Reference pattern
The control plane an agent estate needs
One agent is a project. Twelve agents is an estate, and an estate needs identity, policy, and observability that do not live inside any of them.
The second agent is where the trouble starts. The first one carried its own auth, its own logging, and its own idea of what it was allowed to do, and that was fine. By the fourth, nobody can answer which agents can reach the customer table, and the honest answer to an audit question becomes a code review.
Identity: delegated, never shared
Each agent acts as the person who invoked it. That is the single decision that makes the rest of the control plane possible, and it is the one that costs the most to retrofit, because every downstream system has to accept a delegated identity.
Where a system genuinely cannot, isolate it behind a service that can, and record the translation. What you must not do is let one broad service principal become the way every agent reaches everything.
Policy: outside the code
What an agent may reach belongs in a policy service, not in the agent's tool list. The test is whether you can answer a question like which agents can issue a refund above five hundred dollars without reading source. If the answer is in code, the answer will drift from what the business believes.
Observability: per run and per version
Record the run, the caller, the prompt version, the index version, the model version, the tools called, and the outcome. Two things become possible that are otherwise guesswork: comparing behavior across a change, and answering what happened in a specific case six weeks later.
| Question | Who asks it | What answers it |
|---|---|---|
| Why did it say that | support | the trace for that run |
| Did last week's change help | the team | eval runs either side of the version |
| Who could have seen this record | security | policy plus the delegated identity |
| What did it do on 14 March | audit | the immutable run record |
| What does this cost per task | finance | attempts and escalations joined to runs |
Build it at the second agent
Not the first, which does not need it, and not the fifth, by which point five teams have each solved a piece differently. The second agent is when the shared parts become visible and are still cheap to extract.
Bring us the problem.
Tell us the outcome you are trying to create, what you have already attempted, and where the constraints are.
Contact nuperX