Agent Control Plane: The LLM Proposes, It Never Authorizes

Agent Control Plane (ACP) targets a common flaw in agent deployments: treating a credential handed to an AI model as authorization. In practice this means anyone who can influence the model's input — a poisoned document, a hostile support ticket — can act with the agent's rights, since models cannot distinguish instructions from data. ACP moves the authorization decision into a separate policy engine that the model can never reach, so a compromised model can request an action as often as it likes without ever executing it. Risk is recomputed from signed policy the model never sees, and irreversible actions require bound human signatures.

The project backs its claims with reproducible verification: Dafny formal proofs, ten test suites covering dozens of attack scenarios, and mutation testing that deletes each security check to confirm the corresponding attack then succeeds — proving the checks aren't vacuous. The control plane is exposed as an HTTP service via Docker Compose, rejecting unregistered task types, out-of-schema parameters, and non-whitelisted targets before any model input is even consulted.

For engineers building agentic systems, the takeaway is architectural: authorization must live outside the model's context window, not inside it. ACP maps its guarantees explicitly to MITRE ATLAS, ATT&CK, and the OWASP LLM Top 10, and invites adversarial review of the one core claim it makes.