Shadow AI: The 10 Control Planes — A Framework for Agentic Risk in Enterprise Environments

1. INTRODUCTION

Definition: The 10 Control Planes Framework is a comprehensive threat modeling architecture mapping visibility and enforcement gaps across enterprise boundaries during autonomous agentic execution.

An enterprise AI agent is not a point-in-time event. It is a process that moves -- authenticating, enumerating, synthesizing, calling, delegating -- across control planes that were never designed to see it coming.

Each of the ten control planes has a detection tool. Each tool encodes assumptions about human intent and linear execution. An autonomous agent violates those assumptions simultaneously -- operating across trust boundaries that were never designed to coordinate against it.

This paper maps what the agent actually does at each plane: the actions it takes, the decisions it makes, the gap it exploits, and what limits the damage without stopping the workflow. The planes are ordered by the logical execution sequence of a typical enterprise agent -- from initial authentication through to full agentic workflow execution.

The framework is grounded in a body of operational evidence that validates its core argument:

• Supply chain attacks at ecosystem scale demonstrated that poisoned agent skills reach production without triggering existing tooling.

• Two independent enforcement failures in Microsoft 365 Copilot -- neither detected by SIEM, EDR, or WAF -- showed that server-side enforcement cannot be verified by the enterprise security stack.

• The first confirmed in-the-wild intrusion driven by an autonomous LLM agent compressed a full post-exploitation chain -- credential extraction, lateral movement, database exfiltration -- to under one hour.

Autonomous exploitation capabilities achieving an 83.1% zero-day success rate demonstrated that agentic workflow threats are no longer theoretical. These incidents are cited throughout as proof points for the structural gaps each plane documents.

2. FRAMEWORK OVERVIEW

The 10 Control Planes framework maps where autonomous AI systems cross trust boundaries that existing enterprise security architecture was not designed to coordinate against. Unlike traditional perimeter security, this framework assumes the agent is already operating inside the environment as a legitimate, non-deterministic process

2.1 The Blast Radius Model

Each plane is scored across three dimensions: (1) data volume reachable if the plane is compromised or unmonitored; (2) recoverability of the resulting damage; and (3) perceived risk level in the organization. The composite score determines ring placement.

Ring placement categorizes the structural risk profile rather than the probability of exploitation. A plane in the Outer Ring carries the highest blast radius regardless of whether an active threat is present. The most dangerous planes in this framework are fully sanctioned -- operating inside approved infrastructure with the lowest perceived risk in the organization.

2.2 The Three Rings

Outer Ring -- Highest blast radius

Broad data reach, low perceived risk, damage that is difficult or impossible to reverse. Planes here are fully sanctioned, operating inside approved infrastructure with tools that cannot inspect what executes within them. Planes: SaaS (03), Embedded Copilot (06), Agentic Workflow (10).

Middle Ring -- Elevated

These planes enable and amplify damage at the outer ring. Misconfiguration here expands what is reachable everywhere else. They carry the authority the blast travels on. Planes: Identity (01), Token (02), API (04), Data Pipeline (05), Model Supply Chain (07).

Inner Ring -- Conditional

Risk is real but bounded by the nature of the plane -- dependent on specific conditions, limited scope, or probabilistic failure modes. Planes: Cloud (08), Endpoint (09).

3. THE 10 CONTROL PLANES

The following planes are documented in logical execution order -- the sequence in which a typical enterprise agent crosses infrastructure boundaries during a single workflow execution. Each plane documents: what the existing tool governs, what the agent actually does there, the resulting visibility gap, supporting evidence, and a blast radius reduction measure.

Plane 01

Identity Plane

Middle Ring . Elevated . Legacy tool: IAM . RBAC

What this plane governs.

Users, service accounts, OAuth grants, delegated access, RBAC scopes. IAM and RBAC were built to manage static access assignment for human actors. They answer: who has access, and when was it granted? They were not designed to evaluate autonomous execution patterns.

What the agent does here

The agent authenticates using a service account or OAuth token provisioned at setup. IAM validates it. From that point, every action the agent takes inherits the permissions of that identity. It never re-authenticates as it moves across systems. The badge is valid for the entire execution.

The visibility gap

IAM confirms validity on every call. There is no mechanism to ask whether the behaviour matches the purpose of the access. Control without behavioural evaluation becomes permission without accountability. Identity is the structural multiplier -- an over-privileged identity expands the blast radius of every plane the agent subsequently touches.

Evidence

Blast radius reduction

Scope the service account to the minimum objects the agent actually needs -- not the role a human in that function carries. Enforce time-bounded tokens tied to the expected execution window.

Plane 02

Token Plane

Middle Ring . Elevated . Legacy tool: Secret Scanning

What this plane governs

Bearer tokens, API keys, session tokens, JWTs. Secret scanning was built to prevent accidental human credential exposure. It assumes tokens are used intentionally by a known operator -- not autonomously inherited and chained across workflows.

What the agent does here

The agent carries its credentials as runtime variables passed in at instantiation. They are never written to a repo. Secret scanning never sees them. The agent chains these tokens across systems: Salesforce, Slack, SharePoint. Each system sees a valid credential. None of them know the same entity presented to all three.

The visibility gap

Tokens are portable identity. The credential was not stolen -- it was handed to a pipeline running unsupervised. Secret scanning has no visibility into runtime token chaining across trust boundaries.

Evidence

Blast radius reduction

Issue per-task tokens scoped to a specific operation, expiring on completion. Each link in the chain has a defined scope and lifespan.

Plane 03

SaaS Plane

Outer Ring . Highest blast radius . Legacy tool: CASB

What this plane governs

Enterprise SaaS applications with embedded or external AI integrations -- M365 Copilot, Salesforce Einstein, Notion AI, HubSpot. CASB governs where users go, not how AI features inside approved applications process or transmit data.

What the agent does here

The agent calls into sanctioned applications. CASB sees approved traffic and clears it. What it cannot see: the caller is an autonomous reasoning engine making programmatic API calls at a rate no human would generate, pulling data across objects no human session would touch sequentially.

The visibility gap

Shadow AI here does not look unsanctioned. It looks approved. CASB approved the application. It has no protocol for what executes inside it. Blast radius is proportional to what the platform holds -- for most enterprises, the entire operational estate.

Evidence

Blast radius reduction

Apply rate limits at the application layer scoped by caller identity, not globally. If the agent's service account pulls records at 10x the rate of any human session, the throttle engages -- not because it is flagged as malicious, but because the rate profile is outside the defined envelope for that identity.

Plane 04

API Plane

API Gateway Middle Ring -- Elevated -- Legacy tool: API Gateway

What this plane governs

Programmatic access between systems via REST, GraphQL, gRPC. API gateways validate whether a caller is authorized and within rate limits. They were not designed to reason about semantic payload content.

What the agent does here

The agent issues POST requests. The gateway checks authentication, rate limits, endpoint availability -- all pass. The body contains data the agent aggregated from earlier planes. The gateway evaluates the envelope, not the contents. The agent is now moving data laterally across systems through legitimate API calls. This is where the non-linear execution graph begins.

The visibility gap

The gateway asked every question it was built to ask. None of them were about what was in the payload. In multi-model agentic workflows, LLM routing libraries sit between the application and every model it calls. A single compromise at the routing layer exposes all API keys, redirects all prompts, and injects into all downstream tool calls simultaneously.

Evidence

Blast radius reduction

Add payload size and structure anomaly detection at the API gateway layer. Validate routing layer integrity in multi-model deployments. An agent shipping a 4MB JSON body to an external endpoint looks structurally different from a normal API call.

Plane 05

Data Pipeline Plane

Middle Ring -- Elevated -- Legacy tool: Data Observability

What this plane governs

ETL/ELT workflows, orchestration layers -- Airflow, dbt, Fivetran, Kafka, Spark. Data observability tools validate reliability: job completion, row counts, schema drift. They assume transformation steps are deterministic data operations.

What the agent does here

If the agent is embedded in an orchestration workflow, it runs as a scheduled job. Pipeline monitoring sees: job started, job completed, output within expected parameters. It does not see what the agent did during execution -- potentially pulling 200,000 records, synthesizing them, and passing the result to an external LLM. The job completed successfully. The monitors are satisfied. The visibility gap Shadow AI here does not look like AI. It looks like a scheduled job. There is no framework for identifying an LLM call embedded within a transformation step.

Evidence

Blast radius reduction

Set data volume watermarks per job and alert when the agent exceeds them. If an agent embedded in a DAG is expected to process 500 records per run and processes 200,000, that is a detectable deviation even if the job completes successfully.

Plane 06

Embedded Copilot Plane

Outer Ring -- Highest blast radius -- Legacy tool: DLP

What this plane governs

AI features built natively into enterprise platforms: M365 Copilot, Salesforce Einstein, GitHub Copilot, ServiceNow Now Assist. DLP systems were built to detect predefined sensitive data patterns moving across known channels. They have no model for synthesized responses.

What the agent does here

The agent synthesizes across Salesforce, SharePoint, Slack, and internal wikis. None of those sources triggered a DLP rule individually. The output combines information that never existed in one place before. DLP watches for data leaving. This data never left -- it was assembled from what was already there.

The visibility gap

Highest blast radius. Lowest perceived risk. Fully sanctioned. DLP was built to detect data leaving -- not data that never leaves but gets understood. A fully sanctioned copilot with org-wide read access can produce outputs aggregating information that never previously existed in a single document. Damage is often undetectable after the fact.

Evidence

Blast radius reduction

Classify synthesized outputs before delivery -- evaluate what the agent produced, not what it read. Structural classification, not keyword matching: does this output contain aggregated information that should not exist in a single document?

Plane 07

Model Supply Chain Plane

Middle Ring -- Elevated -- Legacy tool: SCA / SBOM

What this plane governs

External models, third-party inference APIs, fine-tuned models, open-source weights, agent skills, MCP servers. SCA tools evaluate code dependencies against known vulnerabilities. They assume software artifacts are deterministic binaries -- not probabilistic reasoning engines or runtime-composable agent skills.

What the agent does here

The agent calls an LLM and executes skills from a registry. Neither the model nor the skills are in the SBOM. If a skill was poisoned or a model fine-tuned to introduce specific behaviours, the agent exhibits those behaviours. Nobody has a framework to identify them before execution.

The visibility gap

SBOMs do not include AI models as a standard artifact category. SCA has no framework for model weight integrity, training data provenance, or behaviours that only activate under specific conditions. Agent skills compose at runtime -- the supply chain is no longer static.

Evidence

Blast radius reduction

Pin models to specific verified versions and validate the hash before each execution. Catalog all agent skills and MCP servers as first-class SBOM artifacts. Restrict AI-driven bots in CI/CD from using publication credentials without human approval.

Plane 08

Cloud Plane

Conditional -- Legacy tool: CSPM

What this plane governs

AWS, Azure, GCP workloads, AI services, model hosting infrastructure. CSPM tools reason about infrastructure state -- misconfigurations, exposed storage, overly permissive IAM roles. They evaluate static posture, not dynamic workload behaviour.

What the agent does here

The agent runs inside correctly configured infrastructure. CSPM did its job at configuration time. What happens at runtime -- what the process running on that instance is actually doing -- is outside CSPM's scope. The enclosure passed inspection. The agent was already running inside it.

The visibility gap

Cloud posture tools see configuration. Shadow AI operates in behaviour. Risk here is context-dependent rather than structural: a cloud-hosted agent with broad data access is an outer ring problem; an agent in a well-scoped environment with runtime monitoring gaps is an inner ring problem.

Evidence

Blast radius reduction

Add runtime process monitoring at the compute layer -- separate from CSPM. Watch which file paths the process accesses, which network destinations it calls, how much memory it consumes. Deviation from a defined behavioural baseline triggers a log entry.

Plane 09

Endpoint Plane

Inner Ring -- Conditional -- Legacy tool: EDR

What this plane governs

User laptops, desktops, mobile devices. EDR platforms detect malicious binaries and anomalous behaviour derived from human-initiated attacks. Detection models are trained on malware, exploitation, and lateral movement patterns.

What the agent does here

If any part of the agent runs locally, EDR sees a legitimate process. Not matching a malware signature. Not exhibiting an exploitation pattern. Reading files, making network calls, writing to disk. All legitimate operations. EDR has no category for an autonomous reasoning engine traversing a filesystem.

The visibility gap

EDR sees malware. It does not see autonomous reasoning. The process is legitimate. The behaviour has no precedent in the detection model. With autonomous exploitation capabilities operating at machine speed, this gap is no longer theoretical -- legitimate processes now run autonomous vulnerability discovery loops.

Evidence

Blast radius reduction

Sandbox the agent with explicit filesystem path restrictions and network egress rules. Outside defined boundaries, calls fail structurally -- not flagged, blocked. The agent completes its task within its operational envelope.

Plane 10

Agentic Workflow Plane

Outer Ring -- Highest blast radius -- Legacy tool: SIEM / SOAR

What this plane governs

Autonomous AI systems chaining tools, memory, APIs, and execution across trust zones. SIEM and SOAR were built to correlate discrete events generated by human sessions and deterministic applications. Agentic AI generates non-linear execution graphs that resemble neither traditional user behaviour nor known malware patterns.

What the agent does here

SIEM watches for attack narratives: reconnaissance, lateral movement, exfiltration. The agent's execution log is none of those things -- it is a reasoning trace: goal evaluation, tool selection, sub-agent delegation, memory read, recursive API call, output generation. It matches no MITRE technique. No alert fires. The only record is whatever the developer built in.

The visibility gap

An agentic workflow touches every other plane in a single execution -- authenticating at Identity, chaining tokens, traversing SaaS, calling APIs, writing to pipelines. Blast radius is a function of what the agent was authorised to reach multiplied by everything it silently touched in one run.

Evidence

Blast radius reduction

Require agent-native execution logging exported to SIEM as a structured event type. Every reasoning step, tool call, sub-agent spawn, and memory operation gets written to a defined schema. SIEM does not need to understand the agent's logic -- it needs the trace. The Autonomous Action Runtime Management specification (AARM) formalizes the structural requirements for this control plane: pre-execution interception, intent-aligned policy evaluation, five-decision authorization, tamper-evident receipts, and identity-bound action logging exportable to SIEM as a structured event type. AARM Core conformance (R1-R6) addresses the forensic record gap directly; AARM Extended (R7-R9) adds semantic drift tracking and least-privilege enforcement at execution time [11].

4. THE THROUGH-LINE

Every control plane has a detection tool. Every tool encodes assumptions about human intent and linear execution. Shadow AI violates those assumptions simultaneously -- introducing autonomous, non-deterministic actors operating across trust boundaries that were never designed to coordinate against them. The agent is not crossing planes sequentially like an attacker would. It is operating across multiple planes simultaneously as a function of its design. Identity, tokens, SaaS, APIs, pipelines -- the agent touches all of these in a single execution.

The evidence is consistent across every incident cited in this paper. The supply chain compromise was invisible to SCA. The enforcement failures were invisible to SIEM, EDR, and WAF. The first in-the-wild autonomous agent intrusion matched no MITRE technique. The autonomous exploitation capabilities operate faster than human defenders can generate a ticket. In each case, the tool designed to detect the activity was asking the wrong question.

The runtime is not a gap in one tool. It is a gap in the architecture of enterprise security itself -- built for a world where the actors were human, the execution was linear, and the activity left a trace someone had thought to look for. The emergence of runtime management as a formal system category [11] signals that the industry has begun to recognize this -- but recognition and deployment are not the same thing. The planes documented here will remain exposed until controls are enforced at the execution layer, not the policy document.

5. SECURITY POSTURE RECOMMENDATIONS

5.1 Audit the Model Supply Chain

• Catalog all agent skills, MCP servers, and third-party plugins currently active in the environment to identify unauthorized or unverified components.

• Cross-reference active packages against known-good repositories to detect typosquatting or poisoned dependencies.

• Restrict AI-driven bots in CI/CD pipelines from using publication credentials without human-in-the-loop approval. 5.2 Harden API and Data Planes

• Validate routing library integrity -- ensure libraries handling multi-model routing are configured with strict logging and API key rotation.

• Move beyond envelope-level validation at the API gateway by implementing content inspection for prompts and injected tool calls.

• Update DLP policies to acknowledge that current DLP cannot inspect synthesized outputs.

5.2 Harden API and Data Planes

• Validate routing library integrity ensure libraries handling multi-model routing are configured with strict logging and API key rotation.

• Move beyond envelope-level validation at the API gateway by implementing content inspection for prompts and injected tool calls.

• Update DLP policies to acknowledge that current DLP cannot inspect synthesized outputs.

5.3 Adjust Endpoint and Identity Monitoring

• Review permissions of service accounts used by local orchestrators -- ensure they do not carry broad filesystem or network access.

• Configure EDR and SIEM to alert on legitimate processes that exhibit non-linear, high-speed file traversal or network activity.

• Treat AI agents as high-risk identities requiring the same MFA and privilege restriction as a human administrative user.

  
  

5.4 Enhance Response Readiness

• Run red-team exercises that simulate autonomous zero-day discovery and sandbox escapes to identify detection gaps in existing SOC workflows.

• Prioritize and automate the intake of vendor advisories for embedded copilots - these are often the only source of discovery for server-side enforcement failures.

6. CONCLUSION

The 10 Control Planes framework documents a structural gap in enterprise security architecture that cannot be resolved by any single tool or vendor. The agent is not an attacker -- it is a legitimate, sanctioned process executing inside infrastructure that was never designed to observe it.

None of the mitigations described here stop the agent. They shrink the radius of what is reachable if the agent behaves unexpectedly, and they create the forensic record that currently does not exist. The workflow executes. The damage envelope is defined rather than open-ended.

The planes documented here will not remain static. The evidence cited throughout this paper is not a historical record -- it is a leading indicator. Each incident represents a proof of concept that a larger class of actors will operationalize. The question for enterprise security is not whether agentic AI will be exploited at scale. It already has been. The question is whether the architecture governing it will be redesigned before the blast radius becomes uncontainable.

References.

[1] IBM Security. (2025). Cost of a Data Breach Report 2025. IBM Corporation.

[2] GitHub; Nightfall AI. (2024). Secret scanning and API key exposure analysis.

[3] UpGuard; IBM; Netskope; CybSafe/NCA. (2024--2025). Shadow AI and employee data sharing surveys.

[4] Traceable AI; Salt Security; Work AI Institute. (2025). State of API Security and AI data flow controls.

[5] Palo Alto Networks. (2025). Unit 42 AI Security Report.

[6] Aim Security; Microsoft. (2025--2026). EchoLeak CVE-2025-32711 disclosure; CW1226324 advisory.

[7] Antiy CERT; SecurityScorecard; OWASP ASI Incidents Tracker. (2026). ClawHub compromise and MCP impersonation incidents.

[8] Orca Security. (2025). State of Cloud Security Report.

[9] Anthropic / Project Glasswing. (2026). Mythos Preview capability disclosures, April 2026. Distributed to participating organizations under restricted access.

[10] Sysdig Threat Research Team. (2026). LLM-Driven Attack: First Observed In-the-Wild Autonomous Agent Intrusion. Sysdig Security Blog, May 2026. https://sysdig.com/blog/llm-driven-attack/

[11] Errico, H. (2026). Autonomous Action Runtime Management (AARM): A System Category Specification for Securing AI-Driven Actions at Runtime. Cloud Security Alliance Technical Working Group. arXiv:2602.09433.