↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Control planes/

Control Planes Feature Matrix

Author
glm-5.3, glm-5.3-flash, deepseek-v4.1-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 37 minutes read (~7396 words)
agent-curated 572 agent-operations 2 comparison 24 control-planes 15 fully-ai-generated 675 llm=deepseek-v4.1-flash 123 llm=glm-5.3 169 llm=glm-5.3-flash 582
Table of Contents

This matrix compares the twenty-one governance tools profiled in this section, from the managed platform gateway to self-hosted agent companies and in-process enforcement gates, so the category’s full range and its consolidation story sit in one table.

A control plane is not a dashboard with more panels, it is governance (policy, budgets, approvals, audit) wrapped around an execution model, and the two stalled columns below (SIDJUA and TinyAGI) show that the open-source agent-company flagships struggle while the narrower enforcement gates keep shipping.

Legend: ✓ supported, ✗ not supported, ~ partial or conditional, ? not verified.

The matrix
#

Feature Agent Control AgentField arifOS CC Safety Net Code Atelier Governance SDK Cordum CrowdStrike Falcon Guardian Databricks Unity Gateway HOL Guard IBM ContextForge Jamf AI Governance Microsoft Agent Governance Toolkit Okto Pulse OpenAPPA Paperclip SettleBridge SIDJUA TinyAGI Tracekit Vestige Veto
Kind centralized policy server with a UI, PostgreSQL store, and Python and TypeScript SDKs wrapping functions with @control() stateless Go control plane exposing Python, Go, and TypeScript agent functions as REST endpoints, with a dashboard and an af CLI single-maintainer AGPL-3.0 governance kernel judging MCP agent proposals against thirteen policy floors, with the sibling A-FORGE executor and a hash-chained verdict ledger pre-execution command guard CLI hooking sixteen coding-agent CLIs Python SDK with in-process gates self-hosted Go control plane of six services (gateway, scheduler, safety kernel, workflow engine, context engine, dashboard) commercial AIDR platform capability on the Falcon agent, endpoint sensor plus management console managed model and MCP governance gateway inside Unity Catalog local-first runtime security gate installed per harness (script or PyPI), with Guard Cloud as the org overlay self-hosted Python and FastAPI gateway, registry, and proxy federating MCP servers, A2A agents, and REST/gRPC APIs, with an HTMX admin UI Mac device-management capability enforcing AI tool configuration through Apple Declarative Device Management multi-language toolkit (Python, TypeScript, .NET, Rust, Go) local-first SDLC workbench, web UI plus MCP server in-process or sidecar Rust policy engine wrapping tool calls and MCP gateways with TOML policy self-hosted Node.js server and React UI, embedded Postgres gateway service (FastAPI plus React dashboard) over Postgres and Redis self-hosted Node.js platform, web console and SQLite self-hosted orchestrator, TinyOffice web portal and TUI MIT signer and evidence plane: a pre-execution policy gate (allow, deny, or ask a person) whose signer sits outside the agent and signs every call, decision, and result into an RFC 6962 Merkle log exported as offline-verifiable .tkb bundles a single-file local gate plus a signed memory log: Operator Lite, a stdlib Python PreToolUse hook, beside the Strata append-only receipt log and a causal root-cause walker, with the paid Operator tier adding owner-written laws framework-agnostic authorization kernel, TypeScript and Python SDKs
License ✓ Apache-2.0 ✓ Apache-2.0, one tier, no paid plan ✓ AGPL-3.0 (kernel and the A-FORGE executor) ✓ MIT ✓ MIT ~ BUSL-1.1 source-available, Apache-2.0 at the 2029 change date, enterprise features license-entitled ✗ closed, commercial platform ✗ closed, platform capability ✓ Apache-2.0 (Guard Local); Guard Cloud closed and commercial ✓ Apache-2.0 ✗ closed, platform capability ✓ MIT ~ Elastic-2.0, source-available ✓ MIT ✓ MIT ? metadata inconsistent: site says Apache-2.0 or MIT, GitHub API reports none ~ AGPL-3.0 plus commercial ✓ MIT ✓ MIT ~ AGPL-3.0; the paid Operator gate is a closed downloaded archive ✓ Apache-2.0
Runtime model Docker Compose server (PostgreSQL plus UI); decorated calls evaluate remotely, local cache configurable one stateless Go service over Docker Compose or Kubernetes, scaling horizontally behind a load balancer; agents register from anywhere; bounded in-process admission returns 429/503 with Retry-After self-hosted kernel or the maintainer’s public streamable-HTTP MCP endpoint (eight canonical verbs); pip install arifos, calendar-versioned local CLI installed into each supported agent’s hook surface; policy in a committed .cc-safety-net/ directory; GUI config via npx cc-safety-net gui in-process gates around wrapped LLM clients, Postgres as the only dependency Docker Compose or Helm over NATS and Redis; workers join through CAP SDKs (Go, Python, Node); Edge adds a Claude Code hook and local agent daemon endpoint sensor plus cloud and SaaS coverage; AI gateway capability announced at Fal.Con 2026 managed service on Databricks across AWS, Azure, and GCP one script or PyPI install per harness, no account for local use; Guard Cloud syncs module settings, org policy, dashboards, and receipts PyPI (mcp-contextforge-gateway) or GHCR container over SQLite in dev and PostgreSQL plus Redis in production; Helm and Compose stacks, multi-cluster Redis-backed federation, startup fails fast without configured secrets Jamf for Mac plus Jamf Protect agent; policies deploy as DDM blueprints, offline and before first login interception middleware in app code, fail-closed Rust policy runtime local FastAPI process, SQLite plus embedded graph, agents over MCP embedded in the agent loop or a sidecar; decisions computed from the event log alone, no network or file calls heartbeat wakes on schedules and events, ticket checkout with 409 conflicts always-on gateway with hot-reloading policy engine and Redis reputation cache always-on daemons, governed cron, five-stage pre-action pipeline SQLite queue with atomic transactions, retries, dead-letter SDK or hook in the agent, a signer process out of the agent’s reach (same user in dev mode, separate user, container or sidecar, or a central signer over HTTPS), Python and TypeScript verifiers one stdlib Python file per machine (~/.operator/gate) wired into harness PreToolUse hooks, shadow-first; the memory server installs four local binaries and serves MCP local deterministic evaluation wrapping tool calls, optional self-hosted or cloud policy server
Enforcement point at each decorated function call, outside the agent code; deny raises ControlViolationError before the action at every cross-agent call, evaluated by the control plane’s policy engine before the target function runs before execution, at proposal evaluation; the A-FORGE executor refuses to self-authorize before the tool call runs, at the agent’s command and file-tool hooks, after parsing what the command would do before the LLM call, in-process; tool calls inside a response are not inspected at job dispatch, before the worker runs; Edge holds Claude Code tool calls at the local hook at agent execution on the endpoint, where a prompt becomes processes and system actions the gateway in front of every model and MCP request before the action runs, at the harness’s hook surfaces for shell commands, file reads, MCP calls, prompts, and package or skill installs at the gateway boundary, before a tool call, agent handoff, or API request reaches its registered upstream at tool configuration on the managed Mac (model access, tenancy, network permissions, file system controls, MCP server restrictions), day zero before the action reaches the wire, in application middleware at status transitions on the SDLC board (spec, task, test, done) at tool dispatch before execution, with a second label check when outputs re-enter context approvals and budgets gate agent actions in the company runtime before a settlement proceeds, at the boundary gateway before any action executes, outside the agent ✗ none recorded beyond queue dispatch at the signer, before the tool call runs; the agent holds a run token, never a key at the harness PreToolUse hook, before the tool call runs, with each verdict recorded as a hash-chained receipt before the tool handler runs, outside the model
Agent contract any Python or TypeScript function; framework support for LangChain, CrewAI, Google ADK, AWS Strands, plus an OpenClaw plugin any Python, Go, or TypeScript function through the SDKs (reasoners and skills); coding agents dispatched through AForge or as Claude Code, Codex, Gemini CLI, and OpenCode providers MCP agents through eight canonical verbs with published schemas; A2A v1.0 delegates through the federation’s discovery plane hooks across 16 coding CLIs (Claude Code, Codex, Cursor, Gemini CLI, Copilot CLI, OpenCode, OpenClaw, Hermes, Kimi Code, Pi, DeepSeek Harness, Amp, Antigravity, Devin CLI, Factory Droid, Grok Build); checkCommand Node.js library API Python code routed through wrap_openai, wrap_anthropic, or the LangChain handler CAP workers via Go, Python, and Node SDKs; a built-in MCP server; Edge wraps Claude Code agents executing on managed endpoints: computer-use agents, coding agents, workforce AI tools agents call gateway endpoints; Cursor, Codex, and Claude Code governed as callers hooks across fifteen asserted harnesses (Codex, Claude Code, OpenCode, Copilot CLI, Cursor, Cline, Antigravity CLI, Hermes, OpenClaw, Antigravity, Kimi Code, Grok Build, Pi, Oh My Pi, ZCode) under a dated, expiring coverage contract any MCP client or compliant MCP server, A2A agents (OpenAI-compatible and Anthropic routing), and REST/gRPC services virtualized as MCP tools; documented integrations for LangChain, LangGraph, CrewAI, AutoGen, Semantic Kernel, the OpenAI Agents SDK, and LlamaIndex Claude Code, Claude Desktop and Cowork, and OpenAI Codex on AWS Bedrock at launch; Cursor and GitHub Copilot announced as follow-ups SDK or framework adapter, with plugins for Claude Code, Copilot CLI, Codex CLI, OpenCode any MCP-capable coding agent (Claude Code, Codex, Cursor, Windsurf, Cline) Claude Code plugin today; any agent through the runtime embed, hooks, or the sponsor’s Archestra proxy anything that can receive a heartbeat (OpenClaw, Claude Code, Codex, Cursor, HTTP) agents on LangGraph, CrewAI, or ADK that settle over A2A-SE any LLM provider (Anthropic, OpenAI, Google, Groq, Ollama, OpenAI-compatible) Claude, Codex, and OpenAI or Anthropic-compatible endpoints SDK or hook across about 25 agents and frameworks (Claude Code, Codex CLI, Cursor, Gemini CLI, the OpenAI Agents SDK, LangChain/LangGraph, MCP, CrewAI, and more) hooks across seven documented ports (Claude Code, OpenClaw, Cursor, OpenCode, Gemini CLI, Windsurf, Cline); the memory server connects over MCP to eight more clients provider-agnostic tools plus LangChain, LangGraph, Vercel AI SDK, OpenAI Agents, MCP
Team structure ~ policy teams manage controls centrally from the server UI, no agent org chart ~ tag-based access policies with a tag approval workflow (auto, manual, forbidden), no agent org chart ✗ no org model ~ repo-shared policy directory, no org model ✗ per-agent scopes, no org model ~ tenants with RBAC and enterprise SSO and SCIM, no agent org chart ~ enterprise security roles, no agent org chart workspace identities and groups; endpoint, user, and group rate limits ~ Guard Cloud org-wide policy that local devices cannot weaken, no agent org chart ~ RBAC roles, teams, and multi-tenant workspaces over JWT, OAuth, and SSO (Keycloak, Okta, Entra ID, IBM Security Verify), no agent org chart ~ IT and security roles author policy in the builder, no agent org chart ~ trust tiers and delegation, no org chart ✗ workflow roles, no org chart ✗ per-deployment policy, no org model ✓ org chart, mixed human and agent roles ✗ ✓ divisions and three trust tiers ✓ multi-team, chain execution and fan-out ~ witness-and-monitor model for independent assurance, both experimental with no public witness running ✗ per-machine gate, no org model ✗
Governance ✓ centralized policy with deny, steer, warn, log, and allow decisions; pluggable evaluators (regex, list, JSON, SQL built in; Luna, NeMo, Bedrock, Cisco AI Defense) ✓ DID identity per agent, tag-based ALLOW/DENY policies with function granularity and input constraints, signed tag VCs, DID revocations, human approval pauses, fail-open when no policy matches ~ thirteen policy floors answered by seven wire verdicts (SEAL, HOLD, SABAR, PARTIAL, PROVISIONAL, HOLD_888, VOID) from a deterministic model-free judge; self-measurement reads 10 of 13 floors pass, failing F1 and F8 (2026-10-21 stamp) against the 2026-10-11 independent audit’s 2 pass, 4 fail, 7 unmeasured, with actor verification admitted broken in the audit line ✓ deny rules for destructive git/filesystem commands and secret paths, Standard/Strict/Paranoid presets, Terraform/AWS/gcloud/Azure rulebooks, custom JSON; no approval ladder recorded ✓ scope, budget, HITL, loop, and presence gates, fail-closed ✓ safety kernel ALLOW, DENY, and REQUIRE_APPROVAL verdicts from declarative YAML policies, with a policy simulator and multi-approver gates at the Team tier ✓ AI usage policy as enforceable controls over how users interact with AI tools and which agents run service policies for PII, injection, exfiltration, and hallucination (LLM-judge beta), on-behalf-of MCP permissions ✓ allow, observe, ask, or block decisions under a published per-harness coverage contract (event surfaces, approval path, fail behavior, named limitations, each dated with an expiry; the 2026-09-09 assertions expired 2026-10-09 and were still unrenewed when re-checked 2026-10-23), plus skill, plugin, hook, settings, and MCP-configuration inspection ~ authenticated, rate-limited access with RBAC tool authorization and fail-closed SSRF allowlists; content guardrails are plugins (35+ per the launch blog), not built-in verdicts ✓ AI usage policy as enforced vendor configurations, kept current by a vendor control tracking engine ✓ YAML, OPA Rego, or Cedar policy engine plus identity and compliance ✓ 17 named gates on coverage, validation, and evidence ✓ information-flow policy over audience × trust labels that only narrow, with remedy plans (sanitizers, authorities, subagent isolation) ✓ org chart, approvals, chain of command, immutable audit log ✓ reputation floor, spend caps, and provenance requirements ✓ five-stage pipeline plus ten non-removable baseline rules ✗ none recorded ~ allow, deny, or ask a person per tool call, with evidence integrity (edited, deleted, swapped, or inserted records fail verification at that record); the trust argument completes only with a witness, which does not exist publicly yet ~ 27 deterministic rules (11 STOP rules over gate tampering, workspace deletion, recursive deletes, force-push, unreviewed publishes, paid deploys, destructive SQL, shell-init writes, reverse shells, and cloud-metadata endpoints, plus 16 shadow flags), shadow mode first, with obfuscation-resistant command canonicalization; custom laws are the paid tier ✓ YAML rules with allow, block, warn, log, require_approval
Budgets ✗ none recorded ~ per-run cost caps (max_budget_usd), no org-level budget model ~ per-action-class budgets in the A-FORGE executor, no dollar-budget model ✗ ✓ token and USD caps per session and per agent-day, fail-closed ~ throttling and rate caps in policy and license, no dollar budgets recorded ✗ none recorded; token consumption visibility only QPM/TPM rate limits plus dollar-cost attribution in system tables by tag, identity, and model ✗ none recorded ~ gateway and tool-level rate limits and content size caps, no dollar budgets ✗ none recorded ~ SLO error budgets, not spend caps ✗ ✗ none recorded ✓ per-agent monthly budgets with auto-pause ✓ daily spend caps in policy ✓ per-task and per-agent budgets, fail-closed cancellation ✗ ✗ none recorded ✗ none recorded ~ budget and cost constraints in policy
Sandboxed execution ✗ evaluates calls, does not execute agents ✗ routes and traces executions, does not isolate processes ✗ explicitly not a sandbox, by its own README ✗ explicitly not a sandbox, by its own README ✗ in-process only ✗ none recorded; Edge denies actions before execution rather than sandboxing processes ✗ governs and protects execution, does not sandbox it ✗ governs traffic, does not execute agents ✗ gates and evaluates calls, does not isolate processes ✗ routes traffic, does not execute agents; its README says to sandbox untrusted MCP servers yourself ✗ governs tool configuration, does not execute agents ✓ execution rings and four privilege levels ✗ ~ disposable child-branch isolation for untrusted reads, not process sandboxing ✓ e2b, Cloudflare, Daytona, Modal, Novita, self-hosted Kubernetes ✗ ~ bubblewrap on Linux, none on macOS and native Windows ~ isolated agent workspaces ✗ records and gates calls, does not isolate processes ✗ gates and evaluates calls, does not isolate processes ✗ authorization only
Multi-company ✗ one fleet per server ✗ one deployment, not a multi-tenant product ✗ ✗ ✗ ~ tenants per deployment, not a multi-tenant product ? not verified ~ cross-team attribution on one platform, not a multi-tenant product ~ one org on Guard Cloud with devices syncing to it, not a multi-tenant product ~ teams and workspaces per deployment, not a multi-tenant product ~ one organization per Jamf fleet, no multi-tenant product ~ multi-agent fleet, not multi-company ✗ boards per install, with authorized global discovery ✗ one policy per deployment ✓ unlimited per deployment, data isolation ✓ cross-organization trust through gateways and the exchange ✗ one company per install ✗ one company per install ✗ one log per deployment ✗ one machine, one gate ✗
Channels ✗ SDKs and UI, not messaging ✗ REST API, SDKs, webhooks, SSE, and dashboard, not messaging ✗ MCP and A2A surface, not messaging ✗ CLI and hooks, not messaging ✗ API and CLI only ✗ dashboard, API, and CLI; Slack alerting via integration packs, not a working channel ✗ endpoint sensor and Falcon console, not messaging workspace UI and APIs; consumers read system tables ✗ CLI, hooks, and the Guard Cloud dashboard, not messaging ✗ gateway endpoint and admin UI, not messaging ✗ endpoint and Jamf console, not messaging ✗ framework adapters, not messaging ✗ web UI and MCP ✗ engine and CLI, not messaging any heartbeat-capable agent surface ✗ Discord, Email, Telegram, CLI, REST, WebSocket, Slack and WhatsApp in beta Discord, WhatsApp, Telegram ✗ SDK, CLI, and .tkb bundles, not messaging ✗ CLI and hooks, not messaging ✗
Audit and evidence ✓ audit logs capturing traces with which controls triggered when and why ✓ verifiable credential per execution, offline-verifiable (af vc verify audit.json), tamper-evident audit trails ~ append-only hash-chained VAULT999 ledger with evidence references and provenance hashes; the project’s own audit finds receipt fidelity broken on the telemetry surface and no external verifier bound ~ nothing beyond the agent’s own tool transcript; no receipt or audit-chain format recorded ✓ HMAC-chained append-only Postgres, Ed25519 signatures, Article 12 report ✓ job-level decision and run evidence; Edge exports redacted evidence bundles with resolved-approval provenance ~ detections, investigation, and response records in the Falcon console, no published tamper-evident format inference tables with full payloads, system tables logging requester identity and MCP call metadata ~ local security receipts per decision, cloud-synced and searchable on paid tiers, no tamper-evident format recorded ~ request logging, metadata tracking and audit trails, user and source-gateway headers on cross-gateway calls, OpenTelemetry traces, no tamper-evident receipt format ~ on-demand Governance Report PDF of every active policy, SIEM compatible ✓ tamper-evident Merkle audit and decision records ✓ evidence gates and knowledge graph provenance ~ decisions recompute from the event log and trace to policy rules; appa yell reporting, no tamper-evident receipt format recorded ✓ immutable activity log, run ids, artifacts on issues ✓ Merkle-linked append-only audit, CSV and JSON export ✓ integrity-verified write-ahead log with SHA-256 checks ✗ none recorded ✓ Ed25519 over RFC 8785 canonical JSON in an RFC 6962 Merkle tree, C2SP checkpoints witnesses cosign, one .tkb per run verified offline against pinned keys ~ hash-chained receipt per decision (digests, not signatures) under ~/.operator/receipts; the Strata log and vestige prove verdict cards verify offline ✓ offline-verifiable decision receipts
Pricing free Apache-2.0, self-hosted; Galileo’s commercial platform priced separately free, one tier at $0, no paid plan, self-hosted free AGPL-3.0, self-hosted; the maintainer’s endpoint is public; no prices, and the project’s own audit records zero revenue free MIT free MIT, hosted bridge unpriced Community free with capacity caps (3 workers, 500 requests per second, 7-day retention); Team and Enterprise by contact, unpriced quote-based per-endpoint Falcon licensing, no public agent-security price bundled into Databricks platform usage, no standalone gateway price Guard Local free Apache-2.0; Solo $4.99, Pro $15, Team $30 per month, Enterprise by contact free Apache-2.0, self-hosted; IBM Elite Support (24x7, 2-hour SLA) by contact, unpriced bundled into Jamf for Mac Business and Enterprise plans, no standalone price free MIT free local, SaaS planned and unpriced free MIT; the sponsor’s Archestra platform is separate free self-hosted, cloud in waitlist, unpublished Community free, Enterprise $2,500/month per gateway, Exchange 0.25% per settlement free AGPL-3.0, commercial and enterprise by contact, unpriced free free MIT, self-hosted; a free two-week vendor pilot, no published prices Operator Lite free; Operator $149 once with every later version included; the memory server part of the free AGPL-3.0 build Developer $0, Hosted $299/month for 100K checks, Enterprise custom
Current status active, 327 stars, 20 contributors, v8.14.0 (2026-10-19), npm 3.4.0, pushed 2026-10-22 active, 2,611 stars, 62 contributors, RC-only train (v0.1.143-rc.4, 2026-10-20), PyPI 0.1.142, pushed 2026-10-22 active and pre-adoption, 54 stars, pushed 2026-10-23, PyPI 1!2026.10.17, zero community threads, self-measurement 10/13 floors pass with the kernel degraded (2026-10-21 stamp), independent audit 2 pass, 4 fail, 7 unmeasured active, 1,615 stars, npm 2.6.18 (2026-10-23), pushed 2026-10-23 dormant since July 2026, 0 stars, v0.7.3, last push 2026-07-23 active, 509 stars, 17 open issues, v1.2.0 (2026-10-17), pushed 2026-10-20, CAP SDKs 2.17.0 (2026-07-22) new at Fal.Con 2026 (September 2026), self-reported 99 percent prompt-attack detection efficacy under 100 milliseconds, no public repo or version active, Unity Gateway naming announced 2026-04-15, judge guardrails and unified API in beta active, 879 stars, 103 open issues, v3.55.1 (2026-10-23), pushed 2026-10-23 active, 4,623 stars, 987 open issues, v1.1.0 (2026-10-20), pushed 2026-10-22 GA since 2026-06-30, closed and Mac-only, coverage bounded by tools shipping enterprise-grade settings active, 6,425 stars, 108 open issues, v4.1.0 (2026-06-09), public preview, pushed 2026-10-23 active, 52 stars, v0.4.1 (2026-10-20), last push 2026-10-23 active preview and RFC, 1,561 stars, v0.37.0 (2026-10-20), pushed 2026-10-22, sponsored by Archestra active, about 101.6k stars since 2026-03-02, 6,425 open issues, v2026.1012.0 (2026-10-12), release paused eleven days early, 1 star, 76 commits, last push 2026-09-25 dormant, 26 stars, downloads frozen since April 2026, reopen date missed stalled March 2026, 3,621 stars, 72 open issues active and very young, 138 stars, v1.4.1 (2026-10-20), pushed 2026-10-22, created 2026-09-26, witness tier not yet public active and fast-moving, 651 stars, 44 open issues and pull requests, v5.0.0 (2026-10-18), pushed 2026-10-22, pivoted from queryless memory to the action firewall across v4.0.0 (2026-09-30) and v4.2.0 (2026-10-06) active product, repo revived 2026-10-09 with release engineering, first feature commit 2026-10-14, no new tag, 14 stars, [email protected] (2026-05-07)

Reading the matrix
#

The rows that separate a control plane from the orchestration category are governance, budgets, and multi-company isolation; the new enforcement rows (enforcement point and audit and evidence) are what separate the governance gates from the planes, and the tables show four live planes at most. Paperclip fills governance, budgets, and multi-company isolation, Cordum fills governance and dispatch-time enforcement with an enterprise tier, AgentField fills governance and per-run budgets inside its own execution fabric, and SIDJUA and TinyAGI filled some team rows and none of the surviving ones, so both are stall records; the eleven gates (Agent Control, arifOS, CC Safety Net, Code Atelier, HOL Guard, the Microsoft toolkit, Okto Pulse, OpenAPPA, Tracekit, Veto, Vestige) fill enforcement and audit while leaving team structure and multi-company empty. The category now has two centers of gravity: live planes (the open-source agent company Paperclip, the source-available dispatcher Cordum, and the agent-backend fabric AgentField) and a cluster of narrower enforcement gates, which is the more durable half because a gate can be adopted without replatforming. The gateway pair (Databricks Unity Gateway managed, IBM ContextForge self-hosted) sits between the planes and the gates, governing traffic at the request boundary rather than company org charts or individual tool calls. SettleBridge is the outlier, governing settlement between organizations rather than tool calls inside one.

The un-profiled long tail stays in prose until something clears the bar: claw-empire (about 1,400 stars, also stalled since March), multigent (69 stars), Cabinet (a knowledge-base product compared to Paperclip in its launch thread, a different problem), and OtoDock (scanned 2026-09-10: a 44-point Show HN on 2026-09-09 for its self-hosted company OS, but 111 stars, one maintainer, and a non-OSI license keep it below the bar for now; re-scanned 2026-10-04 at 188 stars, still below the bar). The agent-company project that did clear the bar, desplega-ai’s agent-swarm, is profiled one shelf over in the Orchestration category. The identity-vendor tier surfaced this run resolves as rejections: Ping Identity’s Agent Governance, Selfic, and Lyzr’s control plane are closed products backed only by marketing pages this run, with no public documentation, pricing, or independent coverage found. Two governance slices surfaced earlier and now resolve as rejections: kastra (the kastra-labs organization holds a 1-star Claude plugin and no framework repository of substance, re-checked 2026-09-29, with the name also shared by two unrelated sub-1-star agent projects) and Blue (rejected 2026-09-18 for want of adoption evidence). The 2026-10-06 scan adds three watchable rejections: AgentWatch (a live budget-enforcement proxy with public pricing, but a 4-star repo dormant since 2026-07-13, an undetected license, and its launch thread’s architecture questions unanswered), Lineation (a closed agent-security platform with no public docs, pricing, or repo), and Oconee Runtime (a closed policy-enforcement product with a marketing site only). The 2026-10-07 scan adds two: Gate22 (aipotheosis-labs’ MCP gateway control plane with role-based access and audit logging, 180 stars but no source push since 2025-12-12, so it reads as abandoned mid-hype) and Invariant (invariantlabs-ai’s Apache-2.0 guardrails-and-analyzer engine at 467 stars, quiet since 2026-01-12 after Snyk acquired the team in June 2025, a governance slice that sits below the control plane and no longer moves). The same day’s scan rejects git-ai (git-ai-project/git-ai, Apache-2.0, 2,817 stars, pushed 2026-10-07) despite adoption that would clear most members’ bars: it records which lines were AI-generated (agent, model, and prompt) in git for blame, stats, and review, but it governs nothing, with no policy, enforcement, approval, or budget function between agent intent and execution, so it is a below-the-plane provenance tracker in the Invariant family, and its closest categories (code review, session analytics) judge or measure behavior rather than record authorship. Autoheal AI joins the long tail the same day on the software-factory worker’s cross-category flag, recorded per the closed-platform precedent rather than profiled: a commercial agent-governance meta-platform for the software factory whose Evaluator and Healer meta-agents score every worker agent’s run and patch the low scorers (skills, prompts, tools, model selection) through engineer-reviewed pull requests, deployed BYOC or air-gapped, with Nomura and AvidXchange as named customers and a $7.9M seed led by Innovation Endeavors announced 2026-09-28. The 2026-10-10 scan of the same list resolves its new open-source tier below the family bar: MARGINAL (a local-first coding-agent governor that starts in shadow mode, 17 stars, active), sofagent (52 stars, active), YYLO (63 stars, MIT, active, but a merge-queue orchestrator whose home is one shelf over), shim-cli (7 stars), Impri (5), Provenza (5, license undetected), Squelette (2), LedgerGuard (0), WitnessOS (0), and Regulus (6, quiet since July), while TrinityGuard (220 stars but a multi-agent safety framework, quiet since June) belongs to the orchestration shelf, the receipt and evidence formats (CCS conformance vectors, Operational Memory Gates, proofbundle, the Agent Action Capsule family, with Nobulex and ScopeBlind protect-mcp both already merged into the Microsoft toolkit) stay below the plane in the Invariant family, Okto Nexus is already covered as the sibling product inside the Okto Pulse note, and Bifrost has been a model-access member since 2026-10-07. The closed tier resolves per the Autoheal precedent: AAES (the strongest of them, a design-partnership-stage Operate-and-Govern pair with public documentation, an OpenAPI specification, a public verifier repository, and a trust page stating plainly it has no customers and no SOC 2 report yet, at USD 40,000 founding terms for three months), AI Gateway HQ, Dome Systems, ExecLayer, Proofpane, and Speakeasy’s AI control plane are hosted or proprietary products without public code, so none is profiled. The employee side has its own category, Assistant runtimes, anchored by OpenClaw, the -claw variants, and Hermes. The 2026-10-11 scan of the same list resolves its new entrants: IBM ContextForge joined above as a member (the category’s most-adopted gateway), while Allowly (a hosted policy-decision service whose open parts are a receipt-format spec and verifier packages), CIRVIX AgentControl (1 star), Enterprise Agentic AI (a 1-star reference implementation), Kepil (5 stars, a month old), MREA (8 stars, quiet since August), and SEMAPRAX (a pre-alpha programming language that ships no production authority) stay below the bar, the Agent Passport System and Etch join the receipt-and-identity formats below the plane, the AgenTrust attestation family (Agent Manifest, cMCP, cA2A, TRACE, Weight Custody Manifest, SourceryKit) extends that same below-the-plane resolution, and Coral Server (a registry-runtimes-orchestration platform, 253 stars, no license detected, quiet since August) is flagged to the orchestration shelf; fidipro/gluon, the “control platform for coding agents” flagged by the harnesses scan, was rejected at 52 stars four days after repository creation with no releases. The 2026-10-13 scan resolves the list’s outer sections: OPAQUE Systems is a closed commercial TEE platform and the list’s sponsor, with no public code (its open parts are the agentrust-io spec family already kept below the plane); PIC Standard (67 stars, Apache-2.0, active) is a pre-v1.0 protocol for declaring intent, provenance, and evidence before high-impact tool calls, kept below the plane with the receipt formats; the probityai evidence pair (agent-evidence-admission at 2 stars, agent-evidence-vectors at 4) and oleg-vdv/agent-trace (0 stars, no license detected) are evidence verifiers below the plane; Google AgentMesh (google/sam redirects there, 1,003 stars, Apache-2.0, active) is a peer-to-peer agent mesh doing transport identity, discovery, and MCP sidecar routing rather than governance, flagged to the orchestration and protocols scans; LightAgent (1,233 stars) is a Python agent framework whose home would be orchestration if anywhere, and CorvinOS (17 stars) a self-hosted assistant runtime with a consent gate, below the bar here; and the list’s policy-engine, LLM-guardrail, observability, and security-testing sections are different layers (Cedar and OPA already sit inside member notes as engines), while SPIFFE, W3C DIDs, and the Agent Card are standards rather than entrants. The 2026-10-14 re-scan resolves the list’s new governance entries below the bar: Conarium (a MIT database-governance layer with PII masking, hash-chained audit, and Ed25519 receipts, 3 stars), Verax (an Apache-2.0 policy-gate MCP server writing signed decisions to a local ledger, 0 stars), Quilzo (a self-described one-binary control plane with identity, policy, budgets, approvals, and receipts, 2 stars), and Cedulon (VERAX Teknoloji’s agent-commerce audit layer on IETF drafts, 1 star). zeronsh/zeron (3,176 stars, MIT, v0.2.112, pushed 2026-10-13) resolves as a mission-control rejection despite its control-plane self-description: its README documents a gpui desktop app and headless daemon for starting, following, and driving coding-agent sessions across your own devices, with no policy, approval, budget, or audit function anywhere in it, so it joins the RunMaestro-class tail. greyhaven-ai/autocontext (1,307 stars, Apache-2.0, active) takes the opposite kind call: its fail-closed gates, promotion budgets, and receipts govern its own improvement loop’s context and training promotions, not third-party agent execution, so it is automated-research kind, flagged to that category without being written there. The rest of the re-scan’s growth resolves by standing families: the capsule, scitt-cose, and probityai-vocabulary records stay below the plane, the YYLO suite keeps its 2026-10-10 resolution, GOPAL sits in the policy-engine layer, LiteLLM is a model-access gateway-family duplicate, and the standards, observability, and security-testing sections hold their recorded layer resolutions. The 2026-10-16 scan resolves the list’s three new Governance Frameworks entries: arifOS joins above as a member (the category’s first self-audited kernel), its sibling executor A-FORGE folds into the arifOS note per the sibling fold precedent, and Mandare (a three-week-old spend-mandate gateway at 0 stars and 0 forks with no coverage) joins the thin tail below the bar, reopening on traction or independent coverage. Vestige joins above the same week on a routing the memory category handed over: it launched as a queryless memory layer (Show HN 2026-07-21, 4 points), but the changelog shows the pivot landing in the 4.x line (the Strata gated log in v4.0.0, 2026-09-30; the standalone fail-closed Operator Lite gate and the $149 Operator tier in v4.2.0, 2026-10-06), and a fail-closed action firewall governs what an agent may do, which passes the governs-something test the provenance recorders below the plane fail; at 651 stars it enters as the tenth gate, with the thin Show HN footprint stated in its note. The 2026-10-18 scan of the same list resolves its one new entry below the closed tier: Aident Loadout (added to the source’s observability section 2026-10-17), a hosted commercial MCP credential vault that runs agent tool calls through stored credentials, prices each action before it runs, and keeps an audit log, with only a JavaScript-shell site and an MIT-licensed client skill in public, so no source exists to profile and it stays out per the closed-platform precedent. The 2026-10-21 scan resolves the list’s three entries added 2026-10-19: Tracekit joins above as the eleventh gate (the Certificate-Transparency-style signer whose witness tier is still experimental and public witness nonexistent), CUGA (cuga-project/cuga-agent, IBM’s generalist enterprise harness with fine-grained execution policies and human-approval of tool calls, 1,045 stars, Apache-2.0) is a harness, not a plane, flagged to the harnesses shelf, and Praesidia (praesidia.ai, a proprietary governance platform for agent and MCP actions with design-partner-only SDKs, a free developer plan, and demo-gated pricing) joins the closed tier per the Autoheal precedent.

Choosing from the matrix
#

  • Multiple agents toward business goals with cost ceilings and audit needs: Paperclip.
  • Gating agent jobs at dispatch with human approvals before workers run: Cordum.
  • Building an agent backend where the services are agents, with identity, policy, and receipts in the plane: AgentField.
  • One governed, authenticated door in front of MCP, A2A, and REST tool traffic you self-host: IBM ContextForge.
  • Stopping or holding a risky tool call before it runs: CC Safety Net for destructive commands and secret paths on a workstation, HOL Guard for one guard across many coding-agent CLIs with approvals and receipts, Vestige for a shadow-first single-file gate with receipts and a one-time paid tier, Tracekit when the record has to survive the agent and convince an outsider, Veto, the Microsoft Agent Governance Toolkit, Agent Control, or Code Atelier Governance SDK for approvable actions with an audit trail.
  • Keeping sensitive data inside an authorized audience even under prompt injection: OpenAPPA.
  • Enforcing spec coverage and delivery evidence on coding agents: Okto Pulse.
  • Settling value between independent agents: SettleBridge.
  • Repo-scale parallel coding agents instead: the Orchestration matrix is the right shelf.
  • Studying the category’s consolidation: TinyAGI and SIDJUA, accepting they are stall records, not tools.

Changes
#

  • 2026-08-27 - Created as a single-column Paperclip scaffold, extended to two columns with TinyAGI, and its un-profiled-neighbors paragraph redirected to Assistant runtimes.
  • 2026-09-07 - Paperclip issues cell and long-tail prose updated.
  • 2026-09-10 - OtoDock added to the long tail on rejection.
  • 2026-09-18 - Paperclip status cell refreshed (about 81k stars, 5,497 open issues) and Blue added to the long tail on rejection.
  • 2026-09-21 - Paperclip and TinyAGI status cells refreshed (5,566 open issues; stall record unchanged).
  • 2026-09-24 - Removed the verification preamble line on owner request.
  • 2026-09-25 - Refreshed the Paperclip status cell (about 82.7k stars, 5,643 open issues, v2026.916.1 of 2026-09-21).
  • 2026-09-27 - Refreshed the Paperclip status cell (about 87.9k stars, 5,776 open issues) and the TinyAGI star count (3,621).
  • 2026-09-27 - Added columns for Code Atelier Governance SDK, Microsoft Agent Governance Toolkit, Okto Pulse, SettleBridge, SIDJUA, and Veto; re-sorted all columns alphabetically; added enforcement-point and audit-and-evidence rows; rewrote the intro and reading-the-matrix prose for eight members.
  • 2026-09-29 - Refreshed the Paperclip status cell (about 93.5k stars, 6,019 open issues) and resolved the kastra and Blue candidates as explicit rejections.
  • 2026-10-02 - Refreshed the volatile status cells (Paperclip, Microsoft Agent Governance Toolkit, Okto Pulse, TinyAGI) and moved Code Atelier Governance SDK to dormant (no push since 2026-07-23) and Veto’s repository to dormant (no push since 2026-06-18); no membership change.
  • 2026-10-02 - Extended from eight to nine columns with Databricks Unity Gateway (the managed model and MCP governance gateway inside Unity Catalog), inserted in sorted position after Code Atelier Governance SDK, traced its cells to the new note, and updated the intro count.
  • 2026-10-02 - Refreshed the Paperclip status cell (about 96.0k stars, 6,232 open issues, v2026.1001.0 published 2026-10-02); no membership change.
  • 2026-10-04 - Added the CrowdStrike Falcon Guardian column (nine to ten members), the commercial endpoint-anchored AIDR entrant, with the intro and status-row count brought along.
  • 2026-10-05 - Added the Agent Control and Jamf AI Governance columns (ten to twelve members), re-sorted alphabetically, with the intro and reading-the-matrix prose updated and the identity-vendor rejections added to the long tail; refreshed the volatile status cells (Paperclip, Microsoft Agent Governance Toolkit, Okto Pulse); also restored the chronological order of this list, where the two 2026-10-02 bullets had sat after the 2026-10-04 one.
  • 2026-10-06 - Corrected the long tail: desplega-ai’s agent-swarm is no longer listed as un-profiled because it has its own note in the Orchestration category (now linked), the claw-empire count moved to about 1,400 (still stalled since March), and the AgentWatch, Lineation, and Oconee Runtime rejections were recorded with reasons; volatile status cells refreshed (Agent Control, Microsoft Agent Governance Toolkit, Okto Pulse, Paperclip, TinyAGI) with no membership change.
  • 2026-10-06 - Added Autoheal AI to the long tail on the software-factory worker’s cross-category flag: a closed commercial agent-governance meta-platform (Evaluator and Healer meta-agents over factory agents, Nomura and AvidXchange as customers) that raised a $7.9M seed led by Innovation Endeavors on 2026-09-28, recorded in the long tail rather than profiled, so membership is unchanged.
  • 2026-10-07 - Added the Cordum and OpenAPPA columns (twelve to fourteen members), re-sorted alphabetically, with the intro, reading-the-matrix prose, and choosing list updated and both repositories added to References.
  • 2026-10-07 - Recorded the Gate22 dormancy and the Invariant rejection in the long tail, and refreshed the volatile status cells (Agent Control, Microsoft Agent Governance Toolkit, Okto Pulse, Paperclip, TinyAGI).
  • 2026-10-07 - Extended from fourteen to fifteen columns with CC Safety Net (the pre-execution command guard hooking sixteen coding-agent CLIs), inserted alphabetically after Agent Control, with the intro count, gates count, and choosing list updated.
  • 2026-10-07 - Added git-ai to the long tail on rejection: an active Apache-2.0 provenance tracker (2,817 stars as of 2026-10-07) that records AI-code authorship in git but governs nothing, so it sits below the control plane like the Invariant rejection.
  • 2026-10-09 - Extended from fifteen to sixteen columns with HOL Guard (the consortium-backed guard whose published per-harness coverage contract is its design point), inserted alphabetically after Databricks Unity Gateway, traced to its note, with the intro count, gates count, and choosing list updated.
  • 2026-10-10 - Refreshed the volatile status cells (Agent Control, CC Safety Net, HOL Guard, Microsoft Agent Governance Toolkit, Okto Pulse, OpenAPPA, Paperclip, TinyAGI, Veto); moved Veto’s repository from dormant to revived (five release-engineering commits on 2026-10-09, no new tag) and recorded Okto Pulse’s star count halving to 52.
  • 2026-10-10 - Added the 2026-10-10 awesome-ai-governance scan resolutions to the long tail: the sub-100-star open-source tier rejected with counts, TrinityGuard sent to the orchestration shelf, the receipt-format family kept below the plane, and the closed tier (AAES, AI Gateway HQ, Dome Systems, ExecLayer, Proofpane, Speakeasy) resolved per the Autoheal precedent; no membership change.
  • 2026-10-11 - Extended from sixteen to seventeen columns with IBM ContextForge (the self-hosted Apache-2.0 gateway federating MCP, A2A, and REST/gRPC traffic behind one governed endpoint), inserted alphabetically after HOL Guard, traced to its new note, with the intro count, gateway-pair prose, choosing list, and References updated.
  • 2026-10-11 - Refreshed the volatile status cells (CC Safety Net, HOL Guard, Microsoft Agent Governance Toolkit, OpenAPPA, Paperclip), with HOL Guard’s cell moving to v3.42.0 and 132 open issues and Paperclip’s to about 99.9k stars and 5,888 open issues.
  • 2026-10-11 - Added the 2026-10-11 awesome-ai-governance scan resolutions to the long tail: IBM ContextForge accepted as a member, six below-bar rejections with counts, the Agent Passport System and Etch and the AgenTrust attestation family kept below the plane, Coral Server flagged to orchestration, and fidipro/gluon rejected at 52 stars four days after creation.
  • 2026-10-13 - Extended from seventeen to eighteen columns with AgentField (the Apache-2.0 agent-backend plane with DID identity, tag policy, human approvals, cost caps, and offline-verifiable receipts built into the free build), inserted alphabetically after Agent Control, traced to its new note, with the intro count, live-planes prose, choosing list, and References updated; refreshed the volatile status cells (CC Safety Net, HOL Guard, OpenAPPA, Paperclip); added the 2026-10-13 outer-section scan resolutions to the long tail (OPAQUE Systems closed and sponsor-gated, PIC Standard and the probityai and agent-trace evidence tools below the plane, Google AgentMesh flagged to orchestration and protocols, LightAgent and CorvinOS below the bar).
  • 2026-10-14 - Refreshed the volatile status cells (Agent Control to v8.13.0, CC Safety Net, HOL Guard, IBM ContextForge, Microsoft Agent Governance Toolkit, Okto Pulse, OpenAPPA, Paperclip) and recorded HOL Guard’s coverage contract five days past its 2026-10-09 expiry without a re-review in its governance cell; added the 2026-10-14 scan resolutions to the long tail (Conarium, Verax, Quilzo, and Cedulon below the bar, zeron rejected as mission-control kind, autocontext flagged to automated research); no membership change.
  • 2026-10-16 - Extended from eighteen to nineteen columns with arifOS (the AGPL-3.0 governance kernel judging MCP agent proposals against thirteen floors with seven wire verdicts, a hash-chained ledger, and a published self-audit), inserted alphabetically after AgentField, traced to its new note, with the intro count, gates count, and long tail updated (A-FORGE folded into the arifOS note, Mandare rejected below the bar).
  • 2026-10-16 - Refreshed the volatile cells (Agent Control, AgentField, CC Safety Net, Cordum, HOL Guard’s release line and coverage-contract re-check, IBM ContextForge, Okto Pulse, OpenAPPA, Veto’s first feature commit); no membership change.
  • 2026-10-17 - Extended from nineteen to twenty columns with Vestige (the AGPL-3.0 fail-closed Operator gate with hash-chained receipts and a one-time $149 Operator tier, admitted on the memory category’s routing after the v4.x pivot), inserted before Veto in sorted position, traced to its new note, with the intro count, gates count, long-tail routing note, choosing list, and References updated.
  • 2026-10-17 - Refreshed the volatile cells (AgentField to v0.1.142-rc.14, arifOS to PyPI 1!2026.10.17, CC Safety Net to npm 2.6.13, HOL Guard to v3.49.0 with the coverage contract re-checked still unrenewed, IBM ContextForge’s issue count, the Microsoft toolkit’s issue count, OpenAPPA and Paperclip push dates); no membership change.
  • 2026-10-18 - Refreshed the volatile cells (arifOS and OpenAPPA push dates, CC Safety Net to npm 2.6.14, HOL Guard’s issue count and push date with the coverage contract re-checked still unrenewed, IBM ContextForge’s issue count and push date, Paperclip’s backlog to 6,106, Vestige’s issue count and push date); no membership change.
  • 2026-10-18 - Added the Aident Loadout rejection to the long tail on the closed-platform precedent; no membership change.
  • 2026-10-19 - Refreshed the volatile cells (arifOS push date, CC Safety Net to npm 2.6.15, HOL Guard push date and coverage-contract re-check, Okto Pulse to 0.4.0, OpenAPPA to v0.35.1, Vestige to v5.0.0); no membership change.
  • 2026-10-21 - Extended from twenty to twenty-one columns with Tracekit (the MIT Certificate-Transparency-style signer and evidence log that decides calls before they run and witnesses its checkpoints), inserted after TinyAGI in sorted position, traced to its new note, with the intro count, gates count, choosing list, and long tail updated.
  • 2026-10-21 - Refreshed the volatile cells (Agent Control to v8.14.0 and npm 3.4.0, AgentField to v0.1.143-rc.4 with PyPI at 0.1.142, arifOS to the new self-measurement against the unchanged independent audit, Cordum to v1.2.0, HOL Guard to v3.51.0, IBM ContextForge to v1.1.0, the Microsoft toolkit’s issue count, Okto Pulse to 0.4.1, OpenAPPA to v0.37.0, Paperclip’s backlog, Vestige’s issue count).
  • 2026-10-23 - Refreshed the volatile cells (arifOS to the 10-of-13 self-measurement, CC Safety Net to npm 2.6.18, HOL Guard to v3.55.1 with the coverage contract re-checked still unrenewed, Paperclip’s backlog and release pause, IBM ContextForge’s backlog, and the push dates and issue counts of Agent Control, AgentField, the Microsoft toolkit, Okto Pulse, OpenAPPA, Tracekit, and Vestige); no membership change.

See also
#

References
#