Designing a control plane for autonomous agents

Most agent tooling observes; almost none controls. A control plane that can start, stop, and restart autonomous agents is a fundamentally different artifact, because act is a security boundary, not a UI feature.

The threat model is the design

The control plane's primitive is process lifecycle over live agents — inherently a dangerous capability. The design question is: what is the smallest surface that can express the needed operations and nothing else?

The answer: the control plane doesn't accept commands from clients at all. It accepts selections over a pre-approved set.

Capability-based, not command-based

Actions are an allowlist defined statically in a host config file. The API accepts a single shape:

{ "action": "restart", "target": "trading-monitor" }

and resolves it against that table. There is no eval, no subprocess with client-derived argv, no shell interpolation. Client input can only index into a fixed, reviewed set of actions — never construct one.

That's capability-based security: the protocol's grammar is the sandbox. The dangerous operation (arbitrary execution) is inexpressible, not merely disallowed.

One event contract

Visibility is the other half. Frameworks emit heterogeneous logs, so the control plane defines a single append-only JSON event schema, and every framework becomes an adapter that normalises into it.

logs → adapter → event stream → dashboard      (observe)
dashboard → control API → executor             (act)

A new framework is one adapter file, not a rewrite. That's what keeps the system small enough to actually run.

Zero-dependency, single-binary discipline

The server is stdlib (http.server), the UI one HTML file, no third-party imports. Incident-path software has to boot on a cold host — no network, no build step — when something is already on fire.

What "control" actually requires

Kill switch — immediate, unconditional stop.
Lifecycle — start / stop / restart with observable state.
Approval flow — for anything mutating or paid.
Single live pane — every agent, one place.

Everything else is polish.

The lesson

Safety is a property of the protocol's grammar, not a bolt-on. A control plane earns trust by making the dangerous thing inexpressible.

Autonomy is great until it isn't. When it isn't, you want a button — and you want that button to only ever do what you pre-approved.