Control plane and data plane

The control plane decides which configuration is approved. The data plane uses an accepted version of that configuration to handle tool requests. Saving a change in the console and activating it in a runtime are separate events.

Architecture / trust boundaryAM / 05

One governed path to your tools

Scroll the diagram sideways to see the full flow →

↻ Replay

01020304

4 / 4

Only an allowed call reaches the approved upstream. The gateway records audit metadata.

Read the full explanation

1. Administrators approve servers, policy, and credential bindings in the control plane.
2. A data plane validates and activates an approved runtime projection.
3. The client sends its identity and tool request to the data plane. Policy is enforced here.
4. Only an allowed call reaches the approved upstream. The gateway records audit metadata.

The control plane owns configuration

Administrators register servers, select API operations, publish Cedar policies, and manage credential bindings here. PostgreSQL stores durable configuration and audit metadata. The console, Admin API, and CLI are interfaces to this administrative work.

An approval establishes that a resource is eligible for use. It does not give every caller permission to use it. Policy, credential bindings, route eligibility, and runtime freshness still apply.

The data plane owns each call

The data plane authenticates the caller, filters discovery, validates the requested tool input, evaluates policy, resolves a permitted credential, and routes the request. It records decision metadata without copying upstream secrets into the client response or audit event.

A client connects to a governed MCP endpoint. It does not use the Admin API as a replacement for the MCP protocol.

Configuration has a freshness boundary

Managed replicas accept validated runtime projections from the control plane. A failed refresh does not authorize an unlimited period of operation on an old policy. A last valid projection can remain active only within its freshness window; missing or expired configuration fails readiness closed.

Read runtime configuration delivery for the heartbeat, snapshot, and acknowledgement sequence.

State survives an individual worker

PostgreSQL is durable truth. Valkey supports hot session and cache state. Session affinity and revocation must remain correct when a worker changes. Stateless MCP traffic does not require a protocol session simply because the gateway records operational metadata.

Next, follow a first governed call.

Implementation reference

Read the source contract.