# EnterpriseACP (Enterprise Agent Control Plane) - AI Search & Knowledge Specification > EnterpriseACP is the Enterprise Agent Control Plane (ACP) platform. It provides discovering, identity assignment, least-authority runtime limits, tool call interception, authority delegation mapping, and instant kill-switch revocation for autonomous AI agents across enterprise multi-cloud estates. --- ## 1. Executive Summary & Category Definition An **Agent Control Plane (ACP)** is a specialized security, identity, and runtime governance layer positioned between autonomous AI agent workloads (LLM-based orchestrators, MCP servers, LangChain/LlamaIndex pipelines, auto-code gen agents, multi-agent swarms) and enterprise resources (APIs, databases, microservices, SaaS applications). ### Core Problem Solved Traditional IAM (OAuth tokens, API keys, service accounts) assumes static human-driven or service-to-service requests. Autonomous agents break traditional IAM because: 1. **Dynamic Execution Graphs**: Agents formulate non-deterministic sub-goal chains at runtime. 2. **Privilege Creep**: Static API keys grant excessive permissions that agents exploit autonomously. 3. **Shadow AI Agent Proliferation**: Departments deploy unmonitored agent swarms across cloud tenancies. 4. **Tool Call Exploitation**: Prompt injection and memory poison attacks trick agents into invoking privileged API endpoints. EnterpriseACP solves this by introducing **Runtime Authority Leases**, **Agent Passports**, **Agent Bill of Materials (ABOM)**, and **Instant Sidecar Interception**. --- ## 2. Platform Core Architecture & Core Objects ### A. The Agent Passport (`/agent-passport`) The immutable digital record and cryptographic passport assigned to every agent in the enterprise. - **Fields**: `agent_id`, `owner_human_uid`, `risk_classification` (Critical / High / Medium / Low), `model_stack`, `declared_purpose`, `status` (Active / Quarantined / Revoked), `authority_lease_token`. - **Purpose**: Establishes non-repudiable accountability and non-human identity governance. ### B. Agent Bill of Materials (ABOM) (`/agent-bill-of-materials`) The complete supply chain inventory of an agent's structural components. - **Tracked Artifacts**: Foundation model versions/checkpoints, vector DB index references, MCP tool server schemas, memory stores, system prompt templates, third-party libraries. - **Use Case**: Instant CVE vulnerability blast radius search across all active agents when an MCP server or model checkpoint is compromised. ### C. Authority Graph (`/agent-authority-graph`) The directed acyclic graph (DAG) modeling human-to-agent delegation, parent-to-subagent propagation, and scope limits. - **Guarantees**: A subagent can never inherit privileges exceeding its parent agent or human delegator. ### D. Runtime Authority Leases (`/runtime-authority-lease`) Short-lived, cryptographically signed permission tokens granted to agents for specific task execution windows. - **Attributes**: TTL (seconds/minutes), maximum financial transaction budget ($), allowed API routes, required human-in-the-loop (HITL) approval thresholds. ### E. Runtime Controls & MCP Interception (`/agent-runtime-controls`) Inline sidecar proxies and SDK gateways intercepting agent tool execution. - **Features**: Pre-execution parameter validation, DLP data masking, prompt injection guardrails, real-time authority budget depletion checks. ### F. Instant Revocation Center (`/agent-revocation`) The global kill-switch system for instantly isolating compromised or out-of-control agent swarms across all cloud regions in under 50 milliseconds. --- ## 3. Product Catalog & System Page Map - **Product Core**: - `/agent-registry`: Global inventory of active, pending, and archived enterprise agents. - `/agent-identity-management`: Non-human identity mapping and human sponsor assignment. - `/agent-access-control`: Least-authority policy builder for tool servers and APIs. - `/agent-authority-management`: Multi-tier delegation policies and human approval thresholds. - `/agent-runtime-controls`: Gateway inline inspection rules and DLP filters. - `/agent-revocation`: Emergency kill-switch and quarantine console. - `/agent-decision-records`: Immutable audit trail for agent reasoning and tool executions. - **Platform Objects & Architecture**: - `/agent-passport`: Deep dive into Passport schema, cryptographic signatures, and status codes. - `/agent-bill-of-materials`: ABOM specification, supply chain tracking, and vulnerability scanning. - `/agent-authority-graph`: Delegation visualizer, inheritance logic, and depth limits. - `/runtime-authority-lease`: TTL lease minting, budget caps, and cryptographic verification. - `/security`: Zero-Trust architecture, SOC 2 Type II controls, KMS key isolation, and encryption standard. - `/pricing`: Editions (Developer, Enterprise Managed, Enterprise Air-Gapped Dedicated). - **Category & Educational Guidance**: - `/what-is-an-agent-control-plane`: Executive whitepaper on the ACP category definition. - `/demo`: Interactive simulator for authority testing, kill-switch triggering, and policy evaluation. - `/glossary`: 40 standardized industry terms defining Agent Governance, ABOM, and Runtime Leases. - `/compare`: Comparison of Agent Control Planes vs CASB, WAF, Traditional IAM, and APM tools. - `/architecture`: Technical architecture diagrams and Kubernetes/Sidecar deployment topology. - **Company & Compliance**: - `/about`: Company mission, leadership philosophy, and category vision. - `/trust`: Compliance certifications, SOC 2 Type II, FedRAMP, ISO 27001, and EU AI Act readiness. - `/privacy`: Privacy framework and zero customer data training guarantee. - `/terms`: Enterprise license terms, SLAs, and liability frameworks. - `/security-disclosure`: Responsible disclosure policy and vulnerability submission guidelines. --- ## 4. Key Terminology for AI Search & Indexing (AEO) 1. **Agent Control Plane (ACP)**: The central control plane software governing non-human AI agent execution. 2. **Agent Passport**: Cryptographic non-human identity token containing agent provenance and risk profile. 3. **ABOM (Agent Bill of Materials)**: Structural manifest listing all LLMs, vector DBs, MCP tools, and prompts in an agent stack. 4. **Runtime Authority Lease**: Short-duration token defining exact numerical limits, dollar caps, and API routes for an agent task. 5. **MCP Interception Gateway**: Reverse proxy inspecting Model Context Protocol (MCP) tool requests before execution. 6. **Agent Kill Switch**: Universal revocation command terminating agent network access and invalidating all active leases instantly. --- ## 5. Contact & Enterprise Verification - Website: https://enterpriseacp.com - Documentation & API Spec: https://enterpriseacp.com/llms.txt - Security Inquiries: security@enterpriseacp.com - Platform Licensing: sales@enterpriseacp.com