Appendix A

Digest of the principal sources

For the principal sources behind this handbook, the table summarizes what each adds and its implication for the control plane. Numbers refer to the endnotes in Appendix B. Where a source could not be retrieved, the closest corroborating research is noted.

Endnote	What the source adds	Implication
3	Agents generate thousands of small, context-heavy calls, making token costs unpredictable. Argues for a centralized control plane and economic model. Nutanix-sponsored BrandVoice content.	Build token FinOps into the control plane from day one.
4	Better orchestration and risk management could raise the autonomous-agent market by 15% to 30% by 2030, to as much as US$45 billion. 80% call their basic automation mature, but only 28% once agents are included.	Orchestration is where the premium lies.
7	Close to three-quarters of companies plan to deploy agentic AI within two years. Only 21% of them have a mature model for agent governance.	Governance, not intent, is the constraint. Build it first.
9	By Microsoft telemetry, more than 80% of Fortune 500 companies use active low-code agents. A commissioned survey puts employees’ use of unsanctioned agents at 29%.	Discovery and a registry come before policy.
10	5% of companies are future-built for AI and 60% see hardly any material value. Agents’ share of AI value is expected to rise from about 17% in 2025 to 29% by 2028.	The value gap is widening, and agents are where it grows.
11	Control planes compete for authority. Identity, orchestration, execution, data and sovereignty are the consequential planes. Written from a Microsoft-ecosystem view.	Evaluate platforms by what they govern. Most enterprises need a cross-ecosystem agent plane.
12	Agent 365 is marketed as the control plane for AI agents. Entra Agent ID moves sponsorship automatically to prevent orphaned agents.	Decide which plane is authoritative for what. Federate identities.
14	Microsoft’s adoption guidance: a centralized agent governance layer with one registry, one identity per agent, consistent policy, cost tags, audit mode first and a plan to disable agents.	Independent confirmation of the control-plane pattern.
15	Companies that faced significant technology challenges share a passively governed architecture function and insufficient executive and board oversight.	Put architecture on the board agenda with a two- to five-year horizon.
16	Salesforce exposes platform capabilities as APIs, MCP tools and CLI commands.	Capability-centric design is mainstream. Agents are first-class API consumers.
17	Agent readiness has three dimensions: embedded capabilities, operability for external agents, and trustworthiness.	Make channels and APIs agent-operable, observable and cost-managed.
18	Without MCP, integrations rise quadratically as agents spread. With reusable MCP tools, effort grows linearly. Recommends private registries, version pinning and access control on every tool call.	Expose each capability once. Allow only trusted, pinned MCP servers.
19	Source of the three architectural paradigms and “planned impermanence.” No public copy located. Both concepts also appear in the source at endnote 1.¹ Bain’s 2026 series²⁰ covers phasing: governance and trust first, orchestration next, enterprise scale last.	Federate after governance and orchestration mature.
24	Context management controls what an agent can access at each decision point.	Treat context as a governed asset, not a prompt trick.
25	Agents declare capabilities and dependencies. A registry discovers and injects them at runtime and degrades gracefully.	Capability-based discovery replaces hard-coded integrations.
29	Move from model risk to runtime assurance. A 12-month plan with autonomy levels, an allow-list behind a gateway, kill switches, immutable logs and a board scorecard.	Maps directly to Agent Registry, AI Gateway and the Kill Switch, with evaluation on any tool.
32	People who oversee high-risk AI must be able to recognize automation bias, override outputs and stop the system safely, with the competence, training, authority and support to do so. After the Digital Omnibus, the obligations apply from December 2027.	Measure oversight by the ability to intervene. Bind approvals to the actions they authorize.
33	Four agency scopes, starting at Scope 1 or 2. Autonomy reduced automatically on security events and expanded only on demonstrated performance.	Promotion on evidence, demotion by rule.
37	Seven new agentic failure modes, including supply chain compromise and inter-agent trust escalation. Mitigations include agent bills of materials and signed, pinned MCP servers.	Verify what enters the registry. Reject self-asserted roles.
38	Security has limited influence over how technology is built: only 37% of CISOs report a deep, trusted relationship with the CTO and 22% with the chief architect. The World Economic Forum’s 2026 outlook⁴⁰ finds AI the top driver of cyber change.	Security must be continuous and built in.
39	Risk and compliance are the top concerns in scaling generative AI. Organizations plan higher cyber investment as a result.	Fund trust controls as part of the AI program, not after it.
41	Google’s Agent Identity: a first-class, SPIFFE-based principal for agents, with an agent gateway and runtime defense.	Agent identity is becoming a platform primitive to federate across clouds.
42	The temporal identity paradox of long-running agents on ephemeral compute: short-lived delegated tokens, re-issued with the same scope once the delegation is rechecked. The Cloud Security Alliance⁴³ proposes per-task credentials with a five-minute default lifetime.	Credentials should expire with the task.
44	Identity attacks rose 32% in the first half of 2025. Over 97% were password attacks. Phishing-resistant MFA blocks over 99%.	Short-lived, bound agent credentials and strong authentication.
46	Draft standard for agent identity: workload identity, short-lived bound credentials, OAuth delegation and real-time revocation. Static API keys are an antipattern.	No static keys. Revocation is a second path for the kill switch.
48	Ten agentic risks, from goal hijack and tool misuse to human-agent trust exploitation and rogue agents.	Map every risk to a control and an owner.
50–53, 56, 57	Federal post-quantum mandate (executive order signed June 22, 2026, and OMB’s implementing memorandum), NIST standards, and board-level oversight of cryptographic risk.	Inventory, prioritize, migrate in phases, with board ownership.
54, 55	An Anthropic model found new attacks on a weakened, seven-round AES and on the candidate HAWK signature scheme. Deployed standards were not affected.	Build crypto-agility now. AI is accelerating cryptanalysis.
58	AI-native banking products illustrate why output integrity matters for customer-facing decisions.	Verify provenance and validate outputs before they reach customers.
59	TRiSM for multi-agent systems: explainability, ModelOps, security, privacy and lifecycle governance, plus new collaboration and tool-use metrics.	Instrument agents with evaluation metrics, not only uptime.
64	Plan for people to take over when agents are taken offline and decide the no-go zones. Incidents involving AI rose 21% from 2024 to 2025, according to the AI Incident Database.	Write and drill a takeover runbook.
67	People remain responsible for functional safety. Limit active AI control of OT without a human in the loop. Build failsafes so AI fails gracefully.	Keep safety systems independent of agents. Agents propose and people approve changes to equipment.
70	Personal open-source agents such as OpenClaw run on employees’ own machines, where they can run commands, read and write files and hold credentials. One security vendor found employees using OpenClaw at 22% of its customers.	Make the governed path the easy path. Pair it with endpoint controls.
79	More than half of CEOs report no significant financial benefit from AI so far. Those with strong AI foundations are three times more likely to report meaningful returns.	Treat the control plane as the foundation for returns, and tie each phase to measured value.
80	About a third of organizations attribute any EBIT impact to AI. High performers redesign workflows and build a repeatable capability rather than accumulating pilots.	Redesign one workflow at a time on shared foundations, and scale what proves out.
81	Most generative AI pilots show no measurable profit impact. Successful deployments start in adjacent processes, prove clear value, then scale into core workflows.	Phase each use case so every milestone proves value before the next is funded.
82	Typical AI payback is two to four years, against seven to 12 months for other technology. Only 6% saw payback within a year. Leaders judge generative and agentic AI on different frameworks.	Phase for early payback, with separate horizons for agentic work.
85	Becoming AI-first is 30% technology and 70% people and organization. Sort work into human-led, AI-assisted and AI-led by asking whether AI could and should do it.	Put an operating model beside the architecture.
88	Organizations with agents in their workflows rose from 13% to 30% in a year, yet half of respondents say governance for teams of people and AI is unclear.	Measure value, not adoption.