Many teams are shipping agents. One place decides what they may do.
A company your size runs agents from several teams, and buys more inside the software it already licenses. The person accountable for what they do is not the person who built them, so the control belongs outside the agents.
One control plane, as many rulesets as you have agents
A support agent, a trading agent and a claims agent decide different things and need different rules. What they share is where those rules live: one engine, one place a version is promoted, one record every decision lands in.
Today each team writes its guardrails into its own code, in its own style, and when the person who wrote them leaves nobody can read them. Here a ruleset is a declared artifact with an owner, a version and a history, and the engine underneath is the same for all of them.
The people who own the policy are not the people who ship the agents
In a startup the product team writes the guardrails because the product team is everyone. At your size the accountability sits with security, risk and compliance, and they cannot wait on an engineering release to change a threshold.
So a rule is written, tested and promoted by the person who owns the policy. No ticket, no deploy, no code review of a business decision. Who may do which of those is itself declared, and the role that writes a rule does not have to be the role that promotes it.
What your security review is going to ask for
All of it is in the deployment on day one, on your own infrastructure.
Which of those your reviewers can verify themselves is on the security page.
You have bought this before, and it was a dashboard
A detector returns a number, and the number is an input to a decision. Buy the number and a dashboard, and the decision stays inside the agent, with no version to point at and no way to answer for it later.
Here your rule decides what the number means, and the rule is versioned like every other one. How a detector plugs in.
An acquisition cannot move your control plane
This layer has been consolidating: Lakera went to Check Point, Robust Intelligence to Cisco, CalypsoAI to F5, Prompt Security to SentinelOne, and Wiz to Google Cloud for $32 billion, closed in March 2026. A control plane running in someone else's cloud can be sold, repriced, moved into a bigger suite you did not buy, or shut down.
This one runs in your data center. There is no sub-processor list to review, because there are no sub-processors.
Where to start
The inventory, because you probably cannot list what you run. Then who may call what, what arrives from outside, what must not leave, what it may spend, and the record that proves it.