The Agentic Control Plane Is Fake

Fire your AI security vendor, because snake oil shouldn't cost this much | Edition 57

I want you to imagine infinity.

What are its dimensions? How many possibilities does it contain?

Now I want you to imagine a sea of infinities.

We can call this vast ocean of infinities a set.

Each with its own dimensionality, each containing its own vast set of possibilities.

How many possibilities–in total–does this set of infinities contain?

Another way to think of this problem: Imagine now a network of infinities, all interconnected.

Image: An interconnected network of infinities.

If you could network a set of infinities, connecting all their possibilities and possible outcomes, how many possibilities would your network contain?

How would you count them?

Could you map them all? Could you trace each potential trajectory within each infinity, find its logical end, and determine whether it was a desirable outcome, or not? If such an endeavor were possible, how long would it take?

Image: The reality is a graph of connections/possibilities in a network of infinities would expand outward too fast to represent graphically or computationally.

Would there be any other way to evaluate and choose possible trajectories within this set of infinities? If not, how would you possibly choose?

Hold this in your mind for a moment.

Infinity is vast. It can be hard to visualize. But counterintuitively, as we increase the dimensional space, sometimes it becomes easier. Sometimes, imagining a set of infinities and their interactions is necessary to understanding a complex system. So it’s worth trying.

Now let’s add some details.

First, these infinites receive inputs, and the set of all inputs any infinity might receive is, as you may have guessed, infinite.

So we are additionally looking at not only infinite connections, but also infinite possible inputs.

The further reality of LLM based systems: Every connection in such a network would also be an intake point for infinite possible inputs.

There are other constraints: These infinities operate in the physical world, so they can communicate and affect the behavior of other infinities–but because they operate in the physical world, the messages take time to pass, and are subject to memory degradation.

In other words: Messages can be passed, but they take time–even if it’s only a little, it adds up–and as they are passed, they lose fidelity.

Now imagine a single original message, which originates at the start of a network of infinities. As the message propagates throughout the network, it reaches a new infinity with instructions.

But each infinity is, of course, infinite, and there is no determining the trajectory a message will take before it is passed to the next infinity in the network.

And because the messages will degrade naturally as they are copied, fidelity is already lost at some point of graph propagation.

So what do you think would happen in such a system?

If you guessed an incalculable explosion of possibilities, you guessed right.

If you ran a network of infinities, you could never, ever predict outcomes to any reliable standard. Because you could never, ever see all the outcomes, or even preserve fidelity in a system that depends on the passing of messages.

If you deploy LLM-based AI Agents, this is exactly what you run.

Image: A network of infinites, but give it access to tools. This is a basic Agentic deployment.

Let’s return to the constraints: Message fidelity and time.

The messages themselves are deeply problematic. Not only is the loss of fidelity catastrophic to system integrity, message passing itself is deeply embedded in the architecture–meaning the system cannot function without the passing of messages.

In fact, both messages and data are passed in a single channel, compounding this vector viciously.

So now we have a system that depends on the passing of messages, which may contain both instructions and data.

Messages which become increasingly unreliable each time they are passed.

In any system where information is stored or passed, it’s known that information degrades over time. It also tends to degrade each time it is copied–and this is why rigorous data checks to ensure data fidelity exist in the first place.

If you’ve ever checked a file’s hash, you’ve performed a data fidelity check–and for good reason.

Here’s another constraint: In the physical world, physical systems operate with lots of noise. Mitigating the effects of this noise takes resources, often including time.

Let’s remember here that each message also takes time to pass. So now we’re dealing with the latency of both noise mitigation, and the physical realities of passing the messages themselves.

Now let’s do a thought experiment: Assuming you worked with a non-AI, fully deterministic network, how large of a network would you need to operate before checking for message fidelity became infeasible–either computationally, or for user experience?

In a production environment, not large, I’d wager.

Even if you worked with a static, deterministic network that only passed messages, your system would still be subject to the constraints of fidelity and time.

But that’s not what you run. You’ve deployed a network of infinities.

Not only that, but these infinities now have capabilities to act, making them something closer to a cohort than a set.

Image: A typical Agentic deployment architecture, represented as a cohort of infinities. This representation appears closed, but is in fact open to infinite possible inputs at the node of each infinity.

Looking at the typical, simplified enterprise Agentic deployment architecture above, how many single points of failure (SPOFs) can you count?

How many such architectural configurations do you think exist? How many have similar SPOFs?

As a point of fact: This architecture is vastly simplified. In an enterprise deployment at scale, you might deal with thousands of Agents, e.g. thousands of infinities.

And here is where I inevitably get the pitch: Agentic control plane is the solution–we’ll just limit what actions a cohort of infinities can take!

The problem is that if you were to limit the ability of an Agentic system to act until it could only follow certain narrow constraints, what you have created is not AGI, it’s an automated workflow.

One that a teenager could’ve coded in python.

Here is one of the best examples I could find: A viral post from r/AI_Agents that’s been making the rounds as an example of when not to use AI Agents.

Image: Popular post from Reddit, where a user posits to be conservatively applying AI, apparently never having heard of natural language processing

The problem: This person claims to steer clients away from unnecessary Agentic systems, but then their example of a workflow that requires Agentic applications is….sorting email maintenance requests into categories based on their content:

“I’m not anti-AI though. I built an AI agent earlier this year for a property management company. Tenants text in stuff like “my sink is leaking and the hallway light has been out for a week.” That’s two problems in one message. The agent reads it, figures out which vendor handles plumbing and which one handles electrical, checks who’s responsible based on the lease, and sends both requests out with the right priority….That one needs AI because people write messy, unpredictable messages and someone has to interpret each one. You can’t set a rule for that the way you can set a reorder point.”

Gentle reader, this is a task that has been easily automated using classical natural language processing methods since dinosaurs roamed the earth.

And I am only exaggerating slightly.

You absolutely can and should use natural language processing rules to interpret these types of messages; the cost would be a fraction, and it would eliminate token costs altogether–as well as eliminating reliance on an unstable 3rd party platform.

And the slightest modicum of AI knowledge from prior to 2023 would have told this “consultant” that.

This task does not require a network of unstable infinities. It requires regex.

This will hurt feelings, but the truth is that once you are able to constrain your unstable network of infinites into only the behaviors you desire, you will have almost certainly created something which approaches a deterministic network–just with more tokens, and infinitely more security vectors.

Common sense and a little bit of logic should tell you this. Anyone who says they can control a network of infinites is bullshitting you. Full stop.

And if they could, they’d be enabling you to pay tokenmaxxed costs for something you could accomplish with regex.

But again, they can’t.

Stay frosty.

The Threat Model

• The Agentic control plane cannot exist in reality, because definitionally autonomy with infinite input sets cannot be constrained–either computationally or practically.

• By the time you have constrained an Agentic deployment to behave under control, you have almost certainly just automated a workflow–except with far more steps, cost, and liability.

• Any vendor who sells you this control plane is selling snake oil–If you haven’t fired your AI security vendor and replaced them with a threat model, now is a good time to start.