“We have a policy that says customer data does not go to a third-party model. Is it enforced?”
There is an honest answer to that in most companies and it takes a while to say out loud. The policy exists. It was approved in March, it is in the wiki, and two of the five teams have read it. Nothing on the path between those teams’ applications and the model has ever heard of it.
Three planes
Policy is a decision an organisation made and wrote down. Evidence is what shows, afterwards, that the decision held. Between them sits the plane that makes it true at the moment it matters, and that plane is not a document.
The first and the third have owners. Risk and compliance own the policy. The auditor and the binder own the evidence. Both of those jobs come with a person whose title contains the word. The middle plane has no natural owner. It belongs to whoever runs the traffic, and nobody wrote it into their job, so it goes missing.
A programme with the first and the third and a gap between them is not lying to anyone. It produces evidence. The evidence is a screenshot of a setting, a config export, a signed statement that a team follows the policy. All of that evidences an intention.
The substitutes
Something always fills the gap. Training, a code review that catches the obvious cases, a prompt template with the right instructions at the top, a shared client library everybody is asked to import. Those are worth having and several of them are load-bearing.
They are not controls in the sense the binder means. None of them happens at the moment the request is made, and none can fail in a way anybody notices. The test is whether somebody would find out on the day one stopped being followed. For a habit nobody would. For a library nobody would, from the first service that does not import it.
The four verbs
For as long as one process holds the connection it can do four things. It can decide whether the request goes at all, redact one span of it, meter what it draws from a budget, and record what it did and under which rule.
Three of those change what happens. The fourth writes down what happened. Enforcement is the first three. The market talks about AI governance almost entirely in the vocabulary of the fourth, so the distinction is worth holding. A record is not a control. It is how a control becomes checkable, and it is worth less when it comes from a different system than the one that acted: evidence produced somewhere other than the decision is a claim about the enforcement, not a record of it.
Control plane
“AI control plane” has started to appear on vendor front pages. To anyone who runs traffic the phrase already means something specific. A control plane configures a data plane. It holds the configuration, agrees it across machines, and hands it to the thing in the path. It is not in the call.
We keep the word for that. pistra has a control plane in the strict sense, and it is not the part this series describes. What pistra puts in the call is a data plane that is allowed to say no.
If you arrived from our front page, the three words there map onto the four verbs. Access is decide plus meter, enforce is decide plus redact, prove is record.
Out of scope
pistra authors no policy. There is no risk register in it, no control library, no questionnaire, and no opinion about which framework you follow. It takes rules somebody else decided, makes them happen in the call, and signs what it did. A platform that owns your binder is the customer of that record, not a competitor for it.
If your middle plane is a code review
For a lot of programmes the honest answer is that the middle plane is a code review, a prompt template and a shared library, and for an internal tool that summarises meeting notes that is proportionate. Nobody needs a gateway to govern a summariser.
The answer does not change with how impressive the model is. It changes on the day the habit is not followed: a new service, a contractor’s project, an agent that calls a tool nobody registered, a team that found a faster provider. A habit covers the paths it knows about. The question was asked about the other ones.
Who already holds the path
The middle plane is a process on the path. Everything on that path already belongs to somebody: a proxy a team stood up in an afternoon, a gateway with an on-call rota, a marketplace on three expense reports, a service inside a cloud account another department owns. Each of them can hold the connection, and each was built for a buyer who wanted something else.
The rest of the series takes them one at a time. For each, two questions. While it holds the connection, what can it do, and whose record is it afterwards?