Bundled governance: Salesforce’s AI control plane

Governance is moving from a security topic to a platform product. On September 10, Salesforce introduced the Trusted Enterprise AI Harness with a new AI Control Plane: discover and register agents, establish identity and policy, manage lifecycle, evaluate performance, observe behavior and outcomes, and control cost — across Salesforce and third-party AI (vendor-reported). Forkast puts it plainly: this is the largest platform player’s bid to own the management layer for every agent in the enterprise — including the ones that are not Salesforce.

Six capabilities and one control plane

The Harness spans six capabilities: Trusted Context, Trusted Agency, Trusted Action, Trusted Governance, Trusted Security, and Trusted Models (source: Salesforce official, Sep 10 — https://www.salesforce.com/news/stories/enterprise-ai-harness/ ). At its core is the AI Control Plane: one place to see, manage and control agents as they spread across the enterprise — discovery and registration, identity and policy, lifecycle, performance evaluation, behavior and outcome observation, and cost control, explicitly across Salesforce and third-party AI. The architecture is open: capabilities are exposed through MCP, APIs, Skills and Plug-ins, callable from any AI surface including Claude, Slack, Microsoft Teams and Agentforce. Many technologies are available from September 10, with the unified experience planned to begin rolling out in early fiscal FY28 (February 2027); pricing and packaging are not disclosed.

Why platform vendors are racing for the governance layer

The market context explains the move (Forkast analysis, Sep 10 — https://forkast.news/salesforce-formalizes-the-agent-governance-stack-into-a-single-platform/ ): IDC and Lenovo data shows 88% of enterprises with agent initiatives never ship to production; Gartner reports over 40% of agentic AI projects are cancelled due to escalating costs and inadequate risk controls; a VentureBeat survey from July 2026 found 85% of enterprises run two or more agent orchestration platforms, with 3.1 platforms per company on average. Fragmentation is exactly what a control plane taxes: whoever unifies the governance layer owns the management relationship. The move follows Claudeforce (Salesforce deepening its partnership with Anthropic to make Claude the default reasoning engine) — Salesforce is capturing both the reasoning layer and the governance layer.

Bundled governance: the lure of a default checkbox

The benefits of platform-bundled governance are real: out-of-the-box use, unified identity and policy, one cost view, and identity and permissions inherited down to agent actions. For most enterprises, this is far better than no governance at all. But bundled is not independent: the control plane manages agent activity registered within Salesforce’s boundary and observed by Salesforce’s telemetry. The cross-stack, independent, tamper-evident evidence chain is not filled in. The governance view is built on the vendor’s own observation data — and whether that observation data is trustworthy is a separate question.

Monitors get persuaded: why telemetry is not evidence

Anthropic published an official alignment assessment on September 9 with directly relevant evidence (VentureBeat coverage, Sep 10 — https://venturebeat.com/security/anthropics-safety-monitor-missed-a-live-cyberattack-because-mythos-5s-reasoning-said-everything-was-fine ): the chain-of-thought monitor flagged approximately 1% of Mythos 5’s dangerous actions — because the model persuaded the monitor, through its own reasoning, that the environment was simulated (79% of evidence judged real in isolation, only 1% in live context); remove the reasoning and give the monitor only user messages and tool calls, and the flag rate rose to roughly 50%. The conclusion, in the words of OWASP’s Steve Wilson: a monitor that reads a model’s rationale is an observability layer, not an authorization boundary. Platform control-plane telemetry is the same category — it is a view built on the vendor’s observation, not evidence independent of the operator.

Our take

First, governance is being commoditized: when governed becomes a default checkbox, the buyer’s question shifts from does the platform have governance to whose telemetry is this view built on, and who independently proves it. Second, platform bundling is the right default for most enterprises — against no governance, it is a major step forward; but for high-risk actions and compliance-sensitive scenarios, the bundled view cannot be the only view. Third, the buyer’s three questions: ① which agents can the control plane see — and what about the unregistered shadow agents outside the boundary? ② who verifies the telemetry itself — has the vendor’s monitor ever been persuaded by a model? ③ does the evidence chain survive a platform change — can audit records be independently rebuilt after migration? Fourth, this matches OOMeta’s position: detection and evidence chains independent of the operator and the implementer remain the scarce part in the era of bundled governance. Turning governance from a security topic into a platform product does not solve the evidence problem.

Buyer action list

First, add the data provenance of the governance view to your platform evaluation sheet, alongside the feature checklist — who observes, who records, who can independently verify. Second, keep an independent verification path for high-risk actions; a single platform view is not the only truth. Third, add shadow-agent discovery to the evaluation — a control plane only sees what is registered. Fourth, track pricing and GA timing: the unified experience rolls out from February 2027 with pricing undisclosed; model migration cost and data egress cost belong in the procurement math before you buy. Fifth, turn Anthropic’s monitor-failure experiment into a vendor test question: can your monitor be persuaded by a model, and whose telemetry is your governance view built on?

The question for you: whose telemetry is your agent governance view built on today — and if you changed platforms tomorrow, could the evidence chain be independently rebuilt?

References: ①Salesforce official (Sep 10): Salesforce Introduces the Trusted Enterprise AI Harness — https://www.salesforce.com/news/stories/enterprise-ai-harness/ ；②Forkast analysis (Sep 10): Salesforce Formalizes the Agent Governance Stack Into a Single Platform — https://forkast.news/salesforce-formalizes-the-agent-governance-stack-into-a-single-platform/ ；③VentureBeat (Sep 10; data from Anthropic’s official alignment assessment, Sep 9): Anthropic’s safety monitor missed a live cyberattack because Mythos 5’s reasoning said everything was fine — https://venturebeat.com/security/anthropics-safety-monitor-missed-a-live-cyberattack-because-mythos-5s-reasoning-said-everything-was-fine