Redpanda Agentic Data Plane Overview
Enterprises spent decades building governance for their human workforce: identity, access control, audit trails, and accountability. They never built the same controls for AI agents. Most agents run with broad credentials, no identity of their own, and no record of what they did, which is why enterprise AI so often stalls before it reaches production.
Redpanda Agentic Data Plane closes that gap. Agentic Data Plane is governance infrastructure for enterprise agents. It sits between your agents and your data, gives every agent an identity, mediates every tool call and data access, and records every action so you can replay and audit it. With Agentic Data Plane, you connect agents to all your enterprise data, from real-time event streams to databases and business systems, and run them safely at scale without losing control.
Agentic Data Plane builds on open standards, including MCP, OAuth, OpenTelemetry, and the Kafka protocol, so governance sits above your choice of LLM, cloud, or agent framework. You stay free to adopt new models and frameworks as they emerge, without re-platforming or locking into a single vendor.
After reading this page, you will be able to:
-
Identify the capability areas of Agentic Data Plane and what each one does
-
Describe how Agentic Data Plane identifies agents and governs, contains, and records their activity
-
Recognize whether Agentic Data Plane fits your organization’s requirements for AI agent deployment
Where Agentic Data Plane runs
Agentic Data Plane runs on Redpanda, in an environment that Redpanda deploys into your own AWS account or Google Cloud project through BYOC. You configure the environment in the Redpanda Cloud UI, including whether its gateway is reachable publicly or only from a private network. Then you provision it by running the rpk command the UI generates, with credentials for your cloud account. You then build and govern agents in it from the Agentic Data Plane UI or the CLI. To set one up, see Create an Agentic Data Plane Environment.
Who runs each component
Managed and self-managed describe runtime ownership, not whether a resource is governed. Redpanda runs managed agents and managed MCP server implementations. You run self-managed agents and MCP servers, while Agentic Data Plane registers their identities and fronts their model or tool traffic through the gateways. An LLM provider is different. It is a gateway connection to an upstream model service, not a model runtime hosted in Agentic Data Plane.
This table shows what you handle and what Redpanda handles for each resource:
| Resource | You | Redpanda |
|---|---|---|
Managed agent |
Configure the system prompt, model, tools, and subagents. |
Runs the agent, gives it an identity, and records its conversations at the transcript recording mode you choose. |
Self-managed agent |
Build, run, and host the agent in your own framework. |
Registers its identity and fronts its LLM and tool calls through the gateways. |
Managed MCP server |
Pick a type from the catalog and supply the upstream credentials. |
Hosts the server implementation and manages its upgrades. |
Self-managed MCP server |
Host and operate the server. |
Fronts it with a managed URL and applies authentication, policy, and observability at the gateway. |
LLM provider |
Supply the upstream account and its credentials, and choose the allowed models. |
Holds the credential in the Redpanda secret store and proxies every call through one URL per provider. The model itself runs at the upstream service. |
Guardrails (Preview), budgets, access policies, and kill switch policies |
Define them. |
Enforces guardrails, budgets, and access policies at the gateway on every call they cover. Evaluates kill switch policies over time windows and contains an agent at the gateway when one fires. |
Transcripts, traces, and the audit log |
Read them. |
Records them, as OpenTelemetry traces and audit events. |
Architecture
Agents and clients connect through Agentic Data Plane rather than reaching your systems directly. Agentic Data Plane gives every agent an identity and applies guardrails and spend caps, mediates tool and data access through MCP servers to your systems of record, and routes every LLM call through the AI Gateway. Model and tool calls stream to a Redpanda topic as OpenTelemetry traces for replay and debugging. Spend and authorization events are recorded separately, for cost reporting and the audit log.
Build agents
With Redpanda AI agents, you declare the agent behavior you want and Redpanda handles execution and orchestration. Instead of writing Python or JavaScript, you configure a managed agent declaratively. Set a system prompt, choose a model, and attach the MCP servers whose tools the agent can use. You can split work across specialized subagents. If you already run agents in your own framework, register them as self-managed agents so their model and tool calls flow through the gateways and they get the same identity, spend tracking, and traces. They get transcripts too when they stream their own OpenTelemetry spans.
Agents reach people and other systems in several ways. Triggers invoke a managed agent from Microsoft Teams or on a recurring schedule. External applications and agents call Agentic Data Plane agents over the open Agent2Agent (A2A) protocol. In a conversation, an agent can answer with inline charts or interactive visualizations when a picture reads better than a paragraph.
For more information, see Build Agents.
Connect data and tools
MCP servers give agents context and capabilities by connecting them to databases, queues, HRIS, CRMs, and other business systems without glue code. Pick a managed type from the catalog and configure it with your credentials, or register an MCP server you host yourself behind a managed URL. Policy is enforced at the tool level, outside the model, so a manipulated prompt can’t get an agent a tool call its policy denies.
Depending on its type, a server authenticates to its upstream system with a shared credential or with each end user’s own OAuth sign-in. Data policies (Preview) mask, drop, or filter tool data and restrict argument values before the model sees anything. Code mode cuts the token cost of a server with a large tool catalog. People can also add a server to the AI client they already use, such as Claude or Cursor, with Redpanda governing every call.
For more information, see Connect Data & Tools.
Route model traffic through AI Gateway
The AI Gateway is a managed proxy for LLM APIs. You configure an LLM provider once, and applications point at a Redpanda-hosted proxy URL while continuing to use the provider’s native SDK. Redpanda holds the upstream credentials, so application code never carries a provider API key and rotation happens in one place.
Because every LLM call flows through one managed entry point, you get usage and cost visibility broken down by provider, model, and user, across any agent framework, without locking into a single vendor’s SDK. Applications authenticate with an API key or with short-lived OIDC tokens issued to a user or a service account, and streaming responses pass through unchanged. Command-line coding agents such as Claude Code and Codex can route through the gateway too, so your team’s coding traffic gets the same credential handling and cost reporting.
For more information, see AI Gateway & LLM Providers.
Control and govern
Every component uses OIDC-based authentication with an on-behalf-of authorization model. When a user invokes an agent, Agentic Data Plane authorizes each action as that user, so the agent can do only what the user behind it is allowed to do. The agent’s own identity does not widen or narrow that check. The agent’s reach is bounded by its configuration, such as which MCP servers and LLM providers it connects to. An embedded identity provider lets any standards-compliant MCP client, such as Claude Desktop, Claude Code, or Microsoft Copilot Studio, connect over OAuth without custom header handling.
On top of identity, Agentic Data Plane gives you these controls:
-
Access policies: Cedar-based rules that permit or forbid specific actions, with conditions over resource tags and ownership. Administrators hold the built-in Admin role and author the policies that grant everyone else.
-
Tags: Key/value labels such as
team=paymentsthat let access policies and spend reports act on a whole team or environment at once. -
Guardrails (Preview): Filters attached to an LLM provider that can block prompt injection, deny off-topic content, and redact or block personally identifiable information in requests and responses.
-
Budgets and cost reporting: Hard spending caps per agent, plus spend broken down by agent, model, provider, user, or tag for chargeback.
-
Kill switch: An emergency stop that cuts an agent off from its LLM providers, MCP servers, and other agents. Contain an agent yourself, or let a kill switch policy contain it when its guardrail or data policy signals spike.
-
Secrets: One store for the API keys, tokens, and certificates your providers, servers, and triggers reference, so no one can read a credential back.
For more information, see Control & Govern.
Monitor and audit
The AI Gateway, managed MCP servers, and managed agents that record transcripts emit OpenTelemetry traces to a Redpanda topic, and self-managed agents can stream their own. From that record, Agentic Data Plane gives you several views:
-
Transcripts: A read-only, turn-by-turn view of each agent conversation, including its prompts, responses, tool calls, token usage, status, and duration. Each agent’s recording mode decides whether it keeps full content, metadata only, or nothing.
-
Traces: One row per agent run or AI Gateway call, expandable into spans, to find the call or policy decision behind a slow or failed run.
-
Audit log: Authorization decisions and configuration changes, with the user accountable, the resource, and whether the request was allowed. Recent events stay in streaming storage, and older ones are archived in an Apache Iceberg-backed store in object storage.
-
Agent network: A live map of your agents, the models they call, and the MCP servers they use, with usage, cost, and health.
-
Home page: What needs attention in the environment, plus gateway traffic, spend, and budget health.
Because Agentic Data Plane records every gateway call and authorization decision, plus the transcripts of agents that record them, it supports audit and compliance efforts under frameworks such as ISO 42001 or the EU AI Act.
For more information, see Monitor & Debug.
Automate with the CLI
The Agentic Data Plane CLI, rpk ai, manages the same resources as the Agentic Data Plane UI from your terminal, including LLM providers, MCP servers, OAuth providers and clients, agents, triggers, and secrets. Because every action is a command, you can script it and run it in continuous integration. For GitOps, keep resource definitions in Git. The apply command creates what’s missing and updates what has drifted, and diff previews those changes first. The same CLI also calls MCP tools, sends A2A messages, and launches coding agents through AI Gateway, all from one signed-in environment.
For more information, see Use the Agentic Data Plane CLI.
Use cases
Common Agentic Data Plane use cases include:
-
Finance operations: Reconcile NetSuite records against Ramp transactions, or review contracts in Ironclad. Each action runs with the requesting user’s own permissions in those systems, through per-user OAuth, and a budget caps what the agent spends on model calls.
-
HR and people operations: Answer employee questions from BambooHR employee and time-off data. Data policies (Preview) mask sensitive fields before the model sees them, and transcripts record the tool calls behind each answer.
-
Customer support: Summarize a customer’s history across Zendesk, Salesforce, and Pylon before a person picks up the case, and draft replies from Zendesk Help Center articles. Pylon writes stay off until you enable them, so a support agent starts read-only.
-
IT and infrastructure operations: Investigate an alert by querying Grafana metrics and logs and Sentry errors, then open or update a ServiceNow or Freshservice incident with the findings. If the agent starts misbehaving, the kill switch contains it, and the audit log records the authorization decision behind each call.
For the full list of systems agents can connect to, see Plug in an App, Database, or Tool.
Check your understanding
Answer each question, then expand it to compare.
Who runs a managed MCP server, and who runs a self-managed one? Does that change how the server is governed?
Redpanda runs managed agents and managed MCP server implementations. You run self-managed agents and MCP servers. The difference is runtime ownership only. Agentic Data Plane registers the identities of self-managed resources and fronts their model or tool traffic through the gateways, so identity, policy, and observability apply to both.
An agent acting for a user calls a tool that the agent’s configuration allows but the user lacks permission to use. What happens?
Agentic Data Plane denies the call. It authorizes each action as the user behind the agent. The agent’s own identity neither widens nor narrows that check. The agent’s configuration only bounds its reach, such as which MCP servers and LLM providers it connects to.
Is an LLM provider something Redpanda runs for you?
No. An LLM provider is a gateway connection to an upstream model service, not a model runtime hosted in Agentic Data Plane. Redpanda holds the upstream credentials and gives applications one proxy URL per provider, and the applications keep using the provider’s native SDK.
An agent starts making unexpected tool calls. How do you stop it, and how do you find out what it did?
Contain it with the kill switch, which cuts the agent off from its LLM providers, MCP servers, and other agents until you release it. Then read its traces and transcripts to see what each run did, and check the audit log for the authorization decisions behind its calls.
