Your AI agent has permissions. Who controls them?

We’re giving agents access to APIs, databases, CRMs, payments and internal systems.

But something feels missing.

We can observe what an agent did.
We can evaluate whether it was right.
We can detect a policy violation.

But what actually stops the agent?

If an agent is allowed to refund $100 and decides to refund $1,000:

Is logging the action enough?

Or should there be a layer that says:

No. You’re not allowed to do that. We’ve been thinking about this as an Agent Control Plane.

Curious how others are solving this today — is runtime control becoming a new layer in the agent stack?