Lyzr Research · October 2026 · A 35 minute read
The agent control plane, mapped.
Who sells it, what it really controls,
and how to choose.
A control plane is the one place that can see every agent, whoever built it, meter what each one costs and record what each one did. We mapped 36 products from eight starting points and scored 17 of them on seven capabilities.
To whoever has to choose one
Every vendor now sells a control plane. Each one started somewhere different.
The market formed in a year.
Google, Okta, Microsoft and ServiceNow each shipped or widened one between April and May 2026, and Palo Alto Networks bought its way in.
Each one controls what it was built to control.
A cloud console is deepest on its own cloud. An identity vendor is deepest on who an agent is. A gateway is deepest on the call.
Almost none can say what an agent cost.
The two numbers a business asks for, what an agent costs and what it earned, sit in different products, when they sit anywhere.
This is the one that matters
We mapped 36 products from eight starting points and scored 17 on seven capabilities. The honest answer to which one to buy depends on where your agents live. For a Microsoft shop it is Microsoft. For a mixed or sovereign estate it is a neutral layer. This report says which, and why, and where Lyzr fits and does not.
Lyzr Research, October 2026
If you read nothing else.
- The market formed in a yearGoogle, Okta, Microsoft and ServiceNow all shipped agent control planes between April and May 2026. Palo Alto Networks, Cisco, Check Point and ClickHouse bought their way in.
- Each started somewhere differentEight starting points, from cloud consoles to identity vendors to gateways. Each is deepest where it began, and none documents more than four of seven capabilities at full strength.
- The bill is the missing joinSpend tripled to $37 billion in 2025 and tokens are the wrong unit. The products that know who owns an agent rarely meter cost, and the ones that meter cost rarely know the owner.
- Choose by where your agents liveOne ecosystem, use its console. Mixed, sovereign or air-gapped, add a neutral layer. Just starting, a gateway and a list will do.
- Test, do not readA two-week bake-off with five tests tells you more than any scorecard, including this one. Lyzr Opencontroller is one candidate, and its row here is capped at half marks.
What this covers
Five parts. One map.
2022 to 2026
The bill
Why unit prices fell while spend rose, why agents multiply tokens, and the six places a task’s money goes.
The attribution gap
Why nobody can read it
Why cheaper models and better surveys do not put a name on a dollar, the three ledgers, and the unit that matters.
36 products
The landscape
Eight starting points, who bought whom, and 17 products scored on seven capabilities.
By estate
Choosing
Seven estates, an interactive picker, and a two-week bake-off.
One candidate
Lyzr’s Opencontroller
What Lyzr’s open control plane does, where it fits, and where it does not.
The bill.
Unit prices fell. Total spend did not. Agents are the reason.
This part follows the money. GPT-3.5-level inference fell 280 times in two years, yet enterprise spend on generative AI tripled in 2025, and one agent task can use up to thirty times the tokens of a chatbot reply. By the end you will know the six places a task’s cost goes.
Software was billed per seat. Agents are billed per step, and the market is moving toward per outcome.
Per seat
The software era
The bill moved with headcount. It was easy to attribute to a team, and it said nothing about whether the software was used.
Per token
The model era
Providers charge per million tokens, with output priced above input. The bill moves with every call and names an account, not an agent.
Per action
The agent era
Platforms meter agent steps. Salesforce moved Agentforce from $2 per conversation to credits at about $0.10 per action.
Per outcome
The direction
Intercom charges $0.99 per outcome. The vendor carries the cost of the attempt, and the buyer has to verify the result.
Intercom Fin pricing page. Salesforce Agentforce published pricing, 2024 to 2026, as reported. Prices change.
Menlo Ventures, December 2025
Enterprise spend on generative AI tripled in a single year.
What enterprises spent on generative AI in 2025, up from $11.5 billion in 2024
That is 3.2 times in twelve months, across model APIs, infrastructure and applications. Spend was $1.7 billion in 2023.
From $1.7 billion to $37 billion in two years
Menlo Ventures, 2025 State of Generative AI in the Enterprise, December 2025.
Stanford AI Index, 2025
The price of GPT-3.5-level inference fell by a factor of 280 in two years.
Fall in the cost of GPT-3.5-level inference between November 2022 and October 2024
From about $20 per million tokens to about $0.07. The unit price is the number everyone watches, and it moved in the direction everyone hoped.
The unit price fell. The bill did not
Stanford HAI, AI Index Report 2025.
The part nobody budgeted for
Cheaper tokens did not shrink the bill. They enlarged what people ask for.
Every efficiency gain in computing has been spent on doing more. Cheaper tokens bought longer context, more reasoning steps, more tools and more agents. Gartner expects inference on a trillion-parameter model to cost providers over 90% less by 2030 than in 2025, and says those savings will not be fully passed on to enterprise customers.
Instrument 01 of 09 · A model worth borrowing
Jevons paradox
William Stanley Jevons, The Coal Question, 1865
When a resource is used more efficiently, total consumption of it tends to rise.
Why it matters here
Jevons saw steam engines become far more efficient while Britain burned more coal, because cheaper power found more uses. The pattern recurs wherever demand stretches. Tokens are the cleanest current case. Each fall in price made long contexts, multi-step reasoning and multi-agent designs affordable, and each of those spends more tokens than the last. Waiting for prices to fix the bill means waiting on the very force that enlarges it.
William Stanley Jevons, The Coal Question, 1865.
Gartner, March 2026
A single agent task can use up to thirty times the tokens of a chatbot reply.
Upper end of Gartner’s range for tokens per task, agentic versus a standard chatbot. The lower end is 5 times.
Anthropic’s own data points the same way, with agents using about 4 times the tokens of chat and multi-agent systems about 15 times. The extra tokens come from reasoning loops, tool calls and a growing context that is read again at every step.
Per task, and not per reply
Gartner press release, March 25, 2026. Anthropic Engineering, How we built our multi-agent research system, June 2025.
Six places
A task’s cost has six parts, and the model invoice holds only some of them.
- Model calls, with input and output priced separately and output priced higher.
- The context the agent reads again at every step, billed as input each time.
- Retries and loops when a step fails or the plan changes.
- Tool calls and retrieval, which sit on other systems’ meters.
- Human review and rework after the answer, which sits in payroll.
- Platform fees, credits and minimums on top of everything else.
A chatbot spends tokens once. An agent spends them on every step.
| A chatbot reply | An agent task | |
|---|---|---|
| Model calls | One | A chain, one per step |
| Context | Short, sent once | Grows, and is sent again at each step |
| When it goes wrong | A poor answer | Retries, loops and rework |
| Who checks it | The reader | A person or a second model |
| What drives the bill | Length of the answer | Input read again and again |
| Cost per request | Predictable | Varies with how the task unfolds |
Nearly everyone manages AI spend. Few can say what it returned.
Now manage AI spend
FinOps Foundation, 2026
Up from 31% in 2024
Call themselves fully mature at it
Harness, 2026
About one in five
Have a robust way to measure business value
Harness, 2026
About one in four
Say anticipating AI spend is guesswork
Harness, 2026
More than half
Harness is a vendor. The FinOps Foundation figure is a practitioner survey.
FinOps Foundation, State of FinOps 2026. Harness, State of AI in FinOps 2026. Cited as published.
What finance actually sees
The bill arrives as one line from one provider, and nothing on it names an agent.
A model provider invoices the account. Suppose three teams run forty agents. They show up as a single number. Finance sees growth. Nobody can say which agent grew, whether it should have, or who decided.
Six ways you are charged, and what each one hides.
| How it bills | What it hides | |
|---|---|---|
| Per seat | A fixed amount per user each month | Whether anyone uses it |
| Per token | Per million tokens, input and output separately | Which agent made the call |
| Per action | Credits for each step an agent takes | What the step achieved |
| Per outcome | A fee for each resolved case | What counts as resolved |
| Committed spend | A volume agreed in advance for a discount | Whether the commitment is used well |
| Platform fee | A flat charge for the platform itself | How much of it is agent cost |
Anthropic published pricing, October 2026
Price per token differs by a factor of one hundred inside a single provider’s list.
Spread in price per million input tokens between the cheapest and the most capable Claude model, $0.10 against $10
Haiku 5.5 is listed at $0.10 input and $0.50 output for prompts up to 100,000 tokens. Fable 5.1 is $10 and $50. Sonnet 5.5 at $2 and $10 and Opus 5.5 at $4 and $20 sit between them. Which model an agent calls is a choice made by whoever built it, and it is often made once.
The choice of model is a spending decision
Anthropic, Claude pricing, October 2026. Prices change.
Why nobody can read it.
The standard answers are cheaper models and better surveys. Both leave the dollars without names.
Model spend lands on one invoice, what an agent did sits in traces, and the return is an estimate held by the business. Three ledgers hold the answer, and no two share an identifier. This part shows why that join is the missing piece, lets you price a completed task with your own numbers, and borrows three old ideas that explain why the problem persists.
The argument of this report
Cheaper models and better surveys are the standard answers. Neither puts a name on a dollar.
Negotiating a lower price per token shrinks the invoice and leaves it as unreadable as before. Surveying people about hours saved produces a number that no finance team can reconcile to a ledger. Both approaches work at the level of the whole program. Neither works at the level of one agent, which is the only level where a decision to keep or stop can be made.
Three ledgers hold the answer, and no two of them share an identifier.
Ledger one
What you paid
The model invoice and the platform fees. Held by procurement and finance. It names an account, not an agent.
Ledger two
What it did
Traces of calls, tools and results. Held by the team that built the agent, if anywhere. It names an agent and rarely an owner.
Ledger three
What it returned
Savings and revenue, estimated after the fact. Held by the business or the vendor. It names a function, not an agent.
What has to change
Cost per outcome needs one agent identifier on all three ledgers.
Put one identifier on every model call, every trace and every outcome record, and cost per completed task becomes arithmetic. Leave it off and no later analysis can recover it, because the information was never captured. This is why the work has to happen where calls are made, and not in a spreadsheet afterward.
Instrument 02 of 09 · A model worth borrowing
The tragedy of the commons
Garrett Hardin, Science, 1968
A resource that everyone can draw on and nobody answers for will be used up.
Why it matters here
Hardin described herders sharing a pasture. Each gains the full benefit of one more animal and bears only a fraction of the damage, so each adds one. A shared inference budget behaves the same way. A team gets the whole benefit of another agent and sees none of the invoice, because the invoice arrives as one line for everyone. Nobody is careless. The structure rewards using more. Putting each team’s name on its own spend changes the incentive without changing the people.
Garrett Hardin, The Tragedy of the Commons, Science, 1968.
FinOps Foundation, State of FinOps 2026
FinOps absorbed AI spend in two years, and it started with allocation.
Share of practitioners who now manage AI spend, up from 63% in 2025 and 31% in 2024
The FinOps framework runs Inform, then Optimize, then Operate, and Inform means allocation first. Cloud cost management learned that nobody can reduce a cost they cannot assign. AI spend is being folded into the same practice, often before the tooling exists to attribute it.
Attribution comes before optimization
FinOps Foundation, State of FinOps 2026. FinOps Framework.
Your arithmetic
What does one completed task really cost?
Six inputs, all yours. The formula is printed underneath, so you can check it or use your own numbers.
Cost per completed task
On these inputs, the model invoice shows 7% of the cost.
($0.16 MODEL + $2.00 REVIEW) / 67% SUCCESS
Cost per completed task equals the cost of one attempt, model plus review, divided by the share of attempts that succeed. Illustrative inputs, not a benchmark.
The unit that matters
A cheaper model can cost more per task than a dearer one.
Tokens bill on every attempt. Value lands only on the successes. So the cost of a completed task is the cost of one attempt divided by the success rate, plus the time a person spent checking it. A model that is half the price per token and half as likely to get it right costs the same per task, before anyone reviews the failures. Below half, it costs more.
Instrument 03 of 09 · A model worth borrowing
Simpson’s paradox
Edward Simpson, 1951
A trend in the whole can reverse inside every group that makes it up.
Why it matters here
Suppose cost per task is falling on the dashboard. It can fall because more of the work is easy, while the cost of every kind of task is rising. The average reports on the mix as much as on the cost. An organization that watches only the blended number will congratulate itself while each agent gets dearer. The check is to report cost per task by agent and by task type, which needs the identifier again.
Edward Simpson, The Interpretation of Interaction in Contingency Tables, 1951.
Read the definition
Outcome pricing moves the argument to the definition of an outcome.
Intercom counts an outcome when the customer confirms resolution, stops asking after Fin answers, or Fin completes a workflow including a handoff. Each is a reasonable definition. None is your definition of value. Before accepting a price per outcome, write down what counts, and check it against your own records.
Instrument 04 of 09 · A model worth borrowing
The market for lemons
George Akerlof, Quarterly Journal of Economics, 1970
When buyers cannot verify quality, they pay the average price, and the good sellers leave.
Why it matters here
Akerlof showed that when used-car buyers cannot tell a good car from a bad one, they offer the average price, and owners of good cars stop selling. Return claims for AI work the same way. If a buyer cannot verify a claimed saving, every claim sounds alike, honest ones are discounted with the rest, and the boldest number wins. A buyer with a baseline and an agent identifier can check the claim, and that breaks the pattern.
George Akerlof, The Market for Lemons, Quarterly Journal of Economics, 1970.
Return claims fail in five predictable ways, and each has a fix.
| Why it happens | What closes it | |
|---|---|---|
| Hours counted as dollars | Time freed is only money once somebody removes the work or puts the time to a use that earns. | Count only capacity that was removed or redeployed, and have the budget owner sign the conversion. |
| Pilot cost used for production | A pilot runs with builders watching and a few users. Production adds volume, retries, review and fees. | Measure cost per task on production traffic, review time included. |
| The same saving claimed twice | The team that built the agent, the function that uses it and the vendor can each count it. | One named owner per agent claims the value, and finance reconciles claims quarterly. |
| Usage reported as outcomes | Prompts sent and licenses activated are easy to count. MIT’s 2025 NANDA study reported 95% of pilots showed no measurable P&L impact. | Report outcomes completed, with one defined unit of work per agent. |
| No baseline | Nobody measured the work before the agent arrived, so any improvement is an assertion. | Measure cost, time and error rate for a few weeks first, and keep the baseline with the agent record. |
The landscape.
Every large vendor now sells a control plane, and each one started somewhere different.
We mapped 36 products from eight starting points, from cloud consoles to identity vendors to gateways to governance programs. The part opens with who has been buying whom, then scores 17 products on seven capabilities from public documentation, and ends with what the standards underneath mean for lock-in.
Since late 2025, security, data and cloud vendors have bought their way into the control plane.
| Buyer | Bought | Closed | What it added |
|---|---|---|---|
| Palo Alto Networks | CyberArk | February 2026 | Identity security for human, machine and agent identities. |
| Palo Alto Networks | Portkey | May 2026 | An AI gateway for its Prisma AIRS platform. |
| ClickHouse | Langfuse | January 2026 | Open-source tracing and evaluation for LLM applications. |
| Check Point | Lakera | October 2025 | Runtime security for LLM and agent traffic. |
| Cisco | Galileo | May 2026 | Evaluation and observability for AI systems, as reported. |
| ServiceNow | Traceloop | 2026 | Runtime observability for agents, as reported. |
| CoreWeave | Weights & Biases | May 2025 | Experiment tracking and agent tracing. |
Dates are closings or announcements as reported. Check the acquirer’s own release before relying on one.
The map
A control plane gets sold from eight different starting points.
Cloud platforms
Built to run agents
Workflow and integration
Built to move work
Identity
Built to say who is who
Security
Built to stop attacks
Gateways
Built to proxy calls
Observability
Built to trace runs
Governance
Built for auditors
Independent
Built to sit across all of it
Lyzr Research. 36 products named from vendor documentation and announcements, October 2026.
Cloud platforms. Three consoles, each deepest on its own cloud.
| Product | What shipped | Strongest when | Stops short |
|---|---|---|---|
| Microsoft Agent 365 | Registry, an Entra identity for every agent, and Defender and Purview controls. Generally available May 1, 2026. | Agents live in Microsoft 365, Copilot Studio or Azure. | Outside agents need onboarding through its SDK. Multi-cloud discovery was still in preview. |
| AWS Bedrock AgentCore | Runtime, Gateway, Identity, Cedar policy, observability and a registry. Generally available since October 2025. | Agents run on AWS. The Gateway can also front MCP servers hosted elsewhere. | The registry catalogs agents and does not run them. Governance centers on AWS. |
| Google Gemini Enterprise Agent Platform | Agent Identity, Agent Registry and Agent Gateway with Model Armor. Launched April 2026 as the successor to Vertex AI. | Agents run on Google Cloud. | Agent Gateway was in private preview at launch, and MCP governance was still being wired in. |
Workflow and integration platforms. Control planes that grew out of the systems that move your work.
| Product | What shipped | Strongest when | Stops short |
|---|---|---|---|
| ServiceNow AI Control Tower | Widened in May 2026 to discover and govern agents across more than 30 outside systems, with a kill switch and agent observability from Traceloop. | ServiceNow already runs your workflows and approvals. | The widest reach needs the enterprise tier and its connectors. |
| Salesforce Agent Fabric | Salesforce’s own materials call it a trusted agent control plane. Discovery reaches Amazon Bedrock and Microsoft Foundry. | Your estate is built around Salesforce and MuleSoft. | Its fullest controls apply to Salesforce-native agents. |
| IBM watsonx Orchestrate | IBM describes an agentic control plane with a governed catalog, guardrails, policy enforcement and cost monitoring. | The estate is regulated, hybrid or on premises. | Breadth means more to adopt. |
| Boomi Agent Control Tower | Boomi’s agent governance, announced with an Okta for AI Agents integration. | Boomi already integrates your systems. | We found little public detail beyond the announcement. |
Identity vendors. Every agent gets a badge and an off switch.
| Product | What shipped | Strongest when | Stops short |
|---|---|---|---|
| Okta for AI Agents | Generally available April 30, 2026. Registers known and unknown agents, adds an agent gateway on a virtual MCP server, and a kill switch. | Okta is already your identity system. | Identity and access only. It does not meter model spend. |
| Microsoft Entra Agent ID | The identity layer under Agent 365, with conditional access and access reviews for agents. | You run Microsoft 365 and Entra. | Several controls need Entra P1, P2 or Governance licenses. |
| CyberArk | Privileged access and machine identity. Now part of Palo Alto Networks, since February 11, 2026. | Secrets and privileged access are the main worry. | Still being integrated into the Palo Alto platform. |
| SailPoint | Reported to map one identity graph across more than 1,000 kinds of non-human identity. | Identity governance is already a SailPoint program. | We could confirm this only through secondary reports. |
Security platforms. The buyers in the consolidation, and the specialists they have not bought yet.
| Product | What shipped | Strongest when | Stops short |
|---|---|---|---|
| Palo Alto Networks Prisma AIRS | Added Portkey as its AI gateway, closed May 29, 2026, alongside Protect AI for model security and CyberArk for identity. | Security leads the program. | Several acquisitions are still being integrated. |
| Cisco AI Defense | Built on Cisco’s purchase of Robust Intelligence, with later deals reported for Astrix and Galileo. | Cisco already runs your network and security. | Product lines are still being merged. |
| Check Point with Lakera | Lakera, a runtime guard for LLM and agent traffic, joined Check Point in October 2025. | Check Point is your firewall vendor. | Narrow focus on runtime protection. |
| CrowdStrike | Bought Pangea for AI guardrails and SGNL for continuous authorization, as reported. | Endpoint security is your anchor. | Agent controls are new to the platform. |
| Zenity | Runtime protection and observability for agents. Still independent. | Runtime defense is the immediate worry. | Narrower than a full control plane. |
| Noma Security | Agent security posture, funded by a $100 million Series B in July 2025. | Posture management is the first need. | A specialist, so it needs partners for the rest. |
Gateways. A meter on every model and tool call, much of it open source.
| Product | What shipped | Strongest when | Stops short |
|---|---|---|---|
| Kong AI Gateway | AI plugins on the Kong API platform, with an MCP proxy since Gateway 3.12. The core is Apache 2.0 and the AI features are enterprise. | You already run Kong. | Standing up Kong only for LLM traffic is heavy. |
| Solo.io agentgateway | A Rust data plane for LLM, MCP and A2A traffic, under the Linux Foundation. Apache 2.0. | Your platform team is Kubernetes native. | Young. Commercial support comes through Solo. |
| LiteLLM | An MIT-licensed proxy with virtual keys, team budgets and an MCP gateway with permissions by key and team. | You want a self-hosted default and have engineers to run it. | Needs Postgres and Redis. Regulated teams add controls around it. |
| TrueFoundry | A Kubernetes-native platform with LLM, MCP and agent gateways, deployable as SaaS, VPC, on premises or air-gapped. | You want gateway, serving and budgets in one platform. | A broad platform, so more to adopt. |
| Cloudflare AI Gateway | A managed edge gateway with caching, spend limits and analytics. | You want the fastest managed start. | No self-hosted path, and MCP governance sits in a separate product. |
| Databricks Unity AI Gateway | Governs model traffic inside Databricks, including external models. | Your data and models already live in Databricks. | Scoped to Databricks. |
Observability. Good tracing, now mostly owned by someone else.
| Product | What shipped | Strongest when | Stops short |
|---|---|---|---|
| Langfuse | Open-source tracing, evaluation and prompt management, MIT licensed. ClickHouse acquired it in January 2026. | You want to self-host and own the data. | Its roadmap now sits inside ClickHouse. |
| LangSmith | LangChain’s platform for tracing, evaluation and agent deployment. | Your agents run on LangChain or LangGraph. | Proprietary. Self-hosting is enterprise only. |
| Arize Phoenix | Open-source tracing and evaluation built on OpenTelemetry, under the Elastic License. | Your team standardizes on OpenTelemetry. | A source-available license, not Apache. |
| Weights & Biases Weave | Agent tracing from the W&B platform, owned by CoreWeave since May 2025. | Your team already trains models in W&B. | Tied to the CoreWeave roadmap. |
| Braintrust | Evaluation-first tracing with release gates in CI. Raised an $80 million Series B in February 2026. | Evals should gate every release. | Proprietary SaaS. |
| Datadog LLM Observability | LLM tracing inside the APM platform many teams already pay for. | Datadog is already your monitoring system. | Tied to the Datadog platform. |
Governance programs. The record for auditors, now adding runtime controls.
| Product | What shipped | Strongest when | Stops short |
|---|---|---|---|
| IBM watsonx.governance | A Leader in Gartner’s first AI Governance Magic Quadrant, June 2026, as reported. Inventories models and agents built anywhere. | The estate is regulated and hybrid. | Runtime blocking leans on companion products, per buyer guides. |
| Credo AI | Policy-first governance, with an Agent Registry of agent cards in public preview since September 2025. | Risk and policy teams run the program. | It documents and assesses. Blocking sits elsewhere. |
| Holistic AI | Guardian Agents add runtime enforcement. Sentinel agents observe, and Operative agents block, quarantine and kill. | You want testing and runtime oversight in one platform. | No inline MCP gateway, per one buyer guide. |
| OneTrust AI Governance | Added real-time governance and Guardian Agents in March 2026 on its privacy and GRC platform. | OneTrust already runs privacy and risk. | The newest layer on an older platform. |
| ModelOp | Embeds governance in delivery across ML, GenAI and agentic AI. A Gartner Visionary, as reported. | Governance has to live inside the delivery pipeline. | We found less public detail on its agent controls. |
Independent control planes. Built to sit across everything else, or assembled from parts.
| Option | What it is | Strongest when | Stops short |
|---|---|---|---|
| Lyzr Opencontroller | An open control plane announced in 2026. Ten blocks from discovery to refinement, with gateways in your own VPC, on premises or air-gapped. | The estate is mixed, sovereign or air-gapped. | New, and documented on Lyzr’s own pages. Control over agents it did not deploy depends on routing their traffic through its gateways. |
| TrueFoundry | A gateway-led platform that calls itself an AI control plane, covering routing, budgets, observability and audit. | You want a Kubernetes-native platform. | Broader than a control plane alone. Also listed under gateways. |
| Open-source assembly | A gateway such as LiteLLM or agentgateway, traces from Langfuse or Phoenix, identity from your provider, and OpenTelemetry to join them. | You have a strong platform team and want no license fees. | You build and maintain the registry, owner records and stop control yourself. |
Seven capabilities and one test of evidence.
| Column | What we looked for | |
|---|---|---|
| Finds agents it did not build | Discovery of agents on other platforms, clouds or endpoints. | |
| Identity and owner | A unique identity and a named owner for each agent. | |
| Tool and MCP access | Policy on which tools and MCP servers an agent may call. | |
| Cost by agent | Metering of model calls and spend by agent, team or key. | |
| Traces and audit | A record of what each run did that someone else can read. | |
| Stop control | A way to hold, pause or quarantine an agent. | |
| Self-hosted | The product can run inside your own network. | |
| Independent coverage | An analyst report or trade press beyond the vendor’s own channels. |
The rule
A full mark needs two sources, and the vendor’s own page is only one of them.
We scored from public documentation in October 2026. A full mark means the vendor documents the capability and an independent source confirms it, whether an analyst note, trade press or a third-party write-up. A half mark means it is documented but in preview, limited to the vendor’s own platform, or confirmed only by the vendor. We scored 17 of the 36 products, the ones where we could read primary material for each capability. Vendors may do more than they publish, and we invite corrections.
Scored on public documentation, October 2026
Cloud, workflow and identity platforms. Deep on their own ground, and widening.
| Finds agents it did not build | Identity and owner | Tool and MCP access | Cost by agent | Traces and audit | Stop control | Self-hosted | Independent coverage | |
|---|---|---|---|---|---|---|---|---|
| Microsoft Agent 365With Entra Agent ID | ||||||||
| AWS Bedrock AgentCoreGateway, Identity, Policy | ||||||||
| Google Agent PlatformGemini Enterprise | ||||||||
| ServiceNow AI Control TowerEnterprise tier | ||||||||
| IBM watsonxOrchestrate and governance | ||||||||
| Okta for AI AgentsIdentity first |
Full Half Not documented
Lyzr Research. A vendor may do more than it publishes. Preview features score half.
Scored on public documentation, October 2026
Gateways and tracing. They meter well and know little about owners.
| Finds agents it did not build | Identity and owner | Tool and MCP access | Cost by agent | Traces and audit | Stop control | Self-hosted | Independent coverage | |
|---|---|---|---|---|---|---|---|---|
| Kong AI GatewayApache 2.0 core | ||||||||
| Solo.io agentgatewayLinux Foundation project | ||||||||
| LiteLLMMIT licensed proxy | ||||||||
| TrueFoundryKubernetes native | ||||||||
| Cloudflare AI GatewayManaged edge service | ||||||||
| LangfuseNow part of ClickHouse | ||||||||
| LangSmithLangChain |
Full Half Not documented
Lyzr Research. A vendor may do more than it publishes. Preview features score half.
Scored on public documentation, October 2026
Governance programs and the independent entrant.
| Finds agents it did not build | Identity and owner | Tool and MCP access | Cost by agent | Traces and audit | Stop control | Self-hosted | Independent coverage | |
|---|---|---|---|---|---|---|---|---|
| Credo AIPolicy first | ||||||||
| Holistic AIGuardian Agents | ||||||||
| OneTrust AI GovernancePrivacy and GRC platform | ||||||||
| Lyzr OpencontrollerCapped at half. See the rule. |
Full Half Not documented
Lyzr Research. Lyzr documents all seven on its own pages and we found no independent source, so its marks are capped at half.
Reading the grid
No product reaches full marks on more than four of seven, and the join is nobody’s job.
Traces are the most commonly documented capability, at full marks in 7 of 17 products. Tool access, cost metering and stop control are the rarest, at 4 each. The products that meter cost are gateways with little notion of an owner. The products that know the owner meter little cost. None with independent confirmation documents full marks on both, which is the join this report began with. Lyzr documents both on its own pages, and we could verify neither beyond them.
Instrument 05 of 09 · A model worth borrowing
Focal points
Thomas Schelling, The Strategy of Conflict, 1960
When people must coordinate without talking, they converge on whatever stands out as the obvious choice.
Why it matters here
Schelling asked strangers where they would meet in New York with no way to confer. Most named the same place and time, Grand Central at noon. Coordination needs no agreement, only an obvious place to stand. MCP became that place for connecting agents to tools, and moving it under neutral governance let rivals adopt it without ceding ground. A2A is trying to do the same for agents talking to agents. For a buyer, a standard everyone treats as obvious matters more than any single feature, because it decides which products can work together.
Thomas Schelling, The Strategy of Conflict, 1960.
Linux Foundation, December 2025
MCP became the focal point for tool connections, and it now sits under neutral governance.
MCP servers published when the Agentic AI Foundation launched in December 2025
The Linux Foundation formed the Agentic AI Foundation on December 9, 2025, with MCP, Block’s goose and OpenAI’s AGENTS.md as its first projects. Platinum members include AWS, Anthropic, Cloudflare, Google, Microsoft and OpenAI. Google’s A2A protocol also sits under Linux Foundation governance. A control plane that speaks both is less likely to strand your agents.
Neutral governance lowers the risk of betting on a protocol
Linux Foundation announcement, December 9, 2025, as reported by IT Brief.
Instrument 06 of 09 · A model worth borrowing
Exit, voice and loyalty
Albert Hirschman, 1970
When a product declines, customers can leave, complain or stay out of habit, and the first two only work if both are possible.
Why it matters here
Hirschman studied what happens when a firm gets worse. Customers can exit, or use voice and push for change. Both lose force as leaving gets costlier, because a vendor that cannot be left has little reason to listen. A control plane holds your registry, your agent identities, your policies and your traces. If those cannot leave in open formats, exit is theoretical and voice has no teeth. Ask what leaving costs before the first agent is registered, while it is still cheap to find out.
Albert Hirschman, Exit, Voice, and Loyalty, 1970.
Before you sign
Check four exits before you register the first agent.
- Registry. Can you export every agent record, owner and risk tier in an open format?
- Identity. Do agent identities live in your own identity provider, so they stay if the vendor goes?
- Traces. Do runs leave as OpenTelemetry, so another tool can read them?
- Gateways. Can you point endpoints back at the model and tool providers without rewriting agents?
Choosing.
Match the console to where your agents live. Add a neutral layer where the estate is mixed.
Seven kinds of estate get seven different answers, and a short picker will give you ours for yours. The rest of the part covers when to build, assemble or buy, why to adopt one control at a time, five tests for a two-week bake-off, and what a control plane has to beat to pay for itself.
Seven estates, seven answers.
| Your estate | Start with | Add when | Hold off on |
|---|---|---|---|
| Mostly Microsoft | Agent 365 with Entra Agent ID | A model gateway for non-Microsoft models | A second control plane |
| Mostly AWS | Bedrock AgentCore with Gateway, Identity and Policy | A model gateway outside Bedrock | A second control plane |
| Mostly Google Cloud | Gemini Enterprise Agent Platform | Agent Gateway, once it is generally available for you | A second control plane |
| Built on ServiceNow or Salesforce | AI Control Tower, or Agent Fabric with MuleSoft | Identity from your own provider | Another console beside it |
| Mixed clouds and platforms | A neutral layer, plus each platform’s own console | A governance program of record, if audited | A fifth console |
| Regulated, sovereign or air-gapped | Controls you host inside your perimeter | A governance program of record for auditors | Managed services that cannot leave the cloud |
| A handful of agents | A model gateway and a shared list with owners | A control plane when the list stops fitting on a page | Any platform purchase |
Your estate, not ours
Which control plane fits your estate?
Five questions. SaaS suite means ServiceNow or Salesforce. The answer names products beyond Lyzr’s, and says when Lyzr is not the fit.
Our answer for that estate
A neutral layer across platforms, plus each console.
START WITH
One control plane that spans clouds and frameworks. Keep each platform’s own console for its own agents.
ADD
Identity from your own provider. A partner or a vendor-run option suits a smaller team.
WHERE LYZR FITS
A candidate beside ServiceNow AI Control Tower and IBM watsonx Orchestrate. Run a bake-off.
WHAT WOULD CHANGE THIS
One ecosystem growing to dominate the estate.
Lyzr Research. A starting point for a bake-off, not a procurement decision.
Instrument 07 of 09 · A model worth borrowing
The nature of the firm
Ronald Coase, Economica, 1937
Firms do things internally when the cost of buying them in the market is higher.
Why it matters here
Coase asked why firms exist at all, and answered that using the market has costs. You must search, negotiate, integrate and monitor. The boundary of the firm sits where doing it inside costs less than buying it. A control plane carries a high cost of integration, because it has to join identity, models, tools and cost across teams. Assembling it from parts means you pay that cost yourself. Buying it means a license and the vendor’s roadmap. Neither is free, and the answer moves with the size and mix of your estate.
Ronald Coase, The Nature of the Firm, Economica, 1937.
The decision, on one slide
Build, assemble or buy. Each one moves the cost somewhere else.
| Build | Assemble | Buy | |
|---|---|---|---|
| What it is | Your team writes the registry, gateway and traces. | You combine a gateway, a tracer and your identity provider. | You adopt a platform console or a vendor’s control plane. |
| Best when | The estate is unusual and the team is strong. | The estate is mixed and you want no license fees. | One ecosystem dominates, or the team is small. |
| Cost you carry | Everything, for as long as it runs. | The glue that joins identity to cost. | A license, and some lock-in. |
| Speed to first value | Slowest | Middle | Fastest |
| Main risk | A project that never finishes. | Nobody owns the join. | The vendor’s roadmap. |
Speed to first value is our judgment, and not a measurement
Instrument 08 of 09 · A model worth borrowing
Gall’s law
John Gall, Systemantics, 1975
A complex system that works has always evolved from a simple system that worked.
Why it matters here
Gall observed that complex systems designed from scratch seldom work, and that patching never turns them into ones that do. Systems that work started simple and grew. For a control plane this means starting with the one control that is cheap to attach and proves its worth, such as an identifier and an owner on every call. A gateway, then traces, then policy follow. Even a ten-block platform is better adopted one block at a time than switched on at once.
John Gall, Systemantics, 1975.
Test it, do not read about it
Five tests to run in a two-week bake-off.
- Plant an agent nobody registered, and see whether the tool finds it.
- Run one task through two agents, and check that the cost report names each agent and owner.
- Write a policy that refuses one tool call, and confirm the call never lands.
- Stop an agent the tool did not deploy, and time how long it takes.
- Export the registry, the policy and a day of traces, and measure the effort.
Harness, State of AI in FinOps 2026
A control plane has to recover more than it costs, and one survey puts the waste at a quarter of AI spend.
Share of AI spend that respondents to Harness’s 2026 survey estimate is wasted
At $1 million a month, Harness says that is $260,000 with no measurable return. Harness is a vendor and its respondents estimated the figure, so treat it as a prompt for your own measurement. The calculator earlier in this report gives you cost per completed task, which is the number to start from.
Put your own number in this sum
Harness, 2026 State of AI in FinOps. A vendor-run survey of 700 respondents.
Instrument 09 of 09 · A model worth borrowing
Real options
Stewart Myers, 1977, on an idea from financial options
A project is worth more for the right to stop it, and the right is worth something only if stopping is cheap.
Why it matters here
Myers noticed that a company’s investment opportunities behave like options. A pilot is the same. You pay a little to learn whether to commit, and the option is valuable only while you can walk away cheaply. As a control plane gains agents, integrations and dependents, replacing it gets dearer and the option decays. Run the bake-off before the first hundred agents are registered, while changing your mind still costs a week.
Stewart Myers, Determinants of Corporate Borrowing, Journal of Financial Economics, 1977.
Our position
Our position, in four lines.
- One ecosystem holds most of your agents. Use its console, and spend the savings on attribution.
- The estate is mixed, sovereign or air-gapped. A neutral layer earns its place, and Lyzr Opencontroller is one candidate to test against the others.
- You have a handful of agents. A gateway for cost and a shared list for owners is enough.
- Whatever you choose, put one identifier on every call, so what an agent cost and what it earned can finally meet.
Lyzr’s Opencontroller.
One candidate for the mixed, sovereign and air-gapped estate, and an honest account of where it fits.
Lyzr describes Opencontroller as an open control plane that finds, owns, ships, runs and improves every agent, wherever it was built. This part covers its ten blocks, how it checks calls in the path, where it fits and where to look elsewhere, and what a first week could look like.
Lyzr Opencontroller
Opencontroller is Lyzr’s open control plane. It finds, owns, ships, runs and improves every agent.
It is built for a mixed estate. Agents stay on the runtimes where they run today. Opencontroller registers them, observes them, and enforces policy wherever their traffic passes through its gateways. It works across any cloud, framework, model and runtime, with adapters for Amazon Bedrock AgentCore, Gemini Enterprise Agent Platform and Microsoft Foundry. Lyzr describes ten blocks and more than 70 modules on one policy model.
Lyzr Opencontroller
Ten blocks, one policy model, from discovery to refinement.
Find
Read-only scans across clouds, clusters and developer laptops build one live inventory.
Ship
One record per agent, with owner, purpose, versions, tools, MCP servers and risk tier.
Each agent gets its own workload identity and signs in through your identity provider.
Multi-turn, red-team and regression evals gate each release.
Ordered environments, approvals, canaries, one-step rollback and quarantine.
Run
Authenticates, authorizes and rate-limits every caller of an agent.
Virtual keys, team budgets, rate limits, routing, fallback and caching.
Prompt injection, PII, secrets and per-tool limits, checked in the path.
OpenTelemetry traces with cost, quality and owner on every span.
Improve
Failures cluster into proposed fixes, proven on held-out evals, then added to the suite.
Lyzr, Opencontroller product site, October 2026.
Lyzr Opencontroller
Control happens in the path, inside your network.
A dashboard cannot stop an agent. Opencontroller sits between agents and everything they call, so a call can be held, redacted or refused before it lands. The control plane and its gateways run in your VPC, on premises or air-gapped, and Lyzr says control-plane data, credentials and telemetry never need to reach it. It speaks open standards, including OpenAI-compatible APIs, MCP, A2A, OpenTelemetry, OIDC, SAML and SCIM. Lyzr lists SOC 2 Type II, ISO 27001, ISO 42001, HIPAA and GDPR on its trust center.
Where Opencontroller fits, and where to look elsewhere.
| It fits when | Look elsewhere when | |
|---|---|---|
| The estate | Agents sit on mixed clouds, frameworks and platforms. | Nearly all agents live in one ecosystem with a capable native console. |
| Where data may go | It must stay in your VPC, on premises or air-gapped. | Public cloud is fine and a managed service is simpler. |
| Agents you did not build | You can route their traffic through the gateways. Lyzr says every agent gets a registry record, and enforcement depends on the path. | You cannot route their traffic, so you would get inventory and observation only. |
| Maturity you need | You are comfortable with a product announced in 2026 and documented mainly by Lyzr. | You need analyst-validated maturity before a purchase. |
| What you need | One policy model across discovery, identity, gateways and evals. | A model gateway alone, which Lyzr says covers one block of ten. |
What a first week can look like.
Days 1 and 2
Find
Run discovery. It is read-only, so it starts without changing anything you run. Read the list of agents nobody registered.
Days 3 to 5
Name and route
Give each agent an owner. Route one agent you worry about through the gateways, with a budget and guardrails.
Days 6 and 7
Read and stop
Read the first trace with cost and owner on it. Then hold or pause that agent, and time how long it takes.
Sources and notes
The numbers, with sources.
- Gartner, Gartner Predicts That by 2030, Performing Inference on an LLM With 1 Trillion Parameters Will Cost GenAI Providers Over 90% Less Than in 2025 (March 25, 2026); agentic models need 5 to 30 times more tokens per task.
- Menlo Ventures, 2025 State of Generative AI in the Enterprise (December 2025); $37 billion in 2025, $11.5 billion in 2024.
- Stanford HAI, AI Index Report 2025; the cost of GPT-3.5-level inference fell from about $20 to about $0.07 per million tokens between November 2022 and October 2024.
- Anthropic, Claude Haiku page and published API pricing, October 2026; Haiku 5.5 at $0.10 and $0.50, Sonnet 5.5 at $2 and $10, Opus 5.5 at $4 and $20, Fable 5.1 at $10 and $50 per million tokens.
- Anthropic Engineering, How we built our multi-agent research system (June 2025); agents use about 4 times the tokens of chat, and multi-agent systems about 15 times.
- FinOps Foundation, State of FinOps 2026; 98% of practitioners manage AI spend, up from 63% in 2025 and 31% in 2024.
- Harness, 2026 State of AI in FinOps, survey of 700 engineering leaders and practitioners; a vendor-run survey.
- Linux Foundation, formation of the Agentic AI Foundation, December 9, 2025, as reported by IT Brief.
Prices change often. Check the provider’s own page before relying on any figure here.
Sources and notes
The pricing and analyst claims, with sources.
- Intercom, Fin AI Agent pricing; $0.99 per outcome, and its definition of an outcome.
- Salesforce Agentforce pricing, $2 per conversation at launch and Flex Credits at about $0.10 per action from May 2025; Zendesk at $1.50 per automated resolution; as reported.
- MIT NANDA, The GenAI Divide, 2025; 95% of enterprise generative AI pilots with no measurable P&L impact, as reported.
- Gartner, first Magic Quadrant for AI Governance Platforms, June 16, 2026, and Market Guide for Guardian Agents, 2026, as reported in vendor and trade write-ups.
Analyst placements come from secondary reports, so check Gartner’s own publication before quoting one.
Sources and notes
The vendor facts, with sources.
- Microsoft, Agent 365 overview and What’s New in Agent 365, May 2026.
- AWS, Amazon Bedrock AgentCore release notes and developer guide.
- Google Cloud, Introducing Gemini Enterprise Agent Platform, April 2026.
- ServiceNow, AI Control Tower release, May 2026, with coverage in The Register.
- Okta, blueprint announcement, March 16, 2026, and Okta for AI Agents general availability, April 30, 2026.
- Palo Alto Networks, releases on Portkey (April 30, 2026) and CyberArk (February 11, 2026).
- ClickHouse, ClickHouse welcomes Langfuse, January 2026.
- Salesforce, Cisco, Check Point, CrowdStrike and SentinelOne deals and products, as reported by trade press and secondary sources.
- Kong, Solo.io, LiteLLM, TrueFoundry, Cloudflare and Databricks documentation, with third-party gateway comparisons.
- Credo AI, Holistic AI, OneTrust, ModelOp and IBM watsonx.governance product pages and buyer guides.
- Lyzr, Opencontroller overview and product site, October 2026.
- Lyzr, Opencontroller comparison page, which states its research date as September 28, 2026.
Capabilities are scored from what vendors publish. Check each with the vendor before buying.
Sources and notes
The ideas, with sources.
- William Stanley Jevons, The Coal Question (1865).Why cheaper tokens enlarged the bill
- Garrett Hardin, The Tragedy of the Commons, Science (1968).Why a shared budget gets used up
- Edward Simpson, The Interpretation of Interaction in Contingency Tables (1951).Why an average cost can fall while every cost rises
- George Akerlof, The Market for Lemons (1970).Why unverifiable return claims all sound alike
- Thomas Schelling, The Strategy of Conflict (1960).Why MCP became the obvious place to connect
- Albert Hirschman, Exit, Voice, and Loyalty (1970).Why leaving has to stay cheap
- Ronald Coase, The Nature of the Firm (1937).Why build, assemble and buy each move the cost
- John Gall, Systemantics (1975).Why to adopt a control plane one block at a time
- Stewart Myers, Determinants of Corporate Borrowing (1977).Why a bake-off belongs before the first hundred agents
The scorecard, the picker and the positions in this report are our own, offered to be argued with.
Your next step
Bring the agent you worry about most.
Thirty minutes, no slides. Leave knowing how to find it, scope it and stop it.
01
Find it
We show how discovery would surface your agents, including the ones nobody told you about.
02
Scope it
We walk through what its identity, budget and policy would allow it to do.
03
Stop it
We show how an owner, or a policy, holds or pauses it, and how long that takes.