The Infrastructure Gap in Agentic AI Is the Control Plane

September 4, 2026·5 min read

Agentic AI is deploying faster than anyone can govern it. Deloitte surveyed 3,235 IT and business leaders across 24 countries and published the results on 24 April 2026. Only 21% report a mature governance model for their agents. Roughly 80% lack clear agent boundaries, real-time monitoring, or full audit trails. The gap is not subtle, and it is not about the model.

Gartner’s 2026 Hype Cycle for Agentic AI places the category at the Peak of Inflated Expectations, and the numbers show why. 17% of organizations have deployed agents so far, and more than 60% expect to within two years. Gartner calls it the most aggressive adoption curve it has measured across emerging technologies. The demand side is settled; the argument has moved from whether to adopt to how fast.

The supply side is a different story, and it is maturing unevenly. The model gets the attention, but a model does not decide whether an agent can be trusted with a consequential action. State and durability, observability, error recovery, and least-privilege write access decide that. That layer around the model is what I mean by the control plane, and the industry is only now treating it as its own category.

Two signals say the category is forming. Gartner’s Hype Cycle lists agentic AI governance, agentic AI security, and FinOps for agentic AI as distinct emerging profiles. The oversight layer is appearing before large-scale deployment, which is the opposite of how these things usually go. In March 2026 the Cloud Security Alliance launched the CSAI Foundation with a stated aim of securing the agentic control plane. I do not remember “control plane” being applied to agents a year or two ago, and now a standards body names it as the thing to secure.

The place the gap gets real is write access, and the Model Context Protocol is where it became measurable. Anthropic introduced MCP in late 2024, and it became a widely adopted open protocol for how agents invoke tools, one we have followed as the protocol hardened through 2026. The November 2025 spec formalized OAuth 2.1 for remote servers, which was the right move and also exposed how thin the protections were before it. Between January and February 2026 the community filed more than 30 CVEs against MCP servers and clients. The worst, CVE-2025-6514, scored CVSS 9.6 across 437,000 or more installed environments. By early 2026 researchers had catalogued nearly 7,000 internet-exposed MCP servers, roughly half with no authentication at all. Those figures come from the Cloud Security Alliance, which aggregates third-party research, so I treat them as direction rather than audited fact.

The 2025 incident list is not one bug. There was a cross-tenant data exposure at Asana, prompt injection against GitHub’s MCP server, unauthenticated remote code execution in Anthropic’s own MCP Inspector tool, and npm supply-chain compromises. The MCP authorization spec names two structural anti-patterns of its own: the confused deputy problem, where a proxy forwards third-party OAuth without per-client consent, and token passthrough, where unvalidated tokens get forwarded downstream. The fix the spec lands on is least privilege at the tool level. That is the write-access half of the control plane, the part nobody was thinking about while agents were demos.

Observability is the second pillar, and it is standardizing. OpenTelemetry’s GenAI SIG is defining semantic conventions for agents so telemetry is not locked to a vendor’s format, and that telemetry doubles as a feedback loop for evaluation. The third pillar is grounding: enterprise knowledge graphs and a semantic layer get positioned as the anti-hallucination control that wraps a probabilistic model in deterministic, auditable logic. None of this is new territory here. I have written about the state and durability layer, the access-control and audit problem, and the audit trail as a security boundary. What is new is that these are being treated as one category, and the category now has a name.

There is one definitional wedge I reach for when the hype gets loud, and it lets me stay skeptical without being anti-agent. Anthropic’s guidance draws a line between workflows, which are predefined code paths, and agents, which are model-directed. A lot of what gets called agentic in enterprise decks is actually a workflow with a model filling in parts of it. That matters because it means the infrastructure panic is partly premature. If most deployments are workflows, most of them do not need the full control plane yet. The gap is real for the genuinely agentic minority, and those are the deployments that can reach systems they should not be able to touch.

The caveats are easy to state. Gartner’s projections that 40% of enterprise apps will carry task-specific agents by the end of 2026, and that more than 40% of agentic projects will fail by 2027, are forecasts, not measurements. The Deloitte figures are a survey. The Cloud Security Alliance white paper is labeled a draft as of 27 March 2026, and its strongest numbers are aggregated from third-party research. I am not going to dress any of this up as audited. It is direction, and the direction is consistent from every source.

The bottom line is simple enough to state without a vendor bet. The model stopped being the binding constraint first, and the value is now in the harness around it. What changed in 2026 is that the harness got a name and a set of incidents. The name is the control plane. The incidents are the MCP CVEs. Least privilege at the tool level, tracing by default, and a clear answer to who can write to what cost less than a failed pilot. They are the difference between an agent you can hand a consequential task and one you cannot.

Sources