Enterprise AI is moving from answering questions to taking action. An agent may have permission to update a customer record, but that does not mean it should change the account information based only on a request in chat. It may need to verify the customer’s identity first.

The same distinction applies across business systems. Permission to perform an action does not, by itself, establish that the action is appropriate in the circumstances. We also need to ask what information led the agent to act and whether that information is trustworthy. A well-intended agent can still make a poor decision if it relies on stale data or an unverified instruction.

Governing agentic AI therefore means governing both authority and context.

Algedonic’s two-plane model offers a way to organize that work. The control plane governs which actions an agent may take and how those actions are constrained at execution. The data plane, as used in this model, governs the information flows and runtime context that shape an agent’s decisions, along with the evidence available to understand them. The planes work together to address distinct parts of the problem.

Figure 1. Algedonic’s two-plane model for governing agent actions and context.

Why agent governance needs two planes

Traditional access controls (RBAC/ABAC) answer static questions: Can this service access this resource? Agent workflows introduce dynamic requirements: Should this specific agent, acting with this intent, using this real-time context, execute this action right now?

When records of data access, policy decisions, and tool calls remain disconnected, an organization may struggle to reconstruct how an outcome occurred. A system that controls actions but ignores context can allow an authorized tool call based on bad information. A system that governs information but cannot enforce decisions at the point of execution may observe a risk without stopping an unauthorized action.

The Algedonic control plane addresses authority to act. The data plane refers to Algedonic’s runtime context layer. This layer addresses the conditions under which an agent forms its decision: what information it retrieves or updates, and how information moves between agents and tools. An agent may have permission to use a finance application to pay a supplier’s invoice, while lacking authority to change a supplier’s bank details.

A system that controls actions but ignores context can allow an authorized API call based on bad information. A system that governs information but cannot enforce decisions at the point of execution may observe a risk without stopping an unauthorized action.

The control plane governs authority and execution

The control plane establishes an agent’s identity, ownership, and scope, enforcing rules at the exact point of execution. Within the Algedonic architecture:

• AI Registry: serves as the central catalog of operational agents across the enterprise environment.

• Synapse: binds identity to an agent dynamically at execution time and bounds its allowable scope.

• Policy Packs: express business and regulatory requirements as rules applied across agents and tools (with the strictest rule taking precedence).

• Guard and Secure Execution Fabric: provide real-time interception at runtime, determining whether an operation proceeds, is blocked, or is held for human review.

Decisions made by Guard and the Secure Execution Fabric using the information provided by the AI Registry, Synapse, and Policy Packs are captured and logged for audit purposes. Sensitive actions, such as approving a payment above a threshold or changing sensitive account details, can be held for human review and oversight. Operators may then take manual actions to approve, suspend, quarantine, or kill an agent if its intended behavior moves outside of its authorized boundaries.

The data plane governs the context behind decisions

The data plane focuses on the information environment in which agents work. Witness provides visibility in an organization’s AI environment by discovering ungoverned agents, new tools, and additional runtime context when an agent executes. Note that discovery on its own is a starting point for governance. It does not, by itself, establish that an action is safe or appropriate; the control plane policy infrastructure provides that context.

For example, data-access policies govern which sources an agent may read and where information may flow. Policy Packs capture the intended use of the information, not merely the channel through which it arrived. Context governance extends that to the runtime information that informs a decision, including data sent by the agent as tool inputs, data retrieved by the agent as tool output, as well as prompts and responses produced by another agent.

Evidence connects activity across the two planes to help teams investigate activity and support review and audit. Evidence records capture agent actions and intent, policies applied, tools and other agents invoked, enforcement decisions made, and outcomes.

Example: A supplier payment shows how the planes work together

Consider an agent assigned to process routine supplier invoices. It can read invoices and supplier records, match amounts to purchase orders, and submit payments to verified suppliers within an approved limit.

Now suppose an invoice includes a request to change the supplier’s bank account. The request might be legitimate, a mistake, or malicious. The agent should not change the account or send payment based on the invoice alone.

In this example, the data plane provides the context that there has been a change to the supplier’s bank account information in the invoice. The control plane provides the infrastructure to intercept and evaluate the proposed payment. While paying an invoice to an established supplier may fall within the agent’s authority as set by Synapse, additional policies may limit access to sensitive supplier information, define payment limits, define the source of approved change requests, or flag such requests for human oversight. In this case, an appropriate outcome is to pause the action until the change is verified and any required approval is obtained.

The architecture can be understood as a recurring operating cycle. Discover identifies the agents, tools, data sources, and runtime activity that need governance. Authorize evaluates a proposed action against identity, assigned authority, policy, and relevant context. Enforce applies the decision where the action occurs, including blocking it or routing it for human review when required. Prove preserves available evidence so the organization can examine what happened and why.

These are connected functions, not a one-time checklist. An agent encounters new information, invokes different tools, and proposes different actions throughout a workflow. Governance needs to account for those changes. The quality of the resulting evidence depends on what the environment can reliably observe and connect; a log of an action alone may not explain the context or authorization decision behind it.

Enterprise data quality, provenance, and lineage shape agent trust

Context governance depends on the quality of enterprise data. Agents often assemble information from systems with different owners, update schedules, definitions, and access rules. A record can be accurate when created and stale by the time an agent uses it. A field can also mean one thing in a finance system and another in a procurement system. Poor data quality can lead to poor recommendations even when an agent behaves as designed.

Provenance helps establish where information originated and how it entered an agent’s context. Lineage describes how data moved or changed across systems. Both can help reviewers assess relevance and trace an input to its source. Neither proves the information is correct: an authoritative system can contain errors, and a well-documented data path can still carry outdated information.

Connecting agent governance with enterprise data systems can help organizations apply existing rules about sensitivity, permitted use, and stewardship to information consumed by agents. It can also help link a decision to the sources that informed it. Organizations should be precise about what their integrations capture and preserve. If lineage stops before the agent’s retrieval step, it may not establish which content actually influenced a response.

A governance architecture for action

As agents take on work across enterprise systems, governance needs to reach beyond account permissions and retrospective monitoring. Organizations need to know which agents are operating, define the authority each one has, govern the context that informs decisions, enforce rules at execution, and preserve evidence that links decisions to outcomes.

That is the purpose of the two-plane model. The control plane governs what an agent may do. The data plane governs what information shapes its decisions and what evidence can be retained about that process. Together, they frame a continuous discipline: Discover. Authorize. Enforce. Prove.

The architectural test is straightforward: can an organization explain both why an agent had authority to take an action and what information informed it? When those answers are connected, agent governance becomes easier to reason about, operate, and review.