The Control Plane Era: What WSO2's Open-Source Agent Governance Bet Means for Enterprise AI Buyers

Every enterprise that has deployed more than a handful of AI agents has run into the same wall: nobody quite owns them. Security teams don’t have a clean way to authenticate them. Compliance can’t produce an audit trail of what they touched. IT can’t even produce a reliable inventory of how many are running. On September 15, 2026, WSO2 pushed its Agent Manager to general availability, and the interesting part isn’t the product tour — it’s the architectural bet underneath it: agent governance should live in its own layer, entirely separate from the agent’s own code, so a company can swap models, frameworks, or vendors without rebuilding its controls from scratch every time.

That bet has a name now — the “agent control plane” — and Forrester published a landscape evaluation of the category in Q2 2026, naming WSO2 among 33 vendors building toward it. This post looks at why that separation matters, what WSO2 actually shipped, and what it should change about how you evaluate agent infrastructure, whether or not you ever touch this specific product.

The Problem: Governance Bolted On Doesn’t Scale

Most companies didn’t set out to have an agent sprawl problem. It happened the way technical debt always happens — one team stood up a customer-support agent, another wired an agent into its CRM workflow, a third let a SaaS vendor’s embedded agent read from a shared database, and within eighteen months nobody had a full list.

Gartner’s numbers on where this is headed are stark. The firm projects that an average global Fortune 500 enterprise will be running more than 150,000 AI agents by 2028, up from fewer than 15 in 2025. Growth on that curve isn’t a rounding error away from today’s operations — it’s a different category of problem, closer to what happened when server counts exploded and forced the shift from managing individual machines to managing fleets through orchestration layers.

The governance side hasn’t kept pace. Gartner also found that only 13% of organizations believe they have adequate governance in place for the agents they’ve already deployed — before the 150,000-agent future even arrives. That gap is exactly what shows up in the numbers on stalled projects: Gartner separately forecasts that more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and insufficient risk controls as the leading causes — not model quality.

That last point is worth sitting with. Enterprises aren’t abandoning agent projects because the underlying models can’t do the work. They’re abandoning them because nobody can answer basic questions: which agent has access to what, who approved that access, what happens when it’s compromised, and how do you prove any of that to an auditor. This is the same territory we covered when 94% of enterprises told researchers they were losing control of their own AI agents — the difference now is that a concrete product category has formed around fixing it.

What WSO2 Actually Shipped

WSO2 Agent Manager moved from beta (launched in June 2026) to general availability on September 15, 2026, adding three capabilities that weren’t in the beta build:

MCP-level governance

The Model Context Protocol (MCP) has become the default way agents discover and call tools, but that convenience cuts both ways — an MCP server is also a new, often unmonitored entry point into enterprise systems. Agent Manager’s GA release adds governance controls at that layer specifically, rather than only at the agent’s top-level API.

Per-agent, per-environment identity

This is the architectural core of the release. WSO2 co-developed an OAuth 2 extension for MCP built on an OpenID Foundation whitepaper on identity management for agentic AI. The premise is simple to state and hard to retrofit: an agent needs a verifiable, machine-readable identity of its own — not a borrowed human credential or a shared API key — before it should be allowed to act on another system. It’s the same logic that pushed enterprise IT toward per-service identities for microservices a decade ago, applied now to software that makes its own decisions about what to do next.

A sandboxed runtime with real-time suspension

Rather than only logging what an agent did after the fact, the GA release can suspend an agent mid-task in a sandboxed runtime when it violates policy. That distinction — detection versus interruption — is exactly the gap that shows up when an AI agent makes a mistake and a company has to sort out the legal and operational fallout after the fact rather than during it.

Underneath those three additions, Agent Manager ships more than 40 built-in guardrails (PII masking and rate limiting among them), end-to-end OpenTelemetry tracing, and support for the frameworks enterprises are actually using in production — LangChain, CrewAI, Amazon Bedrock’s Strands, and Microsoft’s Agent Framework. It’s released under the Apache 2.0 license, deployable self-hosted or as managed SaaS, and WSO2 has positioned itself as a member of the Agentic AI Foundation, the industry body coalescing around shared agent infrastructure standards.

“Speed and control get treated like a tradeoff,” WSO2’s Chief AI Officer Dr. Rania Khalaf said of the release. “They shouldn’t be.”

Why the Separation Is the Actual News

It’s tempting to read this as one vendor’s feature list. The more useful read is architectural. WSO2’s framing — governance as a control plane, decoupled from the agent’s own logic — mirrors a pattern enterprise infrastructure has been through before: the same shift that moved network policy out of individual applications and into firewalls and service meshes, or that moved access control out of individual databases and into centralized identity providers.

Applied to agents, decoupling buys you something specific: you can change the model powering an agent, swap the framework it’s built on, or move it from one cloud to another, without rebuilding the guardrails, the audit trail, or the access policy from scratch. Given how fast the underlying model layer is moving — a topic we’ve tracked as enterprises increasingly hedge against single-vendor AI bets — that portability isn’t a nice-to-have. It’s the difference between a governance investment that survives your next model migration and one you rebuild every time you switch providers.

It also reframes identity as the load-bearing piece. We’ve written before about the scale of the non-human identity problem — organizations where AI agents already outnumber human employees by more than 100 to 1. A control plane is only as good as the identity layer underneath it; without a verifiable way to say “this specific agent, in this specific environment, is authorized to do this specific thing,” every other governance feature is enforcing rules against an unreliable premise.

What This Means for Enterprise AI Buyers

Regardless of whether WSO2’s specific product is the right fit for your stack, its architecture points to questions worth adding to any AI agent procurement checklist:

• Is governance coupled to a specific model or framework? If switching your underlying LLM means rebuilding your access policies, you’ve bought a feature, not infrastructure.
• Does the vendor support open standards for agent identity? The OAuth 2/MCP identity work WSO2 co-authored with the OpenID Foundation is becoming a reference point industry-wide — vendors ignoring it are asking you to bet on a proprietary alternative.
• Can policy violations be interrupted in real time, not just logged? Detection after the fact is forensics. Suspension mid-task is governance.
• Is there a real audit trail an external party can review? OpenTelemetry-based tracing that produces the same evidence for a customer-support agent as for a finance-adjacent one is what turns “we have oversight” into something you can actually show an auditor or regulator.
• Who’s accountable when the agent is wrong? Tooling helps, but it doesn’t replace the operational and legal groundwork of deciding in advance who signs off on what an agent is allowed to do.

None of this requires picking WSO2 specifically. It requires recognizing that “governance” has stopped being a slide in a vendor’s pitch deck and started being a distinct piece of infrastructure you should be evaluating on its own terms — separately from whichever model or agent framework your teams are excited about this quarter.

Conclusion: Buy the Layer, Not the Feature

The 40% project-cancellation rate Gartner is forecasting isn’t a verdict on whether agentic AI works. It’s a verdict on whether most enterprises have built the operational scaffolding to run it safely at scale. WSO2’s move to general availability is one vendor’s answer to that gap, but the shape of the answer — an open, framework-agnostic control plane with agent-native identity at its core — is likely to outlast this specific product cycle.

If you’re currently running agents with governance stitched together ad hoc — a script here, a manual review there, a spreadsheet tracking what’s deployed — the actionable takeaway isn’t “go buy a control plane.” It’s narrower and more useful: audit whether your current governance approach survives a model or framework switch intact. If it doesn’t, you’re not managing agent risk — you’re managing it until your next migration, at which point you start over. That’s the real cost the control-plane vendors are betting enterprises will finally stop tolerating.

Frequently Asked Questions

What is an “agent control plane,” in plain terms?

It’s a governance layer that sits outside an AI agent’s own code and manages its identity, permissions, monitoring, and policy enforcement centrally — similar to how a service mesh manages network policy for microservices rather than each application handling it independently.

Is WSO2 Agent Manager only for companies already using WSO2 products?

No. It’s released under the Apache 2.0 open-source license and is explicitly framework-agnostic, with support for LangChain, CrewAI, Amazon Bedrock Strands, and Microsoft’s Agent Framework, among others. It’s designed to sit alongside whichever agent stack a company already has.

Why does agent identity matter more than it sounds like it should?

Because most enterprise security models assume a human — or at least a fixed, well-understood service account — is behind every action. Agents act autonomously and can chain actions together in ways a static API key was never designed to authorize or audit. A verifiable, agent-specific identity is what makes it possible to know which agent did what, and to revoke its access without affecting anything else.

Does adopting a governance layer slow agents down?

It can if implemented poorly, but that’s the tension WSO2’s Chief AI Officer was pointing at directly — the goal of decoupling governance from agent logic is to enforce policy without requiring every development team to rebuild controls for every project, which is what actually tends to slow things down in practice.

Is the 40% agentic AI project cancellation figure about all AI, or specifically agents?

Specifically agentic AI projects — systems where AI takes autonomous, multi-step action rather than just generating a response. Gartner’s forecast, published in 2025, attributes the cancellations to escalating costs, unclear business value, and insufficient risk controls, not to the underlying models being incapable of the tasks.

What should a company do this quarter if it doesn’t have a control plane yet?

Start with an inventory: an honest list of every agent in production, what it can access, and who owns it. That step — which Gartner’s own six-step guidance places second, right after setting baseline policy — is usually where the biggest gaps surface, well before any tooling decision needs to be made.

Sources

• WSO2 Agent Manager Brings Sovereign AI Governance to Enterprise Agent Sprawl - Official press release on the general availability launch, features, and executive quote.
• WSO2 defines identity, governance & scale for AI agents - Technical breakdown of the OAuth 2/MCP identity extension and open standards foundation.
• WSO2 Ships an Open-Source Control Plane, Formalizing Agent Governance as Infrastructure - Analysis of the control-plane architecture pattern and industry positioning.
• Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 - Original Gartner forecast and analyst commentary on causes of project cancellation.
• By 2028, an Average Global Fortune 500 Enterprise Will Have Over 150,000 Agents in Use - Coverage of Gartner’s agent-sprawl forecast and governance-readiness statistics.
• Gartner Predicts AI Agent Sprawl and Outlines Prevention Steps - Coverage of Gartner’s six-step governance framework and the 150,000-agent, 13%-readiness statistics.