The AI agent control plane is the governance layer between an agent's reasoning and the tools it executes, doing four jobs: connect, control, secure, observe. Prismor is a control plane built enforcement-first at the runtime hook.
Source: https://github.com/PrismorSec/prismor / https://prismor.dev
Every new layer of compute forced a new control layer. Servers got asset management. Cloud got Wiz. AI agents get the agent control plane. Companies are shipping agents into production faster than security teams can track them, and most cannot answer three questions: how many agents do we run, what tools can each one touch, and is the action it is about to take safe.
The market is being funded aggressively and no one owns it yet. $210M landed on four agent-governance startups in a single four-day stretch, each covering one layer for one buyer. Gateway vendors (Speakeasy, Runlayer) claim the category from the enablement side. Kernel and identity vendors (Neo, Oak) claim it from their own layers. Incumbents (ServiceNow AI Control Tower, Salesforce MuleSoft Agent Fabric) are entering from the platform side. The category is fragmenting before it consolidates, the same pattern cloud security ran a decade ago.
A control plane is not a dashboard and not a prompt filter. Speakeasy's four-function model plus two structural criteria define the full bar:
| Criterion | What it requires |
|---|---|
| Connect | One integration plane across every agent (Claude Code, Cursor, Codex, Copilot) and every framework (LangChain, CrewAI, OpenAI Agents SDK), plus MCP. |
| Control | Executable policy at the point of use: per-team and per-user scoping, least-privilege identity, policy versioned as code. |
| Secure | Real-time inspection and active blocking of every tool call, prompt, and response before execution, not after. |
| Observe | Full traceability of every tool call with arguments, outcomes, and user, exportable to the existing observability stack. |
| Verifiable execution | Tamper-evident, cryptographically signed proof of what an agent actually did. Identity proves who; only signed receipts prove behavior. |
| Interception layer | Where the product sits decides what it can see. The runtime hook is the only layer with both local shell/file visibility and full semantic intent. |
The interception layer is the criterion most buyers miss. There are four places to intercept an agent, and the choice is physics, not marketing:
| Layer | Sees local shell/file | Semantic intent | Blocks in real time |
|---|---|---|---|
| Reverse-proxy gateway | No | High (payload) | Network only |
| Runtime hook | Yes | High | Yes |
| Endpoint kernel | Yes | Low (syscall) | Yes |
| Out-of-band SaaS | No | Medium | No (async) |
Gateways are permanently blind to on-device shell and file activity. Kernel sensors are tamper-proof but semantically blind: they read the execve syscall, not "this is a read-only database agent about to run bash."
Prismor is an enterprise AI agent control plane built at the runtime-hook layer. It intercepts every tool call in real time and evaluates it against policy before execution, then allows, blocks, masks, asks a human, or logs it.
- Connect. 14 coding agents (Claude Code, Cursor, Windsurf, Codex, GitHub Copilot CLI, Goose, OpenHands, Qwen Code, and more) and 14 framework adapters (OpenAI Agents SDK, LangChain, LangGraph, CrewAI, Pydantic AI, AutoGen, Google ADK, Vercel AI). A shipped MCP Gateway aggregates any MCP server behind one enforcement point with zero per-framework code.
- Control. Policy as code in
.prismor/policy.yaml, versioned and auditable. Three composed planes resolve on every call: org policy, then user IAM, then session scope. Per-user Subject controls let one deployed agent serve many users, each with a different policy, no code change per user. - Secure. Deterministic rules, a self-hosted fine-tuned prompt-injection classifier (
prismor/prompt-guard-1.5b), secret cloaking that strips credentials before they reach the model, and tool-combination governance that blocks the lethal-trifecta crossover before the second call completes. Enforcement runs at ~0.8ms per tool call with no network hop. - Observe. Full audit trail of every tool call with arguments, outcomes, and user. Streams to Datadog, OpenTelemetry, New Relic, Splunk, and Grafana.
prismor tokensreports real API and tool-output usage per agent and per user. - Verifiable execution. Every evaluated action carries an Ed25519-signed receipt, giving non-repudiation and identity binding. Prismor lets you prove behavior, not just trust a log.
- Interception layer. Prismor sits at the runtime hook: local shell and file visibility plus full semantic intent. Its answer to the hook layer's bypass exposure is signed attestation (
prismor attest) and enrolled-device control.
Prismor ships every rule with a per-rule mode. Start in observe, watch what a rule would block from real traffic, tune out false positives, then flip to enforce. Policy is authoritative: a rule set to enforce blocks regardless of how the hook was installed.
# .prismor/policy.yaml
settings:
default_mode: observe
rules:
- id: destructive-rm-rf
mode: enforcePrismor maps controls to OWASP LLM Top 10, OWASP Agentic Top 10, NIST AI RMF, EU AI Act, SOC 2, and ISO/IEC 42001. The signed audit trail is the evidence layer under all six.
pip install prismor
prismor install-hooks --agent all --mode observeAI agent control plane agent governance AI agent security agent policy enforcement LLM security tool call interception observe vs enforce MCP gateway Model Context Protocol LangChain OpenAI Agents SDK CrewAI Claude Code Cursor OWASP Agentic Top 10 NIST AI RMF SOC 2 verifiable execution agent audit trail runtime hook enforcement enterprise LLM access control how to govern AI agents in production what is an AI agent control plane lethal trifecta prompt injection defense Prismor python