Boomi's Agent Control Plane: enforcement in the path

On September 2, 2026, Boomi launched its Agent Control Plane, positioning it as AI-native infrastructure that connects agents to core business systems, governs what they do once connected, and reins in runaway token spend. The platform runs across public cloud, a customer's own VPC, or on-premises — a deployment choice Boomi ties directly to data and digital sovereignty. The announcement completes an arc the integration vendor has been building all year, and it turns the control layer between agents and the ERP from an idea into a product category.

From model risk to execution risk

The release frames the problem as a governance gap that widens as adoption accelerates. Enterprises are moving agents into production faster than they can see what those agents do, what they cost, or what happens when one touches the wrong system. Many respond by restricting connectivity, which keeps the enterprise safe on paper but starves agents of the systems that make them useful.

Third-party data supports the framing. A Forrester Consulting study commissioned by Boomi found 86% of leaders have moved beyond pilots, yet only 34% trust the actions their agents take, and organizations that deployed prematurely reported an average of $2.1 million in added cost. The FinOps Foundation's 2026 survey found 98% of practitioners now manage AI spend, up from 31% two years earlier. Omdia chief analyst Michael Barnes summarized the shift: 'Enterprises are no longer primarily worried about what an agent says. They are worried about what it does to a general ledger or a customer record, and whether anyone can reconstruct the decision six months later in an audit.'

Why pilots died

Chris Hallenbeck, Boomi's SVP and GM of AI and Platform, offered a blunter diagnosis. Projects failed when CISOs refused to sign off on systems that could not protect personal data or verify the identity behind an agent's request, when connectivity to systems of record was too hard to build, and when data quality was too poor to give agents usable context. The deeper failure: agent ownership. Without ownership, integration and data teams disclaim AI while centers of excellence lack authority. The companies that reached production made integration teams responsible for agent-ready APIs, embedded the CISO at design time, and paired AI teams with FinOps.

What the control plane does in the path

The September 2 announcement completes an arc ERP Today has tracked all year. Boomi's March pivot to data activation introduced Meta Hub and a European platform instance. Boomi World in May added Boomi Connect and Orchestrate plus a letter of intent for AI gateway specialist Lunar.dev. That deal closed on July 27, and the Lunar-based Boomi AI Gateway now serves as the enforcement layer beneath the control plane — combining MCP gateway and LLM gateway functions in one control point.

The control plane sits between any agent, whether built on Boomi, third-party frameworks, or open source, and transactional systems including SAP, Oracle, Salesforce, and Workday. It inspects live traffic, applies identity and rate limits, and holds high-risk transactional actions for human approval. Boomi Connect exposes those systems as governed MCP tools — more than 1,000 of them — so that employees can use Claude, ChatGPT, or Gemini against enterprise data with access provisioned through existing identity providers. The runtime story matters just as much for regulated industries: bring-your-own-model support spans commercial LLMs, open-weight models, and private instances, with fine-tuned small language models coming soon. Running models on infrastructure the enterprise controls converts variable per-token cost into predictable compute cost — answering the question Steve Lucas raised back in 2024: who is watching the agents?

Three actionable moves

ERP Today's takeaways from the release form a checklist any enterprise can adopt directly. First, put enforcement in the path, not alongside it: cloud and model vendors each govern their own estate, leaving partial audit trails; CIOs should demand a single control point that logs, meters, and can halt every agent action against a system of record. Second, audit APIs before exposing them to agents: enterprise architects should assume legacy transactional APIs are unsafe for autonomous access and budget for a fine-grained, business-level API layer with throttling and delegated authorization. Third, bring FinOps into agent design from day one: token cost variability is now a board-level risk, and model routing between frontier models, cloud models, and on-premise SLMs should be a governed policy, not a developer's choice.

The bottom line

The thesis Boomi has argued since 2024 — integration is innovation, and AI is impossible without a data house in order — has hardened into a product category. Whether enterprises buy it from Boomi or assemble it themselves, the control layer between agents and the ERP is no longer optional; it is infrastructure any company moving agents from pilot to production must build in 2026. The test is simple: does your enterprise have a single control point that can answer, for every agent, what it just did to the general ledger, how many tokens it spent, and who approved it? If the answer is no, then no matter how strong the model, you are still in pilot.

References

• ERP Today: Boomi's Agent Control Plane Targets the Governance Gap Stalling Enterprise AI — https://erp.today/boomis-agent-control-plane-targets-the-governance-gap-stalling-enterprise-ai/
• Boomi: Lunar.dev acquisition completed — https://boomi.com/blog/lunar-dev-boomi-acquisition/
• Boomi: Infrastructure for the enterprise AI control plane — https://boomi.com/resources/resources-library/boomi-infrastructure-enterprise-ai-control/