From north star to plan

This is the north star: a vendor-neutral target reference architecture that turns the research in the first half of this briefing into what good looks like. Use it as the yardstick for any platform decision. The next slide shows it realized with MuleSoft Agent Fabric and Informatica.

The layers:

1. Consumers and workloads: agents from any platform, copilots and assistants, MCP clients such as Claude, Slack and Teams, apps and workflows, and partner systems.
2. Control plane, the one policy point: a registry of agents, tools and models with owners and risk tiers, plus orchestration with deterministic gates. It also includes an AI gateway for model, MCP and A2A traffic, agent identity with bounded authority, and evaluation, observability and a kill switch.
3. Models: frontier, open-source, specialized, self-hosted and packaged SaaS models, chosen per task within cost, latency and regulatory limits [1].
4. Capabilities and data: business capabilities exposed once as governed APIs and MCP tools, plus connectors, document processing and automation, and trusted data, with master data, quality and lineage.
5. Infrastructure and resilience: multi-cloud and edge, managed or sovereign runtimes, post-quantum-ready transport, OpenTelemetry and audit logs, and failover with model fallback.

Across every layer: zero-trust security and governance, including policy as code, cost per outcome, evaluation before promotion and human oversight that people can exercise.

Principles: one policy point, capabilities not channels, open by default (MCP and A2A), trust by design, economics built in, and adoptable in stages. Each layer delivers value on its own, so the plan can return value in every phase. Control planes compete for authority over identity, orchestration and data [11], and published guidance on architecting for agentic AI starts with governance and a single policy point [20].

Design rule: nothing in layer 1 calls layer 3 or 4 directly. Every agent-to-model and agent-to-tool call traverses layer 2. In operational technology the rule extends one layer down: no agent reaches a control system except through a governed conduit, and independent safety systems sit beneath everything.

This slide shows the north star realized: every layer of the vendor-neutral architecture maps to a MuleSoft or Informatica capability. The control plane (layer 2) sits between consumer workloads and the models and data beneath, and applies identity, policy, routing, cost controls and audit to every agent-to-model and agent-to-tool call.

How the layers map:

1. Consumers and workloads: agents from any platform (Agentforce, Copilot Studio and Foundry, Bedrock AgentCore, Gemini Enterprise Agent Platform), copilots and MCP clients such as Claude, Slack and Teams, and B2B systems, discovered by Agent Scanners and registered in Agent Registry [21].
2. Control plane, MuleSoft Agent Fabric: Agent Registry and Scanners (inventory), Agent Broker (orchestration), AI Gateway (one policy point for LLM and MCP traffic), Trusted Agent Identity, and Agent Visualizer and AI cost controls [21].
3. Models: five model classes, routed per task by AI Gateway's intelligent model routing, with token-based rate limits and spend attribution [1][21].
4. Capabilities and data: MuleSoft system and process APIs, MCP Bridge and connectors with IDP and RPA, plus Informatica for master data, data quality, catalog and lineage (with data services exposed to agents through Informatica's MCP servers) and Salesforce Data 360 for customer data [21][77].
5. Infrastructure and resilience: multi-cloud and edge, CloudHub or customer-managed Runtime Fabric, post-quantum-ready transport, OpenTelemetry and audit logs, and failover.

Across every layer: Omni Gateway policies (including custom ones), Trusted Agent Identity, the Agent Kill Switch, Agent Visualizer and OpenTelemetry traces, and Informatica governance and lineage.

Design rule: nothing in layer 1 calls layer 3 or 4 directly. Every agent-to-model and agent-to-tool call traverses layer 2. In operational technology the rule extends one layer down: no agent reaches a control system except through a governed conduit, and independent safety systems sit beneath everything (reference use case 3 applies this to a gas pipeline operator).

How Agent Fabric covers the control-plane requirements:

1. Breadth: it governs agents regardless of where they were built. Scanners discover and register agents, MCP servers and APIs from ecosystems including Amazon (Bedrock and AgentCore), Google (Gemini Enterprise Agent Platform, formerly Vertex AI), Microsoft (Copilot Studio, Microsoft Foundry), Claude, Databricks and Kong [21].
2. Depth: it is built on MuleSoft's integration and API management foundation, so agents can take action in the systems where work happens as well as answer questions.
3. Enforcement at runtime: policy, identity, rate limits and the kill switch are applied in the gateway path [21].
4. Economics: token visibility, spend attribution and intelligent routing connect AI spend to business value [21].

Be precise: governance is applied to agent traffic that flows through MuleSoft [21]. The architecture principle is therefore to route every agent-to-model and agent-to-tool call through the fabric. Shadow agents running on endpoints still need endpoint and identity controls. Decoys help find what inventories miss: honeytoken credentials, canary documents and decoy MCP tools that no sanctioned agent should ever touch, so any use flags an agent working outside the governed path. A custom Omni Gateway policy family can plant and watch them [78].

Relationship to Agentforce: Agentforce is an agent platform for building and running agents in Salesforce. Agent Fabric is the control plane that registers, governs, orchestrates and observes all agents and MCP endpoints, including Agentforce. Both use the same engine for defining how agents reason, plan and act [21].

How to use this slide: it maps each control-plane requirement to a specific MuleSoft or Informatica capability [1][21].

• Trusted data: Informatica Multidomain MDM, Data Governance and Catalog and data quality, with data services exposed to agents through Informatica's MCP servers, such as CDGC Metadata Search and Address Verification [77].
• Output integrity: Agent Visualizer adds confidence, bottleneck and hallucination-risk signals [21]. The evaluation itself runs on any tool that scores outcomes before release, with the results recorded in the registry [62][63].
• Custom: Omni Gateway runs custom policies written in Rust and compiled to WebAssembly with the Policy Development Kit [78]. Approval-to-Execution Binding (the executed MCP or A2A action must match its approval, including a freshness check against the gateway's own clock and a separate attester), Cross-Session Aggregate-Risk Gate (reserve-then-authorize against a shared exposure budget) and decoy and honeytoken policies (planted credentials and tools that flag any agent working outside the governed path) are custom policies, not MuleSoft products. The customer or partner owns their testing and support.

Most enterprises already run more than one agent control plane, so "why another one?" is a fair question. Microsoft describes Agent 365 as "the control-plane for AI agents", with Microsoft Entra Agent ID for agent identities [12]. AWS offers Amazon Bedrock AgentCore (Runtime, Memory, Gateway for MCP servers, Identity and OpenTelemetry-compatible Observability) [62]. Google's Gemini Enterprise Agent Platform includes Agent Registry, Agent Gateway and Agent Identity [47]. Agentforce runs agents in Salesforce data and processes.

Each governs its own estate well. The answer is a division of labor, agreed up front: which system is authoritative for inventory, identity, policy and telemetry. A workable default keeps each native plane authoritative for identity and runtime inside its estate. MuleSoft Agent Fabric is then authoritative for the cross-estate inventory, policy on every call into enterprise capabilities and data, orchestration across vendors, and cost and audit [21]. Microsoft's own Cloud Adoption Framework takes the same approach inside its estate: it names Agent 365, or Entra Agent ID where Agent 365 is not in use at scale, as the authoritative inventory and asks for consistent policy across every agent platform [14].

Value comes first: this is a reference architecture adopted incrementally, and every phase delivers something the business can see. The research supports the approach: 56% of CEOs report no significant financial benefit from AI so far, yet strong AI foundations make meaningful returns three times more likely [79]. High performers build a repeatable capability instead of accumulating pilots [80], and successful deployments start in adjacent processes, prove clear value, then scale into core workflows, with top performers moving from pilot to full implementation in about 90 days [81]. Each phase is funded against the value the previous one proved.

By Phase 4 the organization has an agile, model-agnostic control plane that can swap models without recoding applications, and each use case runs at its full run rate.

Why this sequence:

• Phase 1 is visibility plus a single policy point: Agent Scanners and Agent Registry for inventory, AI Gateway for LLM and MCP traffic, and a governance council and published autonomy tiers (the first 90 days of the CDO Magazine plan [29]). Start new policies in audit mode, then enforce, as Microsoft's Cloud Adoption Framework recommends [14]. Value: spend and risk visible by use case, unused agents retired, and the first use-case slice live in assist mode.
• Phase 2 opens up the enterprise: expose the highest-value capabilities through MuleSoft APIs and MCP Bridge, then turn on model routing and token-based rate limits so cost per outcome becomes measurable [21]. Value: every new agent reuses governed capabilities, and routine work moves to lower-cost models.
• Phase 3 hardens trust: Trusted Agent Identity with bounded delegation, enforced tiers with approvals bound to the actions they authorize, kill-switch and approver drills, evaluation in release pipelines and monthly red-teaming. Value: agents can act in systems of record under bound approvals, which is where most of each use case's business case sits.
• Phase 4 federates: multi-agent orchestration across domains through Agent Broker and A2A, post-quantum migration for control-plane traffic ahead of the 2030–2031 federal deadlines, and discovery and registries federated across domains. Value: all goals met, with new use cases starting on shared controls.
• Bain [20] supports doing federated discovery and cross-domain routing last, because they add complexity that is only justified once governance and orchestration are mature.

Use this slide to answer the ROI question directly. The top row is the research. More than half of CEOs report no significant financial benefit from AI so far, but organizations with strong AI foundations are three times more likely to report meaningful returns [79]. Of the organizations surveyed, 37% attribute any EBIT impact to AI, and high performers redesign workflows and build a repeatable capability rather than accumulating pilots [80]. Top performers move from pilot to full implementation in about 90 days, starting in adjacent processes and scaling into core workflows once value is proven [81].

The table shows how each reference use case is phased with the plan. Each column is a separate illustration from a different industry, not a sum. Values are illustrative annual run rates at each milestone, before platform, model and change costs, derived from each use case's business case:

• Use case 1 (10,000 launches a year): month 3 covers one service line in one region, about a tenth of launches, with effort down from 14 to 10 hours (about $0.5M). At month 8, half of all launches get letters, budgets and staffing proposals (about $8M: capacity $3.6M, utilization $4.5M). At month 12, every launch is covered, with SAP setup gated on the partner's bound approval and all KPI targets met (about $30M). Cumulative value reaches about $33M by month 24.
• Use case 2 (1,500 exceptions a day): month 3 covers one market and asset class, with handling time down from 18 to 13 minutes (about $0.8M). At month 8, all markets are covered, with the SSI golden source and one-click fixes (about $5.5M). At month 12, tier 3 automation runs within cross-session limits and bound SSI approvals, with 40% auto-resolved and 9-minute handling (about $9.8M), plus fewer fails and penalties. The cumulative total is about $12M by month 24.
• Use case 3 (40 stations): month 3 gives advice only, at 8 stations (about $0.4M). At month 8, planning, crew and permit agents run at all stations with no changes to equipment (about $1.8M). At month 12, setpoint proposals run under bound, 10-minute approvals after stop drills pass (about $3M). By month 24 the cumulative value is about $3.8M.

The pattern: the early milestones release capacity from assembling, checking and drafting in read-only or propose-only modes, and the larger gains arrive once agents can act in systems of record under the approvals and limits that phase 3 puts in place.

The benchmark band: finance will test the month-3 and month-8 run rates against published payback data. In Deloitte's 2025 survey of 1,854 executives in Europe and the Middle East, most reached satisfactory ROI on a typical AI use case within two to four years, against the seven to 12 months expected of technology investments, while only 6% saw payback within a year, 10% see significant ROI from agentic AI today and 85% of the survey’s AI ROI leaders use different frameworks or timeframes for generative and agentic AI [82]. In KPMG's 2025 Global CEO Outlook, 67% of 1,350 CEOs expected AI returns within one to three years, where a year earlier most expected three to five [83]. Google Cloud's 2026 survey of 2,403 executives found 84% seeing increasing financial returns from AI and 26% seeing returns accelerate [84]. Phasing lets the program beat the benchmark, because read-only slices pay back within months and fund the controls the larger gains depend on.

The plan names one accountable executive and a governance council. This slide shows the day-to-day model beneath them.

Why it matters: BCG estimates that becoming AI-first "involves 30% technology and 70% people and organization" [85]. In Microsoft's 2026 Work Trend Index (20,000 people using AI at work in 10 countries), only one in four said their leadership is clearly and consistently aligned on AI, and organizational factors accounted for more than twice the reported impact of individual ones [86]. In Google Cloud's 2026 survey, 48% of the organizations whose AI returns are accelerating had "extremely clear" ownership and decision rights for AI and agentic initiatives, and 38% built required AI training into roles [84].

The roles: the accountable executive owns the program and decides which phases proceed. The AI governance council (architecture, security, risk, data, finance and the business) owns policy, tiers and no-go zones. The business owner is accountable for value and decides which steps stay human. Each agent has a sponsor who owns it from registration to retirement and recertifies it. The platform team runs the control plane as a product. Security and risk can block a release or demote an agent, and finance owns cost attribution and how value is reported.

Could AI, should AI: BCG suggests sorting work into human-led, AI-assisted and AI-led by asking whether AI could do each step as well as or better than people, and whether it should, given regulatory risk, customer trust, ethics and safety [85]. Record the answer before any decision on roles: Deloitte's 2026 Human Capital Trends found that 57% of leaders who cut staff because of AI have come to question that decision [87]. Build skills in step with the plan: approvers on what they approve, sponsors on the lifecycle, business teams on working alongside agents.

Treat the control plane as a product with an owner, a plan and a scorecard. Arrows show the desired direction. Reporting cadence follows the CDO Magazine plan [29].

Stress AI cost visibility, because in KPMG's Q2 2026 pulse only 26% of organizations had full, real-time visibility into AI operating costs [8]. Also stress time to contain, which includes handing the stopped agent's open work to a named person, tested in takeover drills.

Leading indicators, one per metric, so delivery teams see movement within weeks: unregistered agents found (coverage), new agents launched behind the gateway (governed traffic), cost per successful task (cost per outcome) [60], spend attributed within a day (cost visibility), acceptance rate counting undo and revert as rejections (value) [60], blocked calls per 1,000, with exposure-limit refusals counted separately (policy enforcement), drill time (time to contain), tool-selection accuracy and plan adherence on sampled traces (eval pass rate) [60], verification latency (oversight coverage), takeover rate (oversight effectiveness) [60], and algorithm agility (crypto readiness). Evaluate the trajectory as well as the answer [60], and measure value instead of adoption. In BCG's 2026 survey of close to 12,000 employees and leaders, organizations with agents in their workflows rose from 13% to 30% in a year, yet half said governance for teams of people and AI is unclear [88].

Questions the board should be able to ask, and management should be able to answer:

1. Which agents are running today, who owns and sponsors each one, what tier is it, and when was it last recertified?
2. What share of our model and tool traffic is governed by a single policy point?
3. Which system is the authoritative record for our agents' inventory, identity and policy across Microsoft, AWS, Google and Salesforce?
4. What do we spend per resolved task, by use case, and is it falling?
5. What share of our AI spend can we attribute to an owner and a use case today?
6. Which phase of the plan are we in, and what value has each live use-case slice delivered against its business case?
7. Before any decision on roles or headcount, have we agreed which work stays human-led, which is AI-assisted and which AI-led, and why?
8. How quickly can we stop an agent or revoke its credentials?
9. If we switched off our most important agent today, who would take over its work, and when did we last rehearse that?
10. Can we prove who, or what, authorized a given action, and on whose behalf?
11. Could the people who approve our riskiest agent actions actually stop one in time, and when did we last prove it?
12. What happens by default when an approval expires or monitoring goes quiet?
13. Which agents passed evaluation before promotion to production?
14. Which recognized agentic threats does our design cover, and who owns the gaps?
15. If a model provider changed its pricing or suffered an eight-hour outage tomorrow, would our business halt?
16. Where does asymmetric cryptography protect our most sensitive data, and what is the migration plan for the 2030–2031 horizon?
17. Where can an agent's action reach physical equipment, and what independent layer stops it if the agent is wrong?

Data sources in Agent Fabric: Agent Registry (coverage, owners, tiers), AI Gateway and LLM Governance (traffic, tokens, cost, cost attribution, policy events), Agent Kill Switch and Trusted Agent Identity (containment and authorization records), Agent Visualizer and evaluation results (quality and risk signals). Oversight effectiveness comes from the approval-binding policy's events and from kill-switch and approver drill records. Policy enforcement also counts the exposure-limit breaches that the custom aggregate-risk policy refuses, so the scorecard tracks limits on what agents do as well as on what they spend. Coverage counts who is assigned, while effectiveness shows they could intervene in time [30][31][32]. Value realized comes from business-case tracking agreed with finance: the run-rate value of each live use-case slice against its plan, reported at every milestone.