Above the architecture
The architecture answers whether the knowledge an agent acts on is fit to be acted on. The control plane answers the question above it: who may let the agent act at all, on whose authority, within what limit, and with what evidence afterwards. In a regulated firm every person who takes a consequential act holds a delegated authority, written, versioned, and signed. The agents the same firm now runs act under entitlements instead. The control plane puts the join between the two at the centre.
The mandate
That join is the mandate: a versioned authority covering one class of acts. It says what the agent may do, what evidence it needs before doing it, when the control plane may refuse, and who answers when it does. One accountable owner signs it, and it has an expiry.
The mandate is also the unit of risk. A board sets an appetite limit on the worst outcomes it will bear. The mandate turns that limit into a bound on one class of acts, narrows the class when the record of adjudicated acts says the bound no longer holds, and widens it on the record alone. Risk appetite, which has lived at the level of the portfolio, is written where the act happens.
The check before the act
Before each act, a check reads three things. The agent itself: is it fit to run, this release, validated for this workflow? Its knowledge: is what it relies on applicable and current, the wording of the policy that was in force on the date of the loss? Its mandate: is it allowed to decide this, within scope, under the ceiling, before expiry? The check can admit the act, refer it to a person with the reason, or refuse it.
One rule runs across the levels of autonomy: autonomy may not rise above evidence. An agent is let further up the ladder only as far as the record of its own acts supports, and an act that cannot be undone needs one level more. A refusal is itself a cost the firm can count, and the mandate prices it beside the cost of a wrong act.
The record
After the act, the record stamps all three: which agent, on what knowledge, under which mandate version, with the check's verdict and its reasons, the facts, the sources, and the result. A reviewer, an auditor, or a supervisor rebuilds the decision from it without the agent's help. The customer who brought the case receives the decision with its reasons and can challenge it.
The record also feeds the loop. It is the evidence on which a mandate is narrowed or widened, on outcomes, complaints, and appeals, and on which the knowledge beneath the agent gains or loses standing.
The map
The map draws the control plane as the essentials a firm has to have in place, at the altitudes where they are decided, applied, and enforced. The essentials are the agent, its knowledge, its mandate, the check before the act, the record, and the loop that changes all three. The altitudes are the enterprise, which decides; the workflow, which applies; and the platform, which enforces. Authority flows down from the law and the supervisors through the firm's own decisions. Evidence flows up to the board, the supervisor, and the external auditor.