---
title: "Control Plane Architecture"
description: "The Control Plane's relationships with the gateway and the other platform services, its registration flow, and its operational boundaries."
source: "Guardian Platform"
---
The Control Plane manages the Agent Gateway; it does not carry agent traffic. This page describes product responsibilities, not implementation internals.

## Platform Relationships

| Component             | Product role                                                                                                                                                                            |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Guardian              | Calls the Control Plane with the signed-in user's token for agent registration, inventory, configuration, audit trail, and plugin configuration views.                                  |
| LLM Gateway           | Verifies the registration tokens the Control Plane mints, loads the signed plugins and configurations it publishes, and writes the audit exchanges and state records it serves.         |
| Viper                 | Exchanges a registration token with the gateway to register an agent, then runs the agent's traffic through the gateway.                                                                |
| Auth Service          | Validates bearer tokens and API keys, checks permissions such as Register Agents and View Project Data, and resolves a caller's DID.                                                    |
| Governance Service    | Reads agent configurations and profiles for agent assessments and attaches the certifications it issues. The Control Plane doesn't call it: Auth Service answers for Guardian projects. |
| Integrity Service     | Dereferences project membership, compliance, and certification credentials and reports whether each is still active.                                                                    |
| Gateway database      | PostgreSQL shared with the LLM Gateway, which creates its tables. Holds agents, audit exchanges, state records, evidence, plugins, and configurations.                                  |
| Plugin artifact store | Object storage for the plugin artifacts the gateway downloads: Google Cloud Storage, an S3-compatible store, Azure Blob Storage, or a shared directory.                                 |
| VirusTotal (optional) | Scans the blobs callers look up through `/v1/vt-scans`, in the background.                                                                                                              |

## Registration Flow

1. A user in Guardian, or a pipeline with an API key, asks the Control Plane for a registration token for a named agent.
2. The Control Plane mints an agent ID and returns a single-use token that lasts 15 minutes. In a Guardian Platform deployment it first checks the caller's Register Agents permission with Auth Service.
3. Viper presents the token to the LLM Gateway along with the agent's new DID.
4. The gateway verifies the token against the secret it shares with the Control Plane, records the agent, and issues its registration credential. The agent then appears in the Control Plane's agent list.

## Background Work

On a fixed interval, `adapter_integrity.status_cache_ttl` (default `5m`), the Control Plane re-checks the status of stored project membership, project compliance, and agent certification credentials with Integrity Service. The certification check also confirms each certified agent still holds the operating profile its certification names. The gateway enforces the status the Control Plane last recorded. It judges configuration itself, request by request: each instance of an agent signs with its own key, and its requests are held to the configuration their own state gives.

## Operational Boundaries

The Control Plane is not on the request path between an agent and its model: an agent keeps running through the gateway while the Control Plane restarts. It does not issue identities or credentials either. Users and API keys come from Auth Service, agent DIDs from Viper, registration credentials from the gateway, and certifications from Governance Service. Integrity Service stores credentials and reports their status.

## Related

- [Control Plane Overview](./overview.mdx) — what the service owns and what it depends on
- [Gateway Basics](../user-guide/gateway-how-it-works.mdx) — the request path through the LLM Gateway
- [Register Agents](../user-guide/register-agents.mdx) — the registration flow from Guardian and from a pipeline
- [Policy as Code](../user-guide/policy-as-code.mdx) — publishing the plugins and configurations the gateway loads
- [Control Plane Configuration](./configuration.mdx) — the connection settings for each component
- [LLM Gateway Architecture](../llm-gateway/architecture.mdx) — the data path that reads what the Control Plane publishes