Akuity, the company built by the people who created Argo CD and Kargo, launched two new products on September 14, 2026. One is the Agentic Control Plane. The other is the Akuity MCP Server. Together they let AI agents like Claude, Codex, or Cursor work on your software pipeline, but only under strict rules. The agent acts as the person who connected it. It gets only their permissions. Every action lands in the audit log under that person's name.
Here is the problem this solves, in plain words. Right now, a developer can hook an AI agent straight into a production cluster with a raw API token. Nobody checks who the agent is acting for. Nobody can say later what it did or why. Security teams call this the shadow-agent problem. It is already happening in many companies without anyone approving it.
The story: how agents sneak into production
Picture a normal team. A developer wants to try a coding agent on the real cluster, just once. The easy path is to paste a token and go. It works. Nobody notices. A month later, the security team finds an automated system with broad access making changes nobody can explain. That is the moment they realize they have a problem.
Akuity's launch blog post cites a 2026 CISO AI Risk Report (a Saviynt survey of 235 security chiefs) to size the gap. 71 percent of organizations already have AI tools touching core business systems. Only 16 percent govern that access well. 92 percent lack full visibility into what AI can reach. Those numbers come from Akuity's blog citing that report, so treat them as vendor-shared rather than independently proven. But the direction is clear. Access is running far ahead of control.
What actually launched
Two products, announced together:
- The Agentic Control Plane. This is the brain. It gives agents the context and permissions to act on your pipeline, under the same rules Akuity already enforces. Agents can see cluster health, deployment history, and which commit is behind each deployment.
- The Akuity MCP Server. This is the pipe. It speaks the Model Context Protocol, the open standard from Anthropic (see our MCP developer guide). Any MCP-capable agent can connect.
The split matters. The MCP Server moves data. The Control Plane decides what is allowed.
The core idea: the agent becomes you
This is the part worth understanding, and it is the heart of the design.
Every request an agent makes goes through the Control Plane. The plane checks it as the specific human who connected the agent. One login carries that person's permissions everywhere. No new credentials to create. No new endpoint for security to watch.
The agent never gets more power than its human. It inherits their role, and the company guardrail can cut it down further. Set the guardrail to read-only, and the agent gets refused for any change, even if the human would normally be allowed.
The flow has four steps, per Akuity's docs:
- The agent logs in as the person it acts for.
- The request is checked against that person's permissions and the company guardrail.
- The action runs, or gets refused.
- The change is written to the audit log under that person's name, marked as agent-made.
Compare that with the shared service account pattern. A shared account hides who really acted. This design shows it. The log says the engineer's name, plus the fact that an agent carried out the action.
The policy layer: blocking what permissions would allow
Permissions answer one question: can this person do this? The policy layer answers a different one: do we want an agent doing this, even when the person could?
That difference is the whole point. A senior engineer may have full rights to production. The company can still rule that no agent may touch a sensitive production action, period. Approval rules hold whether a release goes out from the UI, the CLI, or an AI agent. An action that needs sign-off stays pending until a human with the right role approves or rejects it.
Admins hold kill switches. They can turn off the MCP endpoint for the whole platform, for one instance, or revoke the credential behind any connection.
Does it work? The MLB early result
Akuity's release carries a customer quote from Michael Goodness, Principal DevOps Engineer at MLB:
"Within hours of enabling Akuity's Agentic Control Plane, it identified more than one hundred degraded applications, and in under ten minutes, it flagged one project as the source of a systemic issue, traced it to the root cause and had a fix ready to go."
That is a vendor-published customer quote, not an independent test. Treat it as a signal, not proof. But the shape of the result shows what good looks like: find the problem, say if it is systemic, hand over the fix.
How it compares with other guardrail tools
An AI gateway sits between agents and tools and brokers calls. A point guardrail bolts onto one product. Akuity's argument is that both miss the same thing. They sit outside the pipeline, so agent permissions live in one system and deployments live in another.
The Control Plane runs the pipeline itself. It already holds deployment history, cluster health, and change lineage. A gateway would have to rebuild that from the outside. Whether the advantage holds in practice, the market will test. But the framing is clean: identity, policy, and audit only line up when the enforcing system is the one running your deployments. (For the wider risk picture, see the real risks of AI agents.)
What it costs
The launch release publishes no pricing for the Control Plane or the MCP Server. The product is available on the Akuity Platform today, with a free trial at akuity.cloud. The platform pricing page shows a Pro tier from 495 dollars per month, but that page predates this launch and does not list Control Plane pricing. Do not read 495 as the price of this product. Pricing can change, so confirm on the official site.
FAQ
Is this just another MCP server? No. The MCP Server is the connection point. The Control Plane behind it is what does identity, policy, and audit. A raw open-source MCP server gives an agent access with none of that.
Can the agent do more than the human it acts for? No. The agent inherits the human's role and can only be cut down further by company guardrails, never raised.
Does it work with Claude, Cursor, and Codex? Yes. Anything that speaks MCP can connect. That covers the major coding agents.
Do I need to give the agent its own credentials? No. One connection authenticates the human once. There are no agent-specific secrets to rotate.
Who is Akuity? The company of the creators of Argo CD and Kargo, two widely used open source deployment tools. Their founders built these at Intuit and later Akuity. (For background on how agents plug into tools, our MCP deep dive covers the pattern.)
What to do next
If your team already connects coding agents to real infrastructure, try the free trial and watch what the audit log shows. Security teams can use the guardrail levels to test a read-only agent first. Argo CD or Kargo shops get the fastest win, since the governance layers onto tools they already run. And if you run raw MCP servers today, audit them this week. The shadow-agent problem does not wait.
