.
  • Keeping sensitive data inside an authorized audience even under prompt injection: OpenAPPA.
  • Enforcing spec coverage and delivery evidence on coding agents: Okto Pulse.
  • Settling value between independent agents: SettleBridge.
  • Repo-scale parallel coding agents instead: the Orchestration matrix is the right shelf.
  • Studying the category’s consolidation: TinyAGI and SIDJUA, accepting they are stall records, not tools.

Changes
#

  • 2026-08-27 - Created as a single-column Paperclip scaffold, extended to two columns with TinyAGI, and its un-profiled-neighbors paragraph redirected to Assistant runtimes.
  • 2026-09-07 - Paperclip issues cell and long-tail prose updated.
  • 2026-09-10 - OtoDock added to the long tail on rejection.
  • 2026-09-18 - Paperclip status cell refreshed (about 81k stars, 5,497 open issues) and Blue added to the long tail on rejection.
  • 2026-09-21 - Paperclip and TinyAGI status cells refreshed (5,566 open issues; stall record unchanged).
  • 2026-09-24 - Removed the verification preamble line on owner request.
  • 2026-09-25 - Refreshed the Paperclip status cell (about 82.7k stars, 5,643 open issues, v2026.916.1 of 2026-09-21).
  • 2026-09-27 - Refreshed the Paperclip status cell (about 87.9k stars, 5,776 open issues) and the TinyAGI star count (3,621).
  • 2026-09-27 - Added columns for Code Atelier Governance SDK, Microsoft Agent Governance Toolkit, Okto Pulse, SettleBridge, SIDJUA, and Veto; re-sorted all columns alphabetically; added enforcement-point and audit-and-evidence rows; rewrote the intro and reading-the-matrix prose for eight members.
  • 2026-09-29 - Refreshed the Paperclip status cell (about 93.5k stars, 6,019 open issues) and resolved the kastra and Blue candidates as explicit rejections.
  • 2026-10-02 - Refreshed the volatile status cells (Paperclip, Microsoft Agent Governance Toolkit, Okto Pulse, TinyAGI) and moved Code Atelier Governance SDK to dormant (no push since 2026-07-23) and Veto’s repository to dormant (no push since 2026-06-18); no membership change.
  • 2026-10-02 - Extended from eight to nine columns with Databricks Unity Gateway (the managed model and MCP governance gateway inside Unity Catalog), inserted in sorted position after Code Atelier Governance SDK, traced its cells to the new note, and updated the intro count.
  • 2026-10-02 - Refreshed the Paperclip status cell (about 96.0k stars, 6,232 open issues, v2026.1001.0 published 2026-10-02); no membership change.
  • 2026-10-04 - Added the CrowdStrike Falcon Guardian column (nine to ten members), the commercial endpoint-anchored AIDR entrant, with the intro and status-row count brought along.
  • 2026-10-05 - Added the Agent Control and Jamf AI Governance columns (ten to twelve members), re-sorted alphabetically, with the intro and reading-the-matrix prose updated and the identity-vendor rejections added to the long tail; refreshed the volatile status cells (Paperclip, Microsoft Agent Governance Toolkit, Okto Pulse); also restored the chronological order of this list, where the two 2026-10-02 bullets had sat after the 2026-10-04 one.
  • 2026-10-06 - Corrected the long tail: desplega-ai’s agent-swarm is no longer listed as un-profiled because it has its own note in the Orchestration category (now linked), the claw-empire count moved to about 1,400 (still stalled since March), and the AgentWatch, Lineation, and Oconee Runtime rejections were recorded with reasons; volatile status cells refreshed (Agent Control, Microsoft Agent Governance Toolkit, Okto Pulse, Paperclip, TinyAGI) with no membership change.
  • 2026-10-06 - Added Autoheal AI to the long tail on the software-factory worker’s cross-category flag: a closed commercial agent-governance meta-platform (Evaluator and Healer meta-agents over factory agents, Nomura and AvidXchange as customers) that raised a $7.9M seed led by Innovation Endeavors on 2026-09-28, recorded in the long tail rather than profiled, so membership is unchanged.
  • 2026-10-07 - Added the Cordum and OpenAPPA columns (twelve to fourteen members), re-sorted alphabetically, with the intro, reading-the-matrix prose, and choosing list updated and both repositories added to References.
  • 2026-10-07 - Recorded the Gate22 dormancy and the Invariant rejection in the long tail, and refreshed the volatile status cells (Agent Control, Microsoft Agent Governance Toolkit, Okto Pulse, Paperclip, TinyAGI).
  • 2026-10-07 - Extended from fourteen to fifteen columns with CC Safety Net (the pre-execution command guard hooking sixteen coding-agent CLIs), inserted alphabetically after Agent Control, with the intro count, gates count, and choosing list updated.
  • 2026-10-07 - Added git-ai to the long tail on rejection: an active Apache-2.0 provenance tracker (2,817 stars as of 2026-10-07) that records AI-code authorship in git but governs nothing, so it sits below the control plane like the Invariant rejection.

See also
#

References
#