Post

The Agent Control Plane

Uber's MCP Gateway, a red-teamed defence-in-depth design, hard budget caps and scheduled-agent failure modes all point to controls the model cannot reach.

Posted
By
6 min read
The Agent Control Plane

The model reasons; a control plane the model cannot reach decides what that reasoning may do. Write-ups published between Oct 1 and Oct 16 by Uber, Anthropic, Simon Willison and two independent engineers converge on the same layers.

Part of Weekend Deep Dive #1: Agent-Scale Infrastructure.

What’s new this week

Within two weeks, several independent sources described the parts of an agent platform that sit outside the model loop:

  • Uber (Oct 1) published the design of its MCP Gateway, which it says hosts more than 800 MCP servers and 5,000 tools.
  • Simon Willison (Oct 3) argued that hard budget caps should be the default on pay-per-use services.
  • Anthropic (Oct 8) published a reference implementation for scheduled agents, organised around their most common failure modes.
  • Billy Kong (Oct 15) published an eight-layer defence-in-depth architecture for infrastructure agents, red-teamed with a mock model that obeys every instruction it reads.
  • Ashish Kumar (Oct 16) catalogued nine control patterns, each mapped to a public incident.

Why it matters. These layers are what separate a production agent platform from a demo: who the agent is, which tools it can find, what it can change without a human, and how much it can spend. The common thread is put most sharply by Kumar: “A control is something the agent cannot read.” Rules in a prompt are requests; credentials, gateways, approval gates and caps are controls.

Key ideas

  • Tool plane: discovery doesn’t imply exposure. Uber’s AutoCrawler turns existing Protobuf and Thrift APIs into MCP tools, with LLM-written descriptions. Every server and tool starts disabled, and the owning team must approve each description change as a config diff. Authorisation is per tool and aware of whether the caller is a human, a service or an agent.
  • Context is a scaling limit. Uber found that wiring hundreds of servers into one agent “would eat up the model context limit.” Its answers are incremental discovery (a single proxy with four meta-tools), response projection, and a CLI-based “Code Mode” that is now Uber’s default for coding agents. LangChain’s Oct 14 post on context engineering attacks the same problem from the agent side.
  • Enforce outside the model. Kong’s three rules: treat model output as untrusted; the agent’s authority is data, not credentials (it proposes, and a deterministic controller holds write access); test every control from both sides. In his red team, 13 of 14 attacks are stopped, each at the point where model output turns into an effect. The open case is data smuggled through valid tool arguments.
  • Approval bound to what was reviewed. In Kong’s design, approvals are tied to a hash of the plan and pre-state, expire, and are re-checked against live state before applying. In his test, the rules caught three of five seeded bad proposals.
  • Scheduled agents fail quietly. Anthropic’s six rules include reading from bookmarks instead of fixed time windows, never mistaking a failed read for a quiet day, and counting a post as sent only when the destination confirms it. A per-run spending cap should start at three to five times the cost of a normal run.
  • Caps must be hard. Willison: “Soft caps, ‘after $X/month, send me a warning email’, will not cut it.” He points to AWS’s new spend limits (limited rollout) and Google Cloud’s Spend Caps, launched in July. Kumar’s survey of SDK defaults, as of Oct 16, finds three vendors with three different answers on turn and spend limits.
  • Platform building blocks exist. According to Google’s documentation, Agent Gateway assigns each agent a SPIFFE-based identity and blocks egress unless an IAM policy grants access, and it supports policies on specific MCP tool names. Spend Caps, per the same docs, pause one eligible service in one project once estimated spend passes the budget, though enforcement “isn’t instant.” On Oct 14 Anthropic added OpenTelemetry traces for Managed Agents and the Messages API, with the advice to review traces before widening an agent’s access.
flowchart LR
    A["Agent loop<br/>no write credentials"] -->|"model calls"| L["LLM gateway: token budgets,<br/>no provider-side tools (Kong)"]
    A -->|"tool calls"| T["Tool gateway + registry<br/>disabled by default (Uber),<br/>hash-pinned descriptions (Kong)"]
    A -->|"proposals only"| P["Approval controller<br/>policy, hash-bound approval (Kong)"]
    P --> W[("Systems of record")]
    B["Hard caps: per run (Anthropic),<br/>per project (GCP Spend Caps),<br/>default-on (Willison)"] -.-> L
    O["Traces outside the agent<br/>(Claude OTel beta, Oct 14)"] -.-> A
    K["Kill switch, drilled in CI (Kong)"] -.-> A

Composite of designs from Uber, Kong, Anthropic and Willison; not any one source’s diagram.

Analysis: none of these sources claims prompt injection is solved. Kong states that his design “limits its impact; it doesn’t prevent it,” and Signals Corps’ Oct 6 scan found injection attempts already arriving through HTTP response headers (vendor figures, mostly pranks so far). The architecture should assume the model will sometimes follow an attacker, and make sure nothing important depends on it refusing.

Reading list

Grouped loosely: gateways and registries (Uber, LangChain), budgets and observability (Willison, Anthropic automations, Anthropic traces), and red-team and surveys (Signals Corps, Kong, Kumar).

  • Designing MCP Gateway: Uber’s MCP Management Platform — Uber Engineering, Oct 1, 2026. Control plane (registry, AutoCrawler) versus data plane (proxy gateway), the “disabled by default” rule, owner-approved description diffs, and three fixes for context bloat at 5,000 tools.
  • We’re going to need default hard budget caps on pretty much everything — Simon Willison, Oct 3, 2026. A short argument for hard caps as the opt-out default, with pointers to the AWS and Google Cloud features.
  • Prompt injection in HTTP headers — Signals Corps, Oct 6, 2026. A scan of 217 million crawled responses for text aimed at AI agents, plus tests of when coding agents obey header instructions. The authors sell agent runtime protection; The Register’s coverage (Oct 15) adds context.
  • Building effective agent automations — claude.dev, Oct 8, 2026. A reference implementation for a scheduled agent, with six rules for the unglamorous failures: bookmarks, unreadable sources, re-checking before posting, confirm-then-record, read-only preferences and per-run caps. A reference repository accompanies it.
  • Agent observability on the Claude Platform — Anthropic, Oct 14, 2026. Short announcement of OpenTelemetry traces (public beta) for agent turns, model calls and tool use, following the GenAI semantic conventions.
  • Context Engineering with Deep Agents — LangChain, Oct 14, 2026. Five techniques (offloading, summarisation, skills, subagents, file-based memory) for keeping tool output out of the context window. It pairs naturally with Uber’s gateway-side projection.
  • Defence in depth for autonomous infrastructure agents — Billy Kong, Oct 15, 2026. One task followed through eight layers, each with what it stops, how that was tested and what it does not stop. Includes a red-team table of 14 attacks and a known-gaps list in the reference repository.
  • Agentic architecture patterns, part 3: the control plane — Ashish Kumar, Oct 16, 2026. A long (56-minute) survey of nine controls, from identity and egress to approval gates, durable execution, budgets and the kill switch, each tied to a public incident and to measured costs. It ends with a table of default turn, spend and networking limits in several agent SDKs, as of Oct 16.

Background and prior art

AI & Agents, Weekly Deep Dive
guardrails agent-patterns
This post is licensed under CC BY 4.0 by the author.