AI agents are outgrowing the enterprise control plane (2026)

On September 10, 2026, OpenAI launched the Agents API in public beta, packaging multi-agent coordination, dynamic tool search, context compaction, and sandbox execution into a single managed service. 1 The release marks a structural shift in software development: launching an autonomous agent now requires a single API call rather than months of custom orchestration logic.

Running machine agency has become easy. Controlling machine agency in production remains an unresolved operational problem. As engineering teams adopt managed runtimes that spawn subagents and execute code in cloud sandboxes, enterprise architecture faces a split between execution capability and administrative visibility.

The practical question for technology leaders is whether their operational scaffolding can govern autonomous execution. Deploying an agent creates obligations around asset inventory, release verification, network egress, and emergency shutdown that traditional application monitoring failed to address.

What managed agent execution solves

OpenAI's Agents API unifies three capabilities that developers previously maintained by hand:

First, programmatic tool calling with Tool Search. Tool Search retrieves relevant tool definitions on demand, bypassing the need to supply exhaustive tool libraries in the initial system prompt. This selective loading preserves prompt caching, reduces token consumption, and allows agents to execute multiple tool calls in parallel or combine results directly in code. 1

Second, automatic context compaction. As multi-turn workflows approach the context window limit, the runtime compresses earlier exchanges while preserving the working state necessary to proceed. This automation sustains long-running tasks across sessions without custom token-pruning pipelines. 1

Third, decoupled sandbox compute. The service executes code in isolated hosted sandboxes or routes workloads through partners such as Cloudflare, Modal, and E2B, with options for customer virtual private clouds. Developers define CPU, GPU, memory, and environment configurations in the initial configuration call. 1

These capabilities streamline the execution layer. They allow software to plan, spin up concurrent subagents, query databases, execute scripts, and process files in parallel. Making an agent reliable across enterprise systems still requires an independent system: the control plane.

The confidence gap in enterprise operations

On the same day OpenAI introduced the Agents API, software delivery platform Harness published findings from an international study of 700 enterprise technology leaders across the United States, the United Kingdom, France, Germany, and India. 2 The surveyed organizations each employ more than 1,000 workers, maintain over 100 developers, generate at least $100 million in annual revenue, and run AI agents in production or active pilots.

The survey reveals a wide divide between subjective leadership confidence and verified operational capability. Across inventory, testing, security, and budgeting, confidence hovers above 70%, while verified controls exist in less than half of organizations.

Operational Dimension	Reported Leadership Confidence	Verified Production Control	Measured Operational Reality
Asset Inventory	77% claim complete inventory of agents, MCP servers, and LLMs 2	44% deploy active discovery tooling 2	Undiscovered shadow agents and unmonitored tool integrations persist in production networks 2
Release Verification	74% trust existing tests to catch production-impacting failures 2	19% maintain automated gates that block bad releases 2	58% report higher production incidents per 100 changes following agent deployment 2
Emergency Containment	76% believe they can disable a misbehaving agent in under 15 minutes 2	33% possess an instant kill switch 2	Background tool access and API usage continue during remediation 2
Security Assurance	75% assert their agents are secure end to end 2	Confident cohort experienced an 88% incident rate 2	Security incidents affected 87% of all surveyed enterprises this year 2
Financial Governance	74% state they hold a complete view of spend per agent 2	60% overran their quarterly AI budget 2	Unpredictable recursive tool calls and subagent loops multiply token expenses 2

The data indicates that belief in agent readiness often functions as an assumption rather than an engineered reality. In the testing domain, fewer than one in five enterprises maintains an automated gate that halts a flawed release. 2 Over four in ten engineering teams decide whether to trust an agent change on a case-by-case basis. Only 53% route agent updates through a standard continuous integration pipeline, while 42% run prompt modifications through code review systems. 2

When change management relies on informal optimism, production stability deteriorates. Fifty-eight percent of organizations report an increase in production incidents per 100 changes since deploying AI agents. 2

The network and transport blind spot

Operational disconnects extend into enterprise networking. In an analysis of enterprise infrastructure published on September 10, 2026, AT&T observed that agentic workloads alter network dynamics. 3

Traditional enterprise architectures handle static client-server requests with predictable data paths. Autonomous agents reverse that pattern. A single prompt can trigger a cascade of secondary model calls, vector database retrievals, tool executions, and external API requests across multiple cloud providers. 3

Existing software-defined wide area networks and basic Zero Trust perimeters verify user identity at the perimeter. They lack visibility into machine-to-machine activity occurring downstream. AT&T highlights the need for an architectural layer positioned between application logic and transport routing. 3 This intermediate layer must identify which specific agent initiated a request, track sensitive data movements, enforce policy across external tools, and balance latency against token expense.

Five requirements for the agent control plane

Technology leaders preparing to expand agent deployment can evaluate their operational scaffolding against five verifiable requirements:

Continuous asset discovery: Active scanning must index every running agent instance, model endpoint, Model Context Protocol (MCP) server, and associated API credential across the organization. The Harness data demonstrates that static registries leave more than half of assets unverified. 2
Automated release gates: Every prompt revision, tool addition, and environment modification must pass through an automated evaluation pipeline before reaching production. Relying on manual developer inspection allows release regressions to slip into active systems. 2
Instant deterministic shutdown: Operators require an immediate mechanism to revoke tool access, sever network egress, and terminate running tasks in seconds. Pausing an agent through chat interfaces leaves background subagents active and vulnerable to recurring failures. 2
Identity-aware network inspection: Transport policies must bind egress traffic to distinct agent identities rather than broad service accounts. Network layers need capability to verify target model endpoints, monitor outbound data transfers, and restrict unauthorized tool connections. 3
Outcome-based spend accounting: Financial tracking must measure cost per completed business outcome rather than aggregate monthly token volume. Visibility requires attributing API calls, database queries, and subagent runtimes directly to specific business tasks. 2

The deployment decision rule

The availability of managed agent runtimes lowers the barrier to building autonomous software. Anyone can write an API call that coordinates three subagents, retrieves tools dynamically, and executes Python in a cloud sandbox. 1

Engineering teams must separate the speed of launching an agent from the discipline of operating it. The appropriate decision rule is straightforward: treat agent runtimes and multi-agent APIs as raw execution engines. Authorize production deployment only when the surrounding control plane can discover every active agent, block defective releases automatically, inspect outbound network requests, and sever access instantly.