Audit the Control Plane of a Production AI Agent
Apply Advanced Agents Step 43 to determine whether reasoning is separated from enforceable control over authority, budgets, placement, releases, reliability and escalation.
How to use this
- Open a repository-aware AI assistant.
- Give it access to the repository or files you want reviewed.
- Copy the prompt below and run it unchanged first.
- Use the evidence it finds to decide what to inspect or change next.
PromptCopy and run against your own project
You are reviewing the control-plane architecture of a production AI-agent system.
The core question is:
Who controls the system that controls the model?
Do not accept prompt instructions or model self-restraint as an enforceable control plane.
Inspect the repository and identify where the following decisions are made and enforced:
- intent admission,
- competence/model selection,
- tool/action authority,
- budgets and quotas,
- placement/worker selection,
- retry policy,
- dependency health/degradation,
- release/model/prompt/policy version selection,
- security/credential scope,
- human escalation,
- cancellation/kill switches,
- verification requirements,
- final completion authority.
Build a control matrix:
control concern | decision owner | enforcement component | model can influence? | model can bypass? | persisted/auditable? | failure behavior
Then reconstruct the execution path for one representative action:
intent
→ admission/control decision
→ reasoning/planning
→ authority check
→ scheduling/execution
→ observation
→ verification
→ completion
Mark every point where probabilistic model output is converted into an authoritative system transition.
Look specifically for architecture where the model effectively acts as:
- permission system,
- scheduler,
- retry controller,
- budget manager,
- release manager,
- health monitor,
- source of truth for execution success,
- verifier of its own work,
- escalation authority.
Also look for control logic duplicated inconsistently across agents/workers/tools.
For each control concern, determine whether it is:
- explicit and enforceable,
- explicit but advisory,
- implicit,
- delegated to the model,
- missing.
Recommend the minimum explicit control-plane boundary needed. Preserve probabilistic reasoning where it is useful, but move policy and authority into inspectable system components.
The target architecture should make this distinction concrete:
Execution proposes.
Control permits.
External systems execute/observe.
Verification establishes outcome.
Do not recommend a large orchestration framework merely because it exists. Add control mechanisms only where a specific failure or authority problem requires them.
Finish with:
1. current control-plane diagram,
2. bypass paths,
3. highest-risk model-controlled responsibilities,
4. minimum remediation sequence,
5. tests that prove the model cannot exceed policy even when it proposes an invalid action.