What the gate asks
Which problem does this solve? What evidence supports it? Does it advance a current outcome? Have we tried it before? What does it displace? Is the request urgent, reversible, and proportionate to the risk?
01 / The change
Agents can build anything. Most of it shouldn't be built.
AI-native companies already run fleets of agents, and the rest are following fast. Every idea now becomes code, credentials, sandboxes, and review load, whether or not it was a good idea.
Execution is no longer the constraint. Oversight is.
What stays scarce is judgment about what to build and the human hours to review it. Nothing in the agent stack defends either.
Most companies are about to find out what happens when they ship all of it.
02 / The oversight problem
Every agent a company runs is one more thing to sandbox, watch, and review.
Each additional agent means another environment to sandbox, more permissions to scope, more secrets to protect, more output to verify.
Security has to hold every time. Nothing decides how many times there are.
1,000 people × 10 agents each
10,000
agent jobs running at once
Sandboxing
Secrets
Permissions
Verification
Monitoring
Human review
Each job may require all six.
At five minutes of human review per job, that is roughly 830 reviewer-hours per cycle. Agent counts scale with a config change. Reviewer capacity does not.
03 / July 2026 · Incident
The standard answer to that problem is better sandboxes. In July 2026, the standard answer failed.
OpenAI's sandbox did not contain its own models.
During an internal cyber evaluation, OpenAI models found a zero-day in a package proxy, obtained internet access, and compromised Hugging Face while trying to retrieve benchmark answers. OpenAI called the incident unprecedented. Hugging Face recorded more than 17,000 events during the intrusion.
Zero-day
Used to cross the intended network boundary
17,000+
Events reconstructed by Hugging Face
One narrow goal
The models were trying to solve a benchmark
Admission control would not have prevented this incident. This was approved work, and approved work still needs containment. What admission control changes is how many bets like this a company has outstanding at once.
Most companies will not outsmart OpenAI, Anthropic, and future frontier models at every step. The other lever is to run fewer agents on work that can touch production, money, or customer data.
04 / The insight
There are two ways to reduce AI risk. Everyone sells one of them.
Total exposure = work admitted × risk per job
Work admitted
How many jobs exist at all. Almost no tooling addresses this factor. Control Plane works here.
Risk per job
What each approved job can do wrong once it is running. Sandboxes, monitors, verification, and evals all compete here. A crowded market.
Every runtime control has to win every time. Admission control decides how many times there are.
Runtime controls are adversarial: they must catch a capable model misbehaving, and catching gets harder as models improve. Admission control points the same capability at a different job, judging work before anything runs. Judging gets better as models improve.
A note for readers who follow AI control research: trusted monitors, sandboxes, verification, and control evaluations all reduce risk per execution. Almost no tooling reduces the number of executions. That factor is what Control Plane reduces.
This holds under normal operation, not against adversarial models. It is a base-rate reduction, not a safety guarantee.
The safest agent is the one that never runs.
05 / The product
Admission control for autonomous work.
Control Plane is software that sits between a request and an agent. It decides whether the work should begin, and writes the approved idea into a spec that says what to build, what counts as done, and what the agent may touch. Every human correction becomes a rule the next request is checked against.
Sandboxes, monitors, and verifiers act on a running agent. Control Plane acts before an agent exists. Its output is a smaller portfolio of approved projects, each with a spec, a recorded reason, and rules that tighten after every review.
Kubernetes will not schedule a pod without admission control. Most companies schedule autonomous work with none.
Control Plane complements the safety stack. It reduces how much work reaches sandboxing, monitoring, and verification. It does not replace them.
06 / How it works
The company decides before the agent starts.
Control Plane intercepts requests from people and agents. It reads the company's current priorities, problem model, prior attempts, and system constraints before it allows work to proceed.
No one can verify work against an intent no one wrote down. The specification is the thing monitors monitor against and verifiers verify against. Verification is a budget; admission control decides where it is spent.
Request intake
Unbounded input
Every idea, bug, feature request, experiment, customer signal, and agent proposal, from anyone in the company. The volume only grows.
Admission engine
The gate
Agents challenge the request, gather evidence, expose hidden complexity, find related work, and test the idea against company priorities. The human supplies taste and context that the system cannot infer.
Scoped execution
Bounded output
The few jobs worth running, each leaving with a spec, success measure, permissions, constraints, and tests.
Now
Next
Needs evidence
Solved differently
Not now
No
Now, next, needs evidence, solved differently, not now, or no. Every decision keeps its reason.
A stop is not a deletion. Requests marked needs evidence or not now return to the queue when the evidence or the priorities change, and a human can overrule the gate.
The gate's agents run read-only against company context. They hold no production credentials, and every decision is logged with its reason.
What an approved spec contains
The user and problem, the success measure, business rules, data boundaries, permissions, and the rollout plan, plus the unresolved product decisions a human still owns.
What remains human
Humans set priorities, supply broad context, exercise taste, resolve tradeoffs, and judge whether the result is good. Agents gather evidence, interrogate gaps, execute scoped work, and encode repeated feedback.
07 / In production
Fulfill runs Control Plane in production today.
Fulfill, a logistics marketplace, runs an internal workforce of agents behind this gate. The clearest week of evidence came from a marketing hire with zero technical background.
First week
A new marketing hire proposed 27 pieces of work in his first five days. He had never used a terminal and did not have a GitHub account. Agents wrote the code he could not.
24
ideas stopped before execution
Fulfill had tried the idea before and learned from it
The request was more complex than it first appeared
The work conflicted with current company priorities
The problem was already being solved another way
3
production PRs in week one
Control Plane approved three ideas and wrote their specs. Agents wrote the code.
Three pull requests reached production because 24 weaker ideas did not create code, credentials, review work, or future maintenance. That is the exposure equation, run for one week.
A static gate would become the new bottleneck. This one learns.
08 / The loop
A correction should not die in a pull request comment.
Human review is the most expensive control a company has. It should not be spent twice on the same miss. Control Plane traces the miss upstream, then changes the gate, specification rule, test, hook, or reusable agent skill that could prevent it next time.
A human catches a miss
A requirement, edge case, architecture decision, product rule, or quality standard was absent or wrong.
Control Plane finds the earlier gap
Review agents ask which question, source, rule, or check would have exposed the problem before execution.
The fix becomes a rule
The correction becomes a gate, rule, test, hook, skill, or piece of context for future work.
↩ The new rule is active for the next request.
Every review makes the gate smarter and harder to replace.
09 / The company
Every company that runs agents will need this gate.
Fulfill runs autonomous agents safely because the filtering layer came first. The gate, the spec writer, and the review loop operate as working software today.
The company opportunity is to package that layer for any organization that runs agents. The wedge is coding agents, where requests, reviews, and rework are already measurable. The same loop then extends to marketing, operations, finance, and support.
Connects to what already exists
It reads the documents, trackers, priorities, and repositories a company already maintains. No new system of record.
Memory that maintains itself
A living record of company priorities, the problem map, and every past decision, which becomes organization-specific policy no generic model ships with. It updates after each review, and people can edit priorities directly.
Adopted, not migrated
It ships in the formats agent harnesses already read, today mostly skills, hooks, and rules files, so a team turns it on without changing how its agents run.
10 / The thesis
Reduce the number of agents that need to be controlled.
Security, sandboxing, verification, and oversight remain essential for approved work. Judgment determines how much work reaches those systems in the first place.
Fewer sandboxes to harden, fewer secrets to scope, fewer diffs to review, fewer monitors to trust. Every downstream control gets cheaper when admission is the first control.