Platform choice is the governance decision. Whatever builders reach for by default becomes the only enforcement point a firm actually has, and paved roads beat policing, because the alternative is per-build review of artifacts that cannot be reviewed.
Why this matters
This dimension is load-bearing rather than a procurement exercise because application governance assumed a release that could be gated, and agents remove it: behaviour is generated at runtime, the tool set changes after approval, and the same input takes different paths on different runs. The mechanism is in why agents break application governance. Whatever used to be caught by reviewing an artifact now has to be supplied by the environment the artifact runs in.
Four independent groups have converged on the same architecture under different names: registry plus observability plus policy enforcement. That convergence is the argument of the agent control plane. Convergence from independent directions is the strongest evidence available in a field this young, and it is the reason this wiki treats the control plane as settled while treating most vendor claims about it as unproven.
The zone model is the part a firm can buy today rather than build. Microsoft ships graduated environments in its own Copilot Studio guidance, which matters less as an endorsement than as a fact about builders: they will meet zones as product documentation whether or not a policy exists. Making tiers physically real, with different connectors, different credentials and different sharing defaults per zone, is what turns a promotion gate from a meeting into a border; see three-zone architecture.
Two warnings that cost firms money when skipped.
The governance layer is often a paid tier. On the leading low-code platform, the managed environments that carry sharing limits, per-environment data policies and pipelines require standalone premium licences, and every active user in such an environment needs one. A firm on bundled licences cannot switch governance on without moving makers and their users to premium SKUs. Details and the enforcement gaps are in low-code agent platforms.
Paved roads need paving. The one well-documented citizen-platform investment in our sources is a feature store built to make curated data reusable across professional and citizen builders, described in 2023 as offering more than 26,000 features (the count comes from one author’s reporting in two outlets, not from the firm, and should be read as dated rather than current). The transferable lesson is that the platform’s value was pre-built assets people preferred to use, not a rule that stopped them. Provisioning bundles security and vendor management from the start, the same argument reached independently from a case study of industrial-scale AI democratization, where IT’s contribution was the governed platform rather than the gate.
Investment intent is running ahead of capability: 76% of 603 respondents expect to invest in platforms for deploying agents in core processes within two years, while 8% had implemented enterprise orchestration. Those figures are directional only: sponsored by two vendors selling that category, screened to agentic-curious organizations, smallest size band 100–999 employees. The sharpest honest framing of the gap comes from a McKinsey partner rather than any survey: firms rolled out tools without productizing use cases, redesigning workflows, or building the platforms and guardrails to run them at scale.
Where you stand
| Level | Looks like | Cheapest next move |
|---|---|---|
| Crawl | Builders use personal accounts and consumer tiers. No sanctioned platform, or one nobody prefers. | Sanction one platform and make it faster than the alternative for the top three use cases. Speed is the control. |
| Walk | One platform, default settings, governance features unlicensed or unconfigured. Everything runs in one environment. | Price the governance tier before you need it, then separate a production environment from the sandbox. |
| Run | Environments separated by tier, a gateway in front of models and tools, registry populated automatically from the platform. | Route new makers into the policy-enforcing environment at first login rather than detecting them later. |
| Fly | Policy-as-code, templated agent identities, zone transitions enforced by the platform rather than by a reviewer’s memory. | Test that a zone transition actually changes what the agent can reach — most don’t. |
Concerns this dimension covers
- Agent sprawl — the population the platform either registers or loses.
- Quality debt and orphaned apps — classic citizen-development debt, now holding production credentials.
- Resource overload and runaway cost — the looping agent that burns the quota, which the platform is the only place to bound.
- Tool and supply-chain compromise — what arrives through the connector catalogue the firm enabled.
Controls that answer them
- Cost controls — budgets and metering as blast-radius limits.
- Sandboxing and isolation — what the platform actually runs inside, which is usually less than the team assumes.
- Runtime guardrails and policy enforcement — enforcement out of process, not inside the agent.
- Built as: three-zone architecture, the agent control plane, and for the highest-stakes cases dual-LLM quarantine.
- Grounded in: Model Context Protocol — the integration layer the platform choice inherits.
Who sells it
- Enterprise AI assistant platforms — the buy-side default; the enterprise bar does not discriminate between them.
- Low-code agent platforms — where citizen builders actually are, and what their governance features cost.
- AI gateways (and MCP gateways) — the enforcement point the control plane needs.
- Agent runtime security — a category with no credible leader yet, which is itself a finding.
Sequencing and where this is checked
- Day 3 sequencing — which platform layer to stand up when, and what to refuse to buy on day 1.
- Build vs buy — the decision this dimension turns on.
- Promotion gates — the zone transition the platform enforces.
- Registry review cadence — where platform drift surfaces.
Open questions
- No platform in our research enforces zone transitions end to end without custom glue. A platform claimed to do so is worth testing against the agent control plane.
- Whether gateway-level enforcement holds when agents spawn sub-agents on their own credentials is unresolved; see multi-agent cascades.