Toolkit · Template

Client report template

The client-facing report, with prompts to replace. Grey italic text is a prompt, and paragraphs with a blue bar are guidance to delete.

AI Control Plane Assessment

[Client name]: [use case name]

Assessment report: the use case, what discovery found, the recommended architecture, and a phased plan with value at every milestone

Prepared by [name, title] for [client name]

[Month year]

How to use this template

This template is the written companion to the AI control plane assessment readout. It follows the same storyline as Part 2 of the client deck, in twelve sections and five appendices. Fill it from templates T1 to T13 in the guide Assessing an AI Control Plane Project. Part 3 of the guide shows every template filled in for reference use case 1 and is the model answer.

Replace every [bracketed prompt]. Paragraphs styled like this one are guidance: leave them out of the report you send, including this page. Search your report for “[” to find any prompt left.

Replace each figure placeholder with an image of the matching slide from Part 2 of the client deck, so the report and the readout match.

Describe each product capability by what it does, from public information, and label custom policies built with the Policy Development Kit as custom. Label every figure illustrative until the baseline is measured and finance agrees the method, and show a formula with every value.

Cite sources with superscript numbers from the shared endnote list in The AI Control Plane Handbook, and list only the sources you cite in Appendix D, with the same numbers.

Use these names. MuleSoft Agent Fabric is the control plane, and MuleSoft APIs, connectors and MCP Bridge are the capability layer. Informatica is the data foundation, and the runtime is CloudHub (MuleSoft-managed) or Runtime Fabric (customer-managed).

Before sending, run the quality checklist in Section 10 of the guide, and fill in your report’s cover, header, footer and document properties (title and subject).

The toolkit’s license, its additional permissions and the full notices are in Appendix E of the guide, and a note about the author is in Appendix F.

1. Executive summary

Write this page last, on one page: the use case, the value, the recommendation, the plan and the decisions. Fill it from T1, T2, T11 and T12. It matches slides 28, 46 and 48 of the client deck.

The challenge

[Two or three sentences in the client’s words: the process, what it costs today in time, money and risk, and why it matters now.]

The recommendation

The recommended approach is governed agents for [the process], with people keeping every accountable decision, on one AI control plane: MuleSoft Agent Fabric as the control plane, MuleSoft APIs, connectors and MCP Bridge for the capability layer, and Informatica as the data foundation. [One or two sentences on why this fits the client’s goals and how it starts.]

The value and the plan

Value at full run rate	[About $X million a year released or protected, before platform, model and change costs (illustrative until the baseline is signed off)]
Month 3	[What goes live in the first slice, and its run rate]
Month 8	[Wider scope, and its run rate]
Month 12	[Every case, gated writes under bound approvals, and its run rate]
Month 24	[All goals met: the run rate sustained, and cumulative value by month 24]
Headline KPIs	[Two or three KPIs, each with its baseline and 12-month target]

Decisions requested

Name an owner: [the accountable executive, the AI governance council and a sponsor for every agent].
Fund phase 1: [the first 90-day slice, in one scope].
Adopt the standards: API-led connectivity, MCP and A2A as enterprise policy, with every agent registered and routed through the control plane.
Agree how value is reported: baseline the KPIs with finance now and report value at every milestone review.

2. The use case at a glance

Fill from T1. Name the use case after its business outcome, show who keeps each decision, and say what is out of scope. Give each stage a work mode (human-led, AI-assisted or AI-led) and the reason for every human-led step. It matches slides 28 and 32.

[One sentence: who uses governed agents to do what, and the result for the business.]

Use case	[Name, after its business outcome]
Problem today	[The chain of manual, risk-sensitive steps and what the delays and errors cost]
Target state	[What agents do, what people keep, which systems are involved]
Trigger	[Event that starts the process]
End state	[What is true when it is done]
Users	[User groups]
Systems of record	[Systems the process runs on]
Out of scope	[What the first phase excludes]

Stages

Stage	Human step	Work mode	Agent and tier	MCP tool or API	System of record
[Stage name]	[Decision or none]	[Human-led, AI-assisted or AI-led]	[Agent (Tier n, mode)]	[Tool or API]	[System]

[Figure: slide 32 of the client deck, the use case at a glance]

Figure 1. [Use case] at a glance: the stages, the agent and human step in each, and the governed path to each system of record.

Goals

Goal	Type	Measured by
[Goal]	[Business or control plane]	[KPI]

3. What discovery found

Fill from T3. Summarize discovery: the counts from the asset inventory and four findings with evidence the client will recognize. One finding should describe the AI estate today, including any agent control planes already in use. The full inventory is in Appendix A. It matches slides 30 and 31.

[One sentence on how discovery ran: the workshops, the documents and data reviewed, and the tools used.]

Systems of record	Agents	Models	MCP tools to publish	Master data domains	Policies and controls
[n]	[n]	[n]	[n]	[n]	[n]

Findings

Finding	Evidence	What it means for the plan
[Finding, as a short headline]	[What discovery showed, with numbers or examples]	[The requirement, phase or risk it drives]

[Figure: slide 31 of the client deck, every asset the use case touches, by layer]

Figure 2. Every asset [the use case] touches, by layer, and the phase in which each is needed.

4. The value at stake

Fill from T2 and T6. Show one formula per lever with its inputs and their source, keep values before platform, model and change costs, and describe risk avoided in words and evidence, without inventing a number. It matches slide 33.

[One sentence: the value at full run rate and where it comes from.]

Value lever	How the solution delivers it	Formula and inputs	Annual value (illustrative)
Capacity released	[How]	[Volume × unit × value]	[$]
Revenue protected or accelerated	[How]	[Volume × unit × value]	[$]
Utilization and throughput	[How]	[Volume × unit × value]	[$]
Cost avoided	[How]	[Volume × unit × value]	[$]
Risk avoided	[How]	[Volume × unit × value]	[$]
Total at full run rate			[About $X a year]

Assumptions

Assumption	Value	Source	Agreed by
[Volume, rate or cost]	[Value]	[System or person]	[Name, date]

Key performance indicators

KPI	Definition	Baseline	Target (month 12)	Data source
[KPI]	[What is counted, from when to when]	[Baseline]	[Target]	[System]



Agent quality	Evaluation pass rate for the agents’ key outputs	Not measured	[Target]	[Evaluation tool]
Governed AI traffic	Share of model and tool calls through the AI gateway	Not measured	100%	AI Gateway
AI cost per [outcome]	Model and platform cost per outcome	Not measured	Within target	LLM Governance Finance
AI cost visibility	Share of model and tool spend attributed to an owner and a use case within a day	Not measured	100%	AI Gateway LLM Governance

5. What it must do

Fill from T4. Show the requirements the architecture turns on, about four per type. The full register is in Appendix B. Each keeps its ID, priority, phase and KPI. Include the operational requirements the control plane needs: evaluation before promotion and on live traces, cost attribution by owner and use case, and a takeover runbook for any agent at tier 3 or above. It matches slide 34.

[One sentence: how many requirements are in the register, and the few that shape the design most.]

ID	Type	Requirement	Priority	Phase	KPI
[BR-01]	[Business]	[Requirement and how it will be tested]	[Must]	[1–4]	[KPI]

6. Security and compliance

Fill from T5. Give one or two lines of controls per layer and what enforces each, the threats the design covers with the owner of each gap, and the evidence each obligation requires. For every agent, show its tier, the evidence to promote it, what demotes it and who takes over its work. It matches slide 35.

Security follows zero-trust principles: every actor is authenticated, every call is authorized for the specific task, and nothing is trusted because of where it sits on the network.⁹⁰ Every agent has an autonomy tier that sets how much it may do on its own, and every write to a system of record needs an approval bound to the exact action, or a person. Agents move up a tier only on evidence and drop a tier automatically on defined triggers, and every agent at tier 3 or above has a takeover runbook.

Layer	Controls	Enforced by	Phase
Users	[Controls]	[Capability or system]	[1–4]
Agents	[Controls]	[Capability or system]	[1–4]
A2A	[Controls]	[Capability or system]	[1–4]
MCP	[Controls]	[Capability or system]	[1–4]
APIs	[Controls]	[Capability or system]	[1–4]
Models	[Controls]	[Capability or system]	[1–4]
Data at rest	[Controls]	[Capability or system]	[1–4]
Data in motion	[Controls]	[Capability or system]	[1–4]
Audit	[Controls]	[Capability or system]	[1–4]

Autonomy by agent

Agent	Tier	Human role	Approval bound to	Limits and kill switch	Who takes over
[Agent]	[Tier]	[Who decides]	[Action and validity]	[Limits]	[Team, at tier 3 or above]

Promotion and demotion

Agent	Evidence to promote	Demotion triggers
[Agent above tier 1]	[Evaluations, red-team findings, impact assessment, sign-off]	[Security event, failed binding check, stale data, lost sponsor]

Threat coverage

The design is checked against the OWASP Top 10 for Agentic Applications,⁴⁸ and every gap has a named owner.

OWASP agentic risk	Controls in this design	Residual gap and owner
ASI01 Agent Goal Hijack	[Controls]	[Gap and owner, or none]
ASI02 Tool Misuse	[Controls]	[Gap and owner, or none]
ASI03 Identity & Privilege Abuse	[Controls]	[Gap and owner, or none]
ASI04 Agentic Supply Chain Vulnerabilities	[Controls]	[Gap and owner, or none]
ASI05 Unexpected Code Execution	[Controls]	[Gap and owner, or none]
ASI06 Memory & Context Poisoning	[Controls]	[Gap and owner, or none]
ASI07 Insecure Inter-Agent Communication	[Controls]	[Gap and owner, or none]
ASI08 Cascading Failures	[Controls]	[Gap and owner, or none]
ASI09 Human-Agent Trust Exploitation	[Controls]	[Gap and owner, or none]
ASI10 Rogue Agents	[Controls]	[Gap and owner, or none]

Compliance and evidence

Where compliance asks, map the controls to ISO/IEC 42001, the NIST AI RMF or the EU AI Act using the crosswalk in Appendix C of the handbook, and put the control IDs in the table.

Obligation	Control ID	Evidence required	Where it is produced	Owner
[Regulation or standard]	[Clause or control]	[Evidence]	[System or log]	[Team]

7. Recommended architecture

Fill from T7. Show the design before naming any product: name only the systems of record and keep everything else vendor-neutral. Record the design review against the framework the client already uses. It matches slide 36.

[One sentence: the architecture in plain words, and the orchestration pattern chosen.]

[Figure: slide 36 of the client deck, the vendor-neutral solution architecture]

Figure 3. Vendor-neutral solution architecture for [the use case]. Only the systems of record are named products.

The design rule. No user or agent reaches a model or a system of record except through the control plane, where identity, policy, routing, cost and audit are applied.

Layer	This use case
Users and channels	[Who uses the solution, through which channel, with which authentication]
Agents and tiers	[Each agent with its tier and mode]
Orchestration	[Pattern, orchestrator, deterministic gates and triggers]
Control plane	[Registry, AI gateway, policy decision point, identity and delegation, evaluation and cost, kill switch]
Models	[Frontier, private and embedding models, and the routing policy]
MCP servers and APIs	[Capabilities exposed as governed tools, with read or write scopes]
Data governance	[Golden records, semantics and data contracts, catalog and lineage, quality, access policies]
Systems of record	[The named systems]
Across every layer	[Security; governance and observability]

Design decisions

Decision	Choice and rationale
Orchestration pattern	[Embedded, dedicated or hybrid/federated, and why]
Model hosting and routing	[Where each model runs, under which terms, and which data may go where]
Where gateways and MCP servers run	[CloudHub or customer-managed Runtime Fabric, and why]
Data residency and sovereignty	[Regions, private links, customer-managed keys]
Human approvals and tiers	[Which actions need a person, and how approvals are bound and expire]
Observability and audit	[Traces, SIEM, retention]

Design review

Check	Framework	Result	Evidence
Every agent has an owner, a sponsor, a risk tier and an identity of its own	Cloud Adoption Framework 20 questions	[Yes, partly or no]	[Evidence]
Each agent’s tool access is least-privilege and allow-listed	Well-Architected Agentic AI Lens	[Yes, partly or no]	[Evidence]
Human oversight matches the risk and reversibility of each action	Well-Architected Agentic AI Lens	[Yes, partly or no]	[Evidence]
Agents’ data access is aligned with their users’ access	20 questions	[Yes, partly or no]	[Evidence]
Only trusted, registered MCP and A2A servers are reachable	Cloud Adoption Framework	[Yes, partly or no]	[Evidence]
New policies start in audit mode, then enforce	Cloud Adoption Framework	[Yes, partly or no]	[Evidence]
Agent reasoning, tool calls and hand-offs are traced end to end	Well-Architected Agentic AI Lens 20 questions	[Yes, partly or no]	[Evidence]
Agent costs are tagged to cost centers, with alerts as spend nears budget	Cloud Adoption Framework Well-Architected Agentic AI Lens	[Yes, partly or no]	[Evidence]
Adversarial testing runs before release and on a schedule	Cloud Adoption Framework	[Yes, partly or no]	[Evidence]
There is a tested way to disable a misbehaving agent and hand over its work	Cloud Adoption Framework	[Yes, partly or no]	[Evidence]

8. How it works

Fill from T8 and T9. Tell one persona’s day from trigger to end state, make every human decision visible, include one moment where a control changes the outcome, and trace the same day through the components. It matches slides 37 and 38.

A day in the life

Persona	[Name, role, team]
The case	[What happens and why it matters]

Time	Moment	What happens	Who decides
[hh:mm]	[Moment]	[What happens]	[Person or none]

[Figure: slide 37 of the client deck, a day in the life]

Figure 4. [Persona]’s day: [what happens] (illustrative).

How the components work together

Time	What happens	Components and protocols	Controls applied
[hh:mm]	[Moment]	[Components; A2A, MCP or API]	[Controls]

[Figure: slide 38 of the client deck, component interaction]

Figure 5. How the components work together in [persona]’s day. Numbered steps follow the day in the life.

9. Realizing it with MuleSoft Agent Fabric and Informatica

Fill from T10. Write the role each capability plays in this use case and leave out the rows the use case does not need. Agree how the control plane coexists with any agent control planes the client already runs. It matches slides 39 to 42.

MuleSoft Agent Fabric is the control plane, with MuleSoft APIs, connectors and MCP Bridge as the capability layer and Informatica as the data foundation, exposed to agents through MCP servers that Agent Fabric can govern.^21,77

[Client] keeps its choice of collaboration tools, models, agent frameworks and systems of record.

[Figure: slide 39 of the client deck, the architecture realized with MuleSoft Agent Fabric and Informatica]

Figure 6. [The use case] realized with MuleSoft Agent Fabric and Informatica. Colors show which vendor fills each role.

Reference component	MuleSoft or Informatica capability	Role in this use case
Registry	Agent Registry and Agent Scanners (MuleSoft Agent Fabric)	[Role]
Orchestration	Agent Broker with guided determinism (MuleSoft Agent Fabric)	[Role]
AI gateway	AI Gateway for LLM and MCP traffic, and Omni Gateway policies for APIs and A2A (MuleSoft)	[Role]
Agent identity	Trusted Agent Identity with mobile approval (MuleSoft Agent Fabric)	[Role]
Approvals bound to execution Exposure limits	Custom Omni Gateway policies built with the Policy Development Kit (Approval-to-Execution Binding; Cross-Session Aggregate-Risk Gate)	[Role]
Operate and control	Agent Kill Switch, Agent Visualizer and AI cost controls, with token-based rate limits and spend attribution (MuleSoft Agent Fabric)	[Role]
MCP servers and APIs	MCP Bridge System and Process APIs with MuleSoft connectors	[Role]
Master data	Multidomain MDM (Informatica)	[Role]
Semantics, catalog, lineage	Data Governance and Catalog, with the CDGC Metadata Search MCP server (Informatica)	[Role]
Data quality	Data quality rules, with the Address Verification MCP server (Informatica)	[Role]
Deployment	CloudHub or customer-managed Runtime Fabric (MuleSoft)	[Role]

Custom Omni Gateway policies, built with the Policy Development Kit, are not MuleSoft products: [client or partner] owns their testing and support.⁷⁸ Evaluation runs with [the evaluation tool the client chose].

How it coexists with other agent control planes

Keep the estates the client runs and leave out the others. Agree the division of labor with the enterprise architect (T10).

Estate	Native agent control plane	Usually authoritative for	MuleSoft Agent Fabric’s role
Microsoft 365 and Azure	Agent 365 and Microsoft Entra Agent ID¹²	Identities and inventory of Microsoft agents Access to Microsoft 365 data	Registers Copilot Studio and Foundry agents and applies common policy to their calls into enterprise systems
AWS	Amazon Bedrock AgentCore⁶²	Runtime, memory and identity for agents built on AWS	Registers Bedrock and AgentCore agents and governs their access to enterprise APIs and MCP tools
Google Cloud	Gemini Enterprise Agent Platform: Agent Registry, Agent Gateway, Agent Identity⁴⁷	Agents built on Google Cloud	Registers them and applies the same policy as for every other estate
Salesforce	Agentforce	Agents working in Salesforce data and processes	Registers and governs Agentforce agents
Across estates	No single native plane	Cross-vendor inventory Policy on every call into enterprise capabilities and data Cross-vendor orchestration Cost and audit	The vendor-neutral control plane²¹
[Client estate]	[Plane]	[What it is authoritative for]	[Agreed role]

What stays [client]’s choice

Component	Choice
Channels and collaboration tools	[Choice]
Agent platforms and frameworks	[Choice]
Models and providers	[Choice]
Systems of record	[Choice]
Identity provider	[Choice]
Security operations (SIEM)	[Choice]

10. The phased plan

Fill from T11 and T13. The platform phases are the same for every client. Fill the use-case milestones, test the month-3 slice against the quick-win test, and name who owns what once the agents are live. It matches slides 43, 44 and 47.

[One sentence: how value arrives at every milestone, quick wins first.]

[Figure: slide 43 of the client deck, the platform and the use case phased together]

Figure 7. The platform and [the use case], phased together. Values are illustrative, before platform, model and change costs.

Platform phases

Phase	When	Focus	Milestone
Phase 1	Months 1–3	Inventory and gateway	Month 3: one front door
Phase 2	Months 4–8	Unlock and route	Month 8: reusable capabilities
Phase 3	Months 9–14	Autonomy and trust	Month 14: trusted autonomy
Phase 4	Months 15–24	Federated control plane	Month 24: north star reached

The phases run in a deliberate order, with visibility and one policy point first, then reusable capabilities and routing, then trust, and federation last. Published phasing guidance likewise starts with governance, a single policy point and baseline guardrails, and federates only at scale.²⁰

Use-case milestones

Milestone	What goes live	KPIs at the milestone	Run-rate value (illustrative)	Foundations left behind
Month 3 (phase 1)	[First slice: one scope, read-only or propose-only]	[KPIs in scope]	[$ a year]	[Registry, gateway, first MCP tools, golden record]
Month 8 (phase 2)	[Wider scope; drafts and proposals]	[KPIs]	[$ a year]	[Reusable APIs and MCP tools; routing and token-based rate limits]
Month 12 (phase 3)	[Every case; gated writes under bound approvals]	[All KPI targets met]	[$ a year]	[Agent identities; bound approvals; drills; evaluation]
Month 24 (phase 4)	[All goals met: run rate sustained; adjacent processes]	[All KPIs held]	[$ cumulative]	[Federated control plane]

Quick-win test for the month-3 slice

Test	Result	Evidence
Shows measurable value within 90 days in one scope (one service line, market, region or site).	[Yes or no]	[Evidence]
Runs read-only or propose-only (tiers 1 and 2): no writes to systems of record yet.	[Yes or no]	[Evidence]
Uses systems and data that are reachable now, or with one connector.	[Yes or no]	[Evidence]
Saves time or money that the users and the sponsor can see.	[Yes or no]	[Evidence]
Leaves a reusable foundation behind: a registered agent, a governed MCP tool, a golden record or the gateway itself.	[Yes or no]	[Evidence]
Has a baseline taken before it starts, so the movement can be proved.	[Yes or no]	[Evidence]

Who owns what

[One sentence: the accountable executive, the governance council and how every agent gets a sponsor.]

Role	Named person or team	Decides
Accountable executive	[Name or team]	Which phases and use cases proceed
AI governance council (architecture, security, risk, data, finance and the business)	[Name or team]	Promotions of high-risk agents Exceptions
Business owner, per use case	[Name or team]	Which steps stay human-led, AI-assisted or AI-led Acceptance of results
Agent sponsor, per agent	[Name or team]	Recertification and retirement The first call in an incident
Platform team (the control plane’s product owner)	[Name or team]	Platform plan, shared policies and onboarding standards
Security and risk	[Name or team]	Blocking a release Demoting or stopping an agent
Finance	[Name or team]	How value per milestone is reported Budget thresholds

11. KPIs, value and ROI

Fill from T6 and T11, and agree the numbers with the client’s finance partner. Month 3 targets apply to the first slice only; say “in scope”. Never add up use cases from different businesses. Give each scorecard metric a leading indicator (T6). It matches slides 45 and 46.

KPIs at every milestone

KPI	Baseline	Month 3	Month 8	Month 12	Month 24
[KPI]	[Baseline]	[In scope]	[Target]	[Target]	[Target]



Agent quality	Not measured	Baseline set	[Track]	[Target]	[Target]
Governed AI traffic	Not measured	100% in scope	100% in scope	100%	100%
AI cost per [outcome]	Not measured	Baseline set	Within target	Within target	Within target
AI cost visibility	Not measured	100% in scope	100% in scope	100%	100%

Control-plane scorecard

Reported monthly to the executive committee and quarterly to the AI governance board.²⁹

Metric	What it shows for this use case	Leading indicator	Data source
Agent coverage	[Every agent in scope registered with an owner, a sponsor and a tier]	Unregistered agents found	Agent Registry
Governed traffic	[Every model and tool call in scope through AI Gateway]	New agents launched behind the gateway	AI Gateway
Cost per outcome	[AI cost per outcome against its target]	Cost per successful task	LLM Governance
AI cost visibility	[Spend attributed to an owner and the use case within a day]	Spend attributed within a day	AI Gateway LLM Governance
Value realized	[Run rate of the live slice against the business case]	Acceptance rate	Business-case tracking
Oversight effectiveness	[High-risk actions executed exactly as approved, within the approval’s validity]	Takeover rate	Gateway approval-binding events
Time to contain	[Kill-switch and takeover drill passed before tier 3 goes live]	Drill time	Agent Kill Switch Takeover drill records

Value and ROI

[Figure: slide 46 of the client deck, value arrives at every milestone]

Figure 8. Run-rate value at each milestone and how the cumulative value adds up (illustrative).

Period	Run rate in force	Value	Costs	Net
Months 3–8	[$ a year] for 5 months	[$]	[$]	[$]
Months 8–12	[$ a year] for 4 months	[$]	[$]	[$]
Months 12–24	[$ a year] for 12 months	[$]	[$]	[$]
Total by month 24		[$]	[$]	[$]

Each run rate counts only for the months it is in force. ROI = (cumulative value − cumulative cost) ÷ cumulative cost. Payback is the month in which cumulative value first exceeds cumulative cost. Costs are the project team’s estimate of platform subscriptions, implementation services, model usage, infrastructure, and change and training. Take model usage from billing data attributed to this use case, in the FOCUS format where available, not from list prices.²³

For comparison, typical AI payback is two to four years, against seven to 12 months for other technology investments, and only 6% of executives saw payback within a year.⁸²

[ROI and payback by month 24, once costs are estimated, and how the plan compares with the benchmark; until then, say that values are before costs.]

Business value beyond the numbers

Risk avoided. [Decisions made by the right person before work starts, with evidence and lineage.]
Compliance evidence. [Audit trails that answer regulators and auditors quickly.]
Experience. [Faster answers for clients and fewer chasers for staff.]
Reuse. [The governed APIs, MCP tools and golden records the next use case reuses.]

12. Decisions and next steps

Fill from T12 and T13. Keep the standard decisions and adapt the second to the first slice. Every risk has an owner and an action, including connector coverage and takeover readiness for any agent heading to tier 3. It matches slide 48.

Decision	What it covers	Owner	By when
Name an owner	One accountable executive and an AI governance council covering agents, models and AI spend, with a sponsor for every agent	[Sponsor]	[Date]
Fund phase 1	[The first slice, in one scope; every model and tool call through AI Gateway]	[Sponsor]	[Date]
Adopt the standards	API-led connectivity, MCP and A2A as enterprise policy Every agent registered and routed through the control plane	[Enterprise architect]	[Date]
Agree how value is reported	Baseline the KPIs with finance now and report value at every milestone review	[Finance partner]	[Date]

The first 90 days

Weeks	Step	Activities	Exit criteria
1–2	Pick the scope and baseline	[Scope; KPI baselines with finance]	[Baseline signed off]
3–6	Govern the traffic	[Agent Scanners; Agent Registry; AI Gateway; first golden record]	[Agents registered; traffic governed]
7–10	Start read-only	[First agents at tiers 1–2 in assist mode]	[Users working with the agents]
11–13	Prove and decide	[KPIs, run-rate value, AI cost per outcome]	[Decision on phase 2]

Skills and adoption

Audience	What they need to learn	When
Approvers	What they approve and the facts behind it How bound approvals expire How to stop an agent	[When]
Agent sponsors	The agent lifecycle: registration, evaluation, promotion, recertification, retirement and the takeover runbook	[When]
Business teams	Working alongside agents: reviewing drafts, handling exceptions and taking over when an agent is stopped	[When]
Platform team	Running the control plane as a product: registry, gateway, identity, evaluation, cost and observability	[When]
Security and risk	Threat mapping, red-teaming agents, incident response and takeover drills	[When]

Adoption measure	Definition	Target
Acceptance rate	Share of agent outputs accepted without significant edits, with undo and revert counted as rejections⁶⁰	[Target]
Takeover rate	How often a person has to step in and take over a task the agent started⁶⁰	[Target]
Verification latency	Time from an agent completing a task to a person approving it Very short times can mean approval without review⁶⁰	[Target]
Trained before go-live	Share of approvers, sponsors and users trained before their slice goes live	[Target]
Value per milestone	Run-rate value delivered against the business case, not the number of users or prompts⁸⁸	[Target]

Risks

Risk	Impact	Mitigation	Owner
[Risk]	[Impact]	[Mitigation or action]	[Owner]

Assumptions and dependencies

Assumption. [Volumes, rates and costs used, and who agreed them]
Assumption. [Values are before platform, model and change costs, which the project team estimates with the client]
Dependency. [Access to the systems of record, with private connectivity]
Dependency. [Model contracts under enterprise terms with zero data retention and approved regions]
Dependency. [Named data stewards for the master data the agents depend on]

Appendix A. Asset inventory

Fill from T3a to T3h: one row per asset, each confirmed by its owner, with the phase in which it is needed.

A1. Applications and systems of record

System	Owner	Role in the use case	Interfaces	Agent access	Phase
[System]	[Team]	[What it does in the process]	[API, event, file]	[Read or write]	[1–4]

A2. Data assets and master data

Data asset	System of record	Golden record today?	Quality and risk notes	Sensitivity	Owner or steward
[Domain or data set]	[System]	[Yes, partly, no]	[Issues]	[Class]	[Name or team]

A3. Integrations, APIs, events and MCP tools

Tool or interface	System	Operation	Scope	Exists or to build	Used by
[tool_name]	[System]	[What it does]	[Read or write]	[Exists or to build]	[Agent]

A4. Agents and copilots

Agent	Responsibility	Tier	Human role	Owner	Status and phase
[Agent]	[What it does]	[Tier, mode]	[Who decides]	[Team]	[Live, pilot, planned, shadow; phase]

A5. Models

Model	Provider and hosting	Tasks	Data rules	Fallback
[Model]	[Provider; SaaS, VPC or on premises]	[Tasks]	[Retention, regions, masking]	[Fallback]

A6. Identities, users and channels

Actor	Channel	Authentication	Authority and approvals
[User group or agent]	[Channel]	[SSO, MFA, step-up]	[What they may approve]

A7. Policies and controls

Policy or control	Type	Enforced today	Target enforcement	Owner
[Rule]	[Gate, data, limit, regulatory]	[Where, or not enforced]	[Where it will be enforced]	[Team]

A8. Infrastructure, runtime and observability

Component	Notes
[Environment, network zone, keys, logging, residency]	[Constraint or decision]

Appendix B. Requirements register

Fill from T4: one requirement per row, with a measurable acceptance test, a priority, the phase in which it must be met, the KPI it moves or protects and an owner who can accept it. Prefixes: BR business, FR functional, DR data, IR integration, NFR non-functional, SR security, CR compliance, OR operational.

ID	Type	Requirement and acceptance test	Priority	KPI	Phase	Owner
[BR-01]	[Type]	[Requirement; how it will be tested]	[Must]	[KPI]	[1–4]	[Owner]

Appendix C. How the assessment ran

Keep the six steps. Replace the prompts with the dates you ran and the people who took part. It matches slide 29.

The assessment ran over [n] weeks, from [date] to [date], with [n] workshops and [n] people from [functions].

Step	What was done	Output	When
1. Frame	Choose one priority use case, agree its goals and scope, and write the value hypothesis.	Use case at a glance Business case and value hypothesis	[Dates]
2. Discover	Inventory the applications, data, integrations, agents, models, identities, policies and infrastructure the use case touches, and baseline its KPIs.	Asset inventory KPI baselines	[Dates]
3. Define	Capture business, functional, data, integration, non-functional and operational requirements, and the security and compliance controls for every layer.	Requirements register Security and compliance requirements	[Dates]
4. Design	Draw the vendor-neutral north star for the use case, tell a day in the life, trace how the components work together, then realize it with MuleSoft Agent Fabric and Informatica.	North-star architecture Day in the life Component interaction Realization	[Dates]
5. Phase	Sequence the use case with the four phases of the plan, quick wins first, and put KPIs, ROI and business value on every milestone.	Phased plan with value per milestone	[Dates]
6. Decide	Present the findings and the plan, agree who owns what once the agents are live, secure the decisions for the first 90 days, and log risks, assumptions and next steps.	Readout, decisions, operating model and a 90-day plan	[Dates]

Workshops and participants

Workshop	Date	Participants
Executive framing	[Date]	[Names and roles]
Process and systems walkthrough	[Date]	[Names and roles]
AI estate inventory	[Date]	[Names and roles]
Data and master data	[Date]	[Names and roles]
Requirements and security	[Date]	[Names and roles]
Architecture	[Date]	[Names and roles]
Value and phasing	[Date]	[Names and roles]
Readout	[Date]	[Names and roles]

Appendix D. Sources

List only the sources this report cites. The numbers are those of the shared endnote list in The AI Control Plane Handbook (Appendix B). Keep them, so the report, the deck and the handbook cite sources the same way.

Superscript numbers in this report refer to the sources below. Vendor-authored sources are cited for product facts, not as independent validation.

12. Microsoft, “Introducing the First Frontier Suite built on Intelligence + Trust,” Official Microsoft Blog, March 9, 2026; see also Microsoft, “What’s new in Microsoft Entra Agent ID,” Microsoft Learn, updated May 1, 2026, and Microsoft, “Microsoft Agent Framework overview,” Microsoft Learn, updated August 25, 2026. https://blogs.microsoft.com/blog/2026/03/09/introducing-the-first-frontier-suite-built-on-intelligence-trust/ https://learn.microsoft.com/en-us/entra/agent-id/whats-new-agent-id https://learn.microsoft.com/en-us/agent-framework/overview/

20. Bain & Company, “How to architect for agentic AI,” May 29, 2026; see also Eric Sheng, Roger Zhu, Brendan O’Rourke, Dale Pedzinski, and Kevin Zhang, “From roadmap to reality: Phasing agentic AI into production,” Bain & Company, April 14, 2026. https://www.bain.com/insights/how-to-architect-for-agentic-ai https://www.bain.com/insights/from-roadmap-to-reality-phasing-agentic-ai-into-production/

21. MuleSoft, “Agent Fabric,” product page, accessed October 2026; see also the MuleSoft documentation pages “Agent Fabric release notes,” “Agent Scanners,” “Adding an MCP Bridge Instance,” “Creating and Managing Model Proxies” and “Detect and Contain Rogue Agents,” and MuleSoft, “AI Cost Management,” accessed October 2026. https://www.mulesoft.com/ai/agent-fabric https://docs.mulesoft.com/general/agent-fabric-release-notes https://docs.mulesoft.com/exchange/agent-scanners https://docs.mulesoft.com/api-manager/latest/create-instance-task-mcp-bridge https://docs.mulesoft.com/general/model-proxy https://docs.mulesoft.com/general/exp-detect-and-contain-rogue-agents https://www.mulesoft.com/ai/agent-fabric/cost-management

23. FinOps Foundation, “FinOps for AI,” FinOps Framework, accessed September 2026. https://www.finops.org/framework/technology-categories/ai/

29. Chirag Agrawal, “AI governance strategy: A 12-month plan to build responsible, trusted AI autonomy,” CDO Magazine, May 14, 2026. https://www.cdomagazine.tech/opinion-analysis/ai-governance-strategy-a-12-month-plan-to-build-responsible-trusted-ai-autonomy

47. Kanchana Patlolla and Greg Brosman, “20 questions for the agentic enterprise (and how Agent Platform can help),” Google Cloud Blog, July 7, 2026. https://cloud.google.com/blog/products/ai-machine-learning/20-questions-for-the-agentic-enterprise

48. OWASP GenAI Security Project, “OWASP Top 10 for Agentic Applications: The benchmark for agentic security in the age of autonomous AI,” December 9, 2025. https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/

60. Benazir Fateh and Amy Liu, “The KPIs that actually matter for production AI agents,” Google Cloud, February 26, 2026. https://cloud.google.com/transform/the-kpis-that-actually-matter-for-production-ai-agents

62. Amazon Web Services, “What is Amazon Bedrock AgentCore?” and “Evaluate agent performance with Amazon Bedrock AgentCore Evaluations,” Amazon Bedrock AgentCore Developer Guide, accessed October 2026. https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/what-is-bedrock-agentcore.html https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/evaluations.html

77. Informatica, “Informatica from Salesforce: Trusted context for agents,” accessed September 2026; see also Informatica, “New features and enhancements,” Informatica MCP servers, What’s New, April 2026 (Address Verification, CDGC Metadata Search and other MCP servers). https://www.informatica.com/salesforce.html https://onlinehelp.informatica.com/IICS/prod/agentic-ui/en/aa-aiae-mcp-whats-new/New_features_and_enhancements_2.html

78. MuleSoft, “Omni Gateway Policy Development Kit (PDK)” and “Omni Gateway agent policies,” product documentation, accessed September 2026. https://docs.mulesoft.com/pdk/latest/policies-pdk-develop-custom-policies https://docs.mulesoft.com/gateway/latest/agent-policies

82. Deloitte, “AI ROI: The paradox of rising investment and elusive returns,” 2025 (survey of 1,854 executives in Europe and the Middle East, August–September 2025). https://www.deloitte.com/global/en/what-we-do/capabilities/ai/research/ai-roi-the-paradox-of-rising-investment-and-elusive-returns.html

88. Vinciane Beauchene, Sylvain Duranton, David Martin, Vanessa Lyon, and Jeff Walters, “AI at work: Why strategy matters more than tools,” Boston Consulting Group, June 2, 2026 (survey of close to 12,000 employees, managers and leaders). https://www.bcg.com/publications/2026/ai-at-work-why-strategy-matters-more-than-tools

90. Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly, “Zero Trust Architecture,” NIST Special Publication 800-207, August 2020. https://csrc.nist.gov/pubs/sp/800/207/final

Appendix E. Notices

Keep this appendix in the completed report: the credit line is a condition of the toolkit’s additional permission (see Appendix E of the guide), and the icon credit is required by the icons’ license whenever the report includes slides from the client deck. Delete the trademark sentences for products the report does not name, and state any relationship between the assessor and the vendors named.

Toolkit credit. Based on the AI Control Plane Assessment toolkit by John Fisher, used with his permission.

Trademarks. Salesforce, Agentforce, MuleSoft, MuleSoft Agent Fabric, CloudHub, Runtime Fabric, Omni Gateway and Informatica are trademarks of Salesforce, Inc. or its affiliates. Other Salesforce, MuleSoft and Informatica product names may also be trademarks of Salesforce, Inc. or its affiliates. Microsoft, Azure, Microsoft 365, Microsoft Agent 365, Microsoft Copilot Studio, Microsoft Entra and Microsoft Foundry are trademarks of the Microsoft group of companies. Amazon, Amazon Web Services, AWS, Amazon Bedrock and AgentCore are trademarks of Amazon.com, Inc. or its affiliates. Google, Google Cloud and Gemini are trademarks of Google LLC. OWASP is a registered trademark of the OWASP Foundation, Inc. Other product, company and organization names may be trademarks of their respective owners. Names are used to identify the products, services and organizations discussed.

Credits. Icons in figures taken from the client deck are from Font Awesome Free by Fonticons, Inc., recolored, licensed under CC BY 4.0, https://creativecommons.org/licenses/by/4.0/.

[State any partnership or commercial relationship between the assessor and the vendors named.]

[Your organization’s notices, for example on confidentiality and distribution.]