Redpanda Agentic Data Plane Overview
Enterprises spent decades building governance for their human workforce: identity, access control, audit trails, and accountability. They never built the same controls for AI agents. Most agents run with broad credentials, no identity of their own, and no record of what they did, which is why enterprise AI so often stalls before it reaches production.
Redpanda Agentic Data Plane closes that gap. Agentic Data Plane is governance infrastructure for enterprise agents: it sits between your agents and your data, gives every agent an identity, mediates every tool call and data access, and records every action so you can replay and audit it. With Agentic Data Plane, you connect agents to all your enterprise data, from real-time event streams to databases and business systems, and run them safely at scale without losing control.
Agentic Data Plane builds on open standards, including MCP, OAuth, OpenTelemetry, and the Kafka protocol, so governance sits above your choice of LLM, cloud, or agent framework. You stay free to adopt new models and frameworks as they emerge, without re-platforming or locking into a single vendor.
Agentic Data Plane is its own product surface. It runs on Redpanda, so there’s no separate cluster to stand up first: Redpanda provisions the underlying environment when you add Agentic Data Plane.
After reading this page, you will be able to:
-
Identify the key components of Redpanda Agentic Data Plane and their purposes
-
Describe how each component addresses enterprise governance and reliability requirements
-
Determine whether Redpanda Agentic Data Plane fits your organization’s requirements for AI agent deployment
Who runs each component
Managed and self-managed describe runtime ownership, not whether a resource is governed. Redpanda runs managed agents and managed MCP server implementations. You run self-managed agents and MCP servers, while Agentic Data Plane registers their identities and fronts their model or tool traffic through the gateways. An LLM provider is different: it is a gateway connection to an upstream model service, not a model runtime hosted in Agentic Data Plane.
In practice, the split looks like this:
| Resource | You | Redpanda |
|---|---|---|
Managed agent |
Configure the system prompt, model, tools, and subagents. |
Runs the agent, gives it an identity, and records every run. |
Self-managed agent |
Build, run, and host the agent in your own framework. |
Registers its identity and fronts its LLM and tool calls through the gateways. |
Managed MCP server |
Pick a type from the catalog and supply the upstream credentials. |
Hosts the server implementation and manages its upgrades. |
Self-managed MCP server |
Host and operate the server. |
Fronts it with a managed URL and applies authentication, policy, and observability at the gateway. |
LLM provider |
Supply the upstream account and its credentials, and choose the allowed models. |
Holds the credential in the Redpanda secret store and proxies every call through one URL per provider. The model itself runs at the upstream service. |
Guardrails, budgets, and access policies |
Define them. |
Enforces them at the gateway on every call they cover. |
Transcripts and the audit log |
Read them. |
Records them, as OpenTelemetry traces and audit events. |
Architecture
Agents and clients connect through Agentic Data Plane rather than reaching your systems directly. Agentic Data Plane gives every agent an identity and applies guardrails and spend caps, mediates tool and data access through MCP servers to your systems of record, and routes every LLM call through the AI Gateway. All activity streams to the Redpanda Data Platform as OpenTelemetry traces for replay, audit, and cost reporting.
AI Gateway
The AI Gateway is a managed proxy for LLM APIs. You configure an LLM provider once, and applications point at a Redpanda-hosted proxy URL while continuing to use the provider’s native SDK. Redpanda holds the upstream credentials, so application code never carries a provider API key and rotation happens in one place.
Because every LLM call flows through one managed entry point, you get usage and cost visibility broken down by provider, model, and user, across any agent framework or platform, including Redpanda’s own, without locking into any single vendor’s SDK. Applications authenticate with short-lived OIDC tokens issued to a user or a service account, and streaming responses pass through unchanged. To control spend, set caps and per-agent budgets in one place.
For more information, see How AI Gateway Works.
MCP servers
MCP servers translate agent intent into connections to databases, queues, HRIS, CRMs, and other business systems. They are the simplest way to give agents context and capabilities without writing glue code.
MCP servers are lightweight, support OIDC-based authentication, and enforce deterministic policies at the tool level. You pick a managed type from the marketplace and configure it with your credentials, or register a self-managed server. Because policy is enforced outside the model, a manipulated prompt can’t get an agent a tool call its policy denies.
With real-time debugging capabilities, you reduce integration time while getting enterprise-grade security. You can reuse your existing infrastructure and data sources rather than building new integrations from scratch.
For more information, see How MCP Servers Work.
AI agents
With Redpanda AI agents, you declare the agent behavior you want and Redpanda handles execution and orchestration. Instead of writing Python or JavaScript, you configure agents declaratively: set a system prompt, choose a model, and attach the tools the agent can use. You can orchestrate multiple specialized sub-agents, or bring your own frameworks like LangChain or LlamaIndex.
What makes this practical at scale is the tool supply: a catalog of managed MCP servers, plus any self-managed server you register, gives declarative definitions real reach into your systems.
The result is faster time-to-production, lower maintenance (declarative definitions instead of imperative code), and organizational consistency across teams.
For more information, see How Agents Work.
Built-in governance controls
Redpanda Agentic Data Plane addresses critical enterprise requirements across all components.
-
Security by design: MCP servers enforce policies at the tool level. Policy enforcement is deterministic and happens outside the model, so even a manipulated or creative prompt can’t get an agent a tool call its policy denies.
-
Unified authorization: All components use OIDC-based authentication with an on-behalf-of authorization model. When a user invokes an agent, Agentic Data Plane authorizes each action as that user, so the agent can do only what the user behind it is allowed to do. The agent’s own identity does not widen or narrow that check. The agent’s reach is bounded by its configuration, such as which MCP servers and LLM providers it connects to. This ensures proper data access scoping. An embedded identity provider lets any standards-compliant MCP client, such as Claude Desktop, Claude Code, or Microsoft Copilot Studio, connect over OAuth without custom header handling.
-
Complete observability: Redpanda Agentic Data Plane provides two levels of inspection. Execution logs (transcripts) give a read-only view of every agent run, capturing each prompt, response, and tool call with token usage per conversation, plus status, duration, and an interactive timeline. Traces are emitted as OpenTelemetry data into an immutable Redpanda topic with 100% sampling. Real-time debugging tools let you inspect individual MCP server calls down to individual tool invocations with full timing data. You can view detailed agent actions in Agentic Data Plane and replay data for agent evaluations. For more information, see How Observability Works.
-
Compliance and audit: Redpanda Agentic Data Plane records every agent action and the data sources used in each decision, which supports audit and compliance efforts (for example, frameworks such as ISO 42001 or the EU AI Act). Execution logs are stored in Redpanda topics and can be materialized to Iceberg tables for longer-term retention and analysis.
Use cases
Common Redpanda Agentic Data Plane use cases include:
-
Automate financial operations: Build agents that reconcile invoices across vendors and ERP systems, monitor real-time spending against budget, or review contracts against approved templates and flag out-of-policy clauses for legal review.
-
Streamline HR and people operations: Answer employee questions against benefits, payroll, and HRIS systems; automate onboarding and offboarding workflows; or triage internal support tickets to the right team.
-
Improve customer experience: Route customer inquiries to the right team, summarize prior support history before an agent picks up the case, or surface relevant knowledge-base articles in real time.
-
Modernize infrastructure operations: Detect anomalies in real-time telemetry from cloud, network, or factory equipment, correlate signals across disparate monitoring systems, and auto-create maintenance tickets with the relevant context already attached.
-
Extend enterprise productivity tools: Integrate Microsoft Copilot or other workplace agents with internal data sources and systems that are otherwise inaccessible.
Check your understanding
Answer each question, then expand it to compare.
Who runs a managed MCP server, and who runs a self-managed one? Does that change how the server is governed?
Redpanda runs managed agents and managed MCP server implementations. You run self-managed agents and MCP servers. The difference is runtime ownership only. Agentic Data Plane registers the identities of self-managed resources and fronts their model or tool traffic through the gateways, so identity, policy, and observability apply to both.
An agent acting for a user calls a tool that the agent’s configuration allows but the user lacks permission to use. What happens?
Agentic Data Plane denies the call. It authorizes each action as the user behind the agent. The agent’s own identity neither widens nor narrows that check. The agent’s configuration only bounds its reach, such as which MCP servers and LLM providers it connects to.
Is an LLM provider something Redpanda runs for you?
No. An LLM provider is a gateway connection to an upstream model service, not a model runtime hosted in Agentic Data Plane. Redpanda holds the upstream credentials and gives applications one proxy URL per provider, and the applications keep using the provider’s native SDK.
Is every agent run recorded, and can anyone change the record?
Yes and no. Every action is captured, nothing is sampled out, and the record is immutable. Transcripts are the read-only view of each run, and you can materialize execution logs to Iceberg tables for longer retention and analysis.
