At The AI Enterprise Conference 2026, Hemakumar Velugula of Xnode argued that AI pilots stall because companies can't prove they control what agents reach, which models touch their data, and what it all costs. He described a control plane layer to close that gap.
Key takeaways
- Control, not capability, blocks production. Velugula said many pilots stall because leaders can't show what agents reach, what they cost or who did what.
- Access controls built for people don't fit agents. Agents lack human judgment, so controls have to move to the data layer.
- Exposure compounds. Four AI surfaces across 10 data systems create 40 pathways to company data.
- One policy, one gateway. A control plane defines policy once and enforces it across every surface, cloud and MCP server.
- Budgets belong in the platform. Spend limits by team, workflow, agent and model help avoid surprise bills.
Many enterprises can now prove that AI works. Far fewer can prove they are in control of it. That was the argument Hemakumar Velugula of Xnode made in the closing session of the day at The AI Enterprise Conference 2026 in New York City, where he said the enterprise AI stack is missing a layer: a control plane that sits between the applications people use and the infrastructure that runs the models.
Velugula, who said he has spent the past 20 years building complex systems in financial institutions, framed the talk around a conversation with the CIO of a financial services company about 18 months earlier.
Why do AI pilots stall even when the technology works?
The CIO had a board mandate, an approved AI budget and three promising pilots, including coding assistants that had lifted productivity for some users, Velugula said. But each time the work went to review, information security or another group asked questions he couldn't answer: what internal data the AI could reach, what it would cost, and whether the company could show auditors, months later, which person took which action on which day.
"I'm not worried about proving the technology, but I'm unable to prove I'm in control of it," Velugula recalled the CIO telling him. That gap, not model performance, was what kept the pilots from reaching production, he said.
He added that the company was careful not only about what data agents retrieved but about which models were allowed to touch it, to the point of keeping Jira tickets away from some frontier-lab models.
Why don't traditional access controls work for AI agents?
For three decades, Velugula said, enterprises built access controls for people. Those controls worked in part because people bring judgment, discretion and accountability. An employee who stumbles on irrelevant data will usually stop.
An agent, by contrast, will do everything it can to find an answer and has no judgment of its own, he said. Prompts that describe its limits are often changed without being tested or approved, and every change tells the model to do something different.
"We cannot rely on agent to stop by your prompt, by anything that we put on top," he said. "The access controls have to be reinvented. It has to go to the data layer."
What is an AI control plane?
Velugula described the enterprise AI stack as an application layer on top, where coding assistants, chat tools, Teams and Slack reach company data, and an infrastructure layer underneath, where models run on a company's own GPUs or a cloud provider's. What is missing, he said, is a governance layer between the two.
That layer covers more than policy, according to Velugula. It also includes financial operations, meaning visibility into how much is spent by company, workflow, agent and team, and orchestration of how internal data is exposed to every surface.
The problem compounds quickly. A company that exposes four surfaces to agents across 10 internal data systems, he said, has "actually ended up exposing 40 gates, 40 pathways" to its data.
What does it take to move AI agents from pilot to production?
Velugula listed the capabilities he said a production-ready setup needs:
- One policy layer defined once and enforced across every surface, whether that is 40 or 400
- One enforcement point, routing agents built on different clouds, vendor-hosted MCP servers and internal systems through a single gateway
- No cost surprises, with budgets and cost-center allocation at the team, workflow, agent and model level
- Intelligent model routing, since not every model fits every task, with a human in the loop to teach the system which tasks are simple or complex
- Egress controls to keep institutional knowledge and IP inside the company's network
He acknowledged that companies can assemble these controls from separate tools, but said the seams between them still have to be bridged. Xnode's product, Xnode Cortex, is designed to bring them into one platform, he said.
How do record-level AI policies work in practice?
In a demo, three users asked an agent the same question about an account's custody relationships and fund balances. One user with full access got the complete answer, with the reasoning, tool calls and model cost visible. A second user without access was blocked by a guardrail "on the way in, not on the way out," Velugula said, with an explanation of which policy triggered. A third user in investor relations received the answer with some account details masked.
The same policy produced all three outcomes, he said, and an administrator could see a full trail of each interaction. Budget limits could also be set at the model, team, account or workspace level.
Velugula closed with six questions he suggested enterprises ask any vendor, grouped into three areas: which records an agent can read, and whether denials and approvals can be shown for a given agent or person on a given day; which models can touch which types of data under a unified policy; and whether AI spend can be limited by user, agent and model while keeping data inside the company network.
More on AI governance at The AI Enterprise Conference 2027
Questions about controlling agents, data access and AI spend ran through many sessions at the 2026 conference. The AI Enterprise Conference returns to Pier Sixty in New York City on Tuesday, August 31, 2027, with registration coming soon. Between conferences, Data Science Connect hosts free live webinars on enterprise AI throughout the year.
Frequently asked questions
What is an AI control plane?
As Velugula described it, a governance layer between AI applications and model infrastructure that enforces data-access policy, tracks and limits spend, and orchestrates how company data is exposed to agents.
Why don't traditional access controls work for AI agents?
They were designed around people who bring judgment and accountability. Agents will do whatever they can to find an answer, so Velugula said controls must be enforced at the data layer.
How can companies control AI agent costs?
Velugula recommended budgets and cost-center allocation at the team, workflow, agent and model level, plus routing simpler tasks to cheaper models.
What questions should enterprises ask AI governance vendors?
Velugula suggested asking which records an agent can read, whether approvals and denials can be shown per person and day, which models can touch which data, and whether spend and data egress can be limited.
Watch: Your Enterprise AI Stack Is Missing Its Control Plane on YouTube
Event: The AI Enterprise Conference · More coverage: The AI Enterprise Conference insights
