Count the metrics they did not publish.
Last quarter a market research firm certified "AI control plane" as its own category, and the vendor that took the leader slot shipped exactly one number to the press: one trillion tokens per day. It is a large number. It is also the only number. No P99 latency. No mean time to recovery. No count of verified executions. No depth of audit trail. Just flow.
I have spent eighteen years reading infrastructure claims, and the metric a company leads with tells you what it cannot defend. Throughput is a vanity metric when your product is governance. Governance is not measured in tokens routed. It is measured in decisions you can prove you made correctly. A control plane that processes a trillion tokens and verifies zero of them is not a control plane. It is a turnstile with a camera that does not record.
This matters to anyone holding crypto, and not for the reason you expect. The architecture that just got certified as a new enterprise category is the same architecture that the blockchain industry spent a decade pretending to abandon. And the part it is missing is the only part we ever actually got right.
The category, and the four boxes inside it
TrueFoundry, an enterprise AI platform, was named a leader by Frost & Sullivan in the newly defined "AI control plane" category. The architecture is a split-plane model. Four components, one operational panel.
An MCP Gateway governs traffic at the protocol layer. MCP is the Model Context Protocol, open-sourced by Anthropic in November 2024, later adopted by OpenAI in 2025. It defines how an autonomous agent discovers and calls external tools. The gateway decides which agent may touch which tool, under which credentials, and logs the exchange.
An Agent Gateway manages the lifecycle of autonomous agents โ spawning, scoping, revoking.
A Model Gateway routes inference across OpenAI, Anthropic, Google, and open-weight models. This is the most familiar box. API gateway plus LLM router. Portkey and LiteLLM were shipping this before the category had a name.
A Skills Registry catalogs and version-controls the capabilities an agent can invoke. Think of it as a service registry, the Consul and etcd pattern, re-expressed for tools instead of microservices.
The commercial pitch is vendor neutrality. The panel spans AWS, Azure, GCP, and on-premise, and holds SOC 2, HIPAA, and ITAR compliance. That last certification is the tell. ITAR is the International Traffic in Arms Regulations. You do not maintain ITAR compliance to serve a startup running a chatbot. You maintain it to serve defense, government, and regulated industrial customers who are legally barred from consolidating onto a single hyperscaler.
Within the same two-week window, Google shipped a Managed Agent Harness, Microsoft and ServiceNow and Rubrik shipped MCP governance layers, and WSO2 shipped an Agent Manager. Every one of those is embedded inside its own platform. TrueFoundry is the neutral overlay. That is the entire war in one sentence: a neutral layer trying to sit above clouds that each want to own the layer themselves.
If you have watched crypto at all, you have already seen this movie.
The four boxes are rebadged primitives
Start with the cold engineering read, because the marketing layer is thick here.
None of the four components is an architectural invention. Each is a mature infrastructure pattern re-fitted for agent traffic. The Model Gateway is an API gateway with model awareness. The MCP Gateway is a protocol-aware API gateway. The Skills Registry is a service registry. The Agent Gateway is a lifecycle controller, the same shape as a Kubernetes control loop.
The genuine bet is not in any single box. It is in the assumption that a customer wants one panel to govern all four. That assumption is an organizational-psychology hypothesis dressed as a technical necessity. Technically, five specialized tools โ one strong router, one strong registry, one strong policy engine โ could each beat the integrated panel at its own layer. The claim that enterprises prefer a single pane of glass is a claim about procurement fatigue, not about engineering quality.
I have audited enough infrastructure to be suspicious of integration as a moat. Combination is easy to describe and hard to defend, because it is reproducible. If your entire differentiation is that you wired four known patterns into one dashboard, the next entrant wires the same four patterns and undercuts you on price. There is no circuit constraint here, no cryptographic hardness assumption, no reason the integration cannot be cloned in two quarters. The earlier DeFi liquidity aggregators learned this. Aggregation is a product, not a protocol, until the aggregation itself becomes a standard that others must route through.
Which brings us to the actual architectural bet, the one buried under the four boxes.
The real exposure is a protocol eleven months old
MCP was open-sourced in November 2024. The control plane category was certified roughly a year later. That means the load-bearing dependency of the entire architecture is a protocol with an eleven-month track record at the moment of productization.
This is not a criticism of MCP. It is a structural observation about where the risk sits. MCP moves governance from the platform layer to the protocol layer. If MCP becomes the default, then whoever governs MCP access becomes a default governance layer regardless of which cloud the workload runs on. That is a genuine, elegant bet.
But the protocol is not owned by the vendor building on it. It is owned by Anthropic, with OpenAI as a powerful second stakeholder. A company whose core architecture assumes a stable, unified MCP is inheriting the fork risk of a spec it does not control. If the protocol fragments into platform-specific implementations โ and the earliest analysis of this category already flagged that risk โ then the unified control plane must maintain N compatible gateways, N policy models, N audit schemas, at N times the engineering cost.
Blockchain developers know this arithmetic instinctively. This is the Ethereum fork-cost problem. Every protocol you depend on but do not govern is a liability you inherit, not a capability you own. The Ethereum community spent years pricing the cost of client diversity and spec coordination, and it is enormous. The AI control plane has just signed up for the same bill without a governance seat at the table.
The single pane reintroduces the coupling modularity removed
There is a deeper structural argument, and it is where crypto's own history becomes useful rather than ornamental.
The industry spent a decade learning that a single monolithic execution layer is a coordination tax. Monolithic chains force every application to share one throughput budget, one state model, one upgrade cadence. Modular architectures split those concerns precisely to avoid the coupling. It took expensive failures to learn that separation of concerns is not bureaucracy; it is a strategy for bounding failure.
The AI control plane, by routing every agent, every model call, and every tool invocation through one panel, re-introduces exactly that coupling. It is a centralized coordination layer for autonomous economic actors. It is a monolith for agents.
Composability isn't a property you bolt on at the end; it's a constraint you pay for from the first commit. A system designed around a single governing panel is, by construction, weakly composable with anything outside that panel. You cannot let a third-party verifier into the decision path without touching the core. You cannot let a competing policy engine plug in without the panel becoming a router of routers โ at which point you have admitted the panel was never the value.
This is where the latency question becomes economics rather than engineering.
All traffic passing through one plane means one additional hop. The vendor published no end-to-end latency increment, and I am not surprised, because the number is unflattering. In single-turn chat, an extra hop of thirty to forty milliseconds is invisible. In a multi-step autonomous agent making twelve tool calls to complete a task, that tax compounds. Twelve hops at forty milliseconds is nearly half a second of pure governance overhead on every completed task, before any model compute is counted.
Treat it like gas. Every additional routing step is a fee charged on every agent action, and the fee scales with how autonomously the agent behaves โ which is precisely the scenario the product exists to serve. A governance layer that taxes autonomy in proportion to autonomy is fighting its own customer. The token-per-day figure hides this entirely, because tokens routed measures utilization, not cost per decision.
The Skills Registry is a promise, not a proof
The most security-relevant box is also the least verified.
Agent supply chain security is real. An agent's capabilities are its tools, and a poisoned tool is a third-party contract that can drain value or exfiltrate data the moment it is invoked. This is not hypothetical; it is the agent equivalent of a malicious npm package, and the failure mode is identical โ a trusted dependency turns hostile after it has been pulled into the trust boundary.
The Skills Registry, in theory, addresses this through cataloging and version control. Pin a tool to a hash, review changes, revoke on anomaly. That is a reasonable first-order defense.
But a registry is only as trustworthy as its verifier, and here the architecture goes quiet. If the registry is centralized โ one operator's database of approved tools, one operator's version history โ then the trust model has collapsed back to a single party. An attacker who compromises the registry does not compromise one agent. They compromise every agent that resolves capabilities through it, and they can do so without touching a single model.
Crypto solved a version of this problem and solved it in a specific way: content-addressed artifacts, independently verifiable, where the identifier of an object is derived from its contents. You cannot silently swap a tool if its address is its hash. The industry's answer to supply chain attacks was not a better database. It was verification that does not require trusting the database operator.
If the Skills Registry cannot be independently verified, it is a signed promise from the party whose behavior it is supposed to constrain. We don't audit what we can't see, and we can't see anything the panel doesn't choose to show us.
Trust me, versus verify me
Now the core insight, and the reason this concerns crypto directly.
Every governance claim in this architecture terminates in a log. The control plane records what each agent did, which tool it called, which model it routed to. The enterprise accepts that log as ground truth. The ground truth is generated and held by the same party whose correctness is being audited.
That structure has a name in finance, and we spent the entire last cycle learning to be suspicious of it. It is the unaudited custodian. It is the exchange that publishes its own reserves. It is the oracle that reports the price it wants to see. The mechanism is not fraudulent by intent; it is simply structurally incapable of proving what it asserts, because the prover and the verifier are the same entity.
In 2025 I worked with a lab in Singapore on exactly the escape hatch for this. The problem was not routing agents or cataloging tools. The problem was this: can you prove that an autonomous decision was made by the model you claim, on the inputs you claim, without revealing the proprietary weights?
We integrated zero-knowledge proofs into the reinforcement learning loop for that reason. Not for privacy theater, not for a marketing bullet โ for the narrow, hard property that the control plane industry currently lacks: an agent's decision can be cryptographically checked by a third party who trusts neither the agent nor the operator. The proof substitutes for the log, and it survives the operator turning adversarial.
The biggest unshipped feature of every AI control plane on the market is a verifier. Every one of them ships a recorder and calls it governance. Recording is not governing. Recording is what you do when you plan to review behavior after the incident, and by then the value has already left.
This is the genuine frontier of AI-crypto convergence, and it is narrower and more technical than the token narratives suggest. It is not about putting agents on-chain. It is about making agent decisions provable without exposing the models that make them, so that governance can be enforced by mathematics rather than by contract language.
The blast radius nobody modeled
There is a final structural omission, and it is the one I find most telling.
The control plane is, by design, a single point through which all agent traffic flows. That is its selling point. It is also an attack surface of extraordinary leverage. Compromise the panel and you do not compromise one agent. You gain the keys to every agent, every model route, every approved tool, every credential the registry manages. The blast radius of a single breach is the entire organization's autonomous operations.
The decentralization argument in crypto, whatever its frequent failures, exists for this reason and no other: to bound blast radius. You spread trust across independent components precisely so that no single compromise is total. The control plane inverts that principle. It concentrates trust to make governance convenient, then sells the concentration as a feature.
None of the published material on this category evaluated that risk. Compliance certifications were presented as pure competitive advantage, never as a corresponding source of liability. ITAR compliance is not just a moat; it is a set of legal obligations and an audit surface, and it binds the operator to a specific geopolitical bloc. A neutral layer that is only neutral within one bloc is not neutral. It is aligned, and the alignment caps its market.
That is the same ceiling I have watched crypto hit repeatedly. Every time a "neutral" layer quietly anchored itself to one jurisdiction's institutions, it kept the revenue and lost the thesis. Bitcoin's original peer-to-peer vision did not die in a single event; it died when the market decided that a regulated wrapper was worth more than the property itself. The control plane is on the same trajectory, one compliance certificate at a time.
The contrarian read: the neutral layer is the one telling the truth
Here is where the standard analysis is not just incomplete but conveniently self-serving for anyone in crypto.
The consensus contrarian take is that hyperscalers will bundle equivalent governance into their platforms at zero marginal cost and starve the neutral layer. That is almost certainly correct. It is exactly what happened to service mesh, where Istio was absorbed into cloud platforms. It is what happened to managed Kubernetes distributions and to much of observability. Neutral layers win arguments and lose procurement.
But that is the wrong question, and asking it lets crypto off the hook.
The real blind spot is this: a centralized control plane cannot deliver the security properties it advertises, and neither can a decentralized one that is decentralized only on the slide. We have no standing to point fingers at a panel of glass when our own sequencers are single nodes. "Decentralized sequencing" has been a PowerPoint for two years. The L2s that route every transaction through one operator, subject to one liveness assumption, one censorship policy, one upgrade key โ they are control planes. They are the same architecture with a different label.
The uncomfortable conclusion is that the AI control plane is at least honest about what it is. It says: we are centralized, we govern everything, trust our log. Crypto says: we are decentralized, we govern everything, trust our log. Those sentences have the same structure. One of them uses the word "decentralized" as an adjective, which is not a mechanism. An adjective is not a proof.
There is one place crypto genuinely holds an advantage, and it is not decentralization as a brand. It is verification as a primitive. If the neutral layer wins the governance war, it will win because it can be checked by a third party that trusts no one โ not because it is neutral. Neutrality is a marketing position. Verifiability is an engineering one.
What to watch
The layer that wins this category will not be the one routing the most tokens.
Three signals will resolve the question over the next eighteen months. First, who ends up governing the MCP specification โ Anthropic holding it unilaterally, or a multi-party foundation taking custody. A single-vendor-owned protocol is a single point of policy failure, and every control plane built on top inherits that failure. Second, whether any control plane ships a verification system rather than a logging system. If a vendor publishes a proof format that an independent party can check without trusting the vendor, that is the actual category-defining event, and it has not happened yet. Third, whether hyperscaler compliance reaches ITAR equivalence, which will tell you whether the neutral layer's moat is structural or temporary.
Watch those three and nothing else. The token count is noise. A trillion tokens per day proves you moved a lot of data. It does not prove you governed any of it correctly, and governing correctly is the only thing anyone is paying for. In a market that certifies categories faster than it verifies claims, the winning question is not "who is biggest." It is "whose log can an adversary be forced to accept."