The first AI-infrastructure wave was about training scale. The next is about production control: who decides, at the moment of execution, which capability runs, for which user, agent, and workflow, under which policy. Five architectures own fragments of that decision today, and they barely overlap.
But trace the verified record of the last eighteen months (four security acquisitions, a $113M war chest for the biggest neutral gateway, capability tiers from both frontier labs, an identity standard for agents) and every one of them is converging on the same junction: the identity-aware request path. This essay maps the five architectures, documents the convergence, and closes with a falsifiable call on who claims the junction.
The model is no longer the whole product. The runtime is.
The next durable AI-infra control plane answers more than “which model should run?” It answers: “should this user or agent, in this workflow, with this data, be allowed to access this level of intelligence under this policy?”
How do we serve tokens cheaply?
The inference-optimization layer: KV cache, batching, latency, throughput, GPU scheduling, quantization, and model hosting.
How do we govern capability?
The governed-execution layer: identity, semantic risk classification, capability-tier authorization, fallback, audit, retention, and tool/action policy.
Agents turn text into action.
Once models use tools, memory, code execution, internal data, and long-running state, safety and access become runtime-engineering problems. Not just model or app-layer ones.
AI infra is splitting into two layers
The first layer is inference optimization: serving tokens faster and cheaper (KV cache, batching, utilization, quantization, latency, throughput, memory bandwidth, GPU scheduling, prefill/decode optimization, and model hosting).
The second layer is governed execution: deciding whether a capability should run at all, under what permissions, with what safeguards, and with which fallback. This layer matters once models become agents: long-running, tool-using, stateful systems that act on data and workflows.
1 · Inference optimization
Goal: serve tokens faster and cheaper.
- KV cache
- Batching / utilization
- Latency / throughput
- GPU scheduling
- Quantization / hosting
2 · Governed execution
Goal: decide whether and how capability should run.
- Identity + workflow context
- Semantic risk classification
- Capability-tier authorization
- Fallback / approval / audit
- Tool permissions + retention
This is the shift from cost per token to cost and control per completed workflow. A coding agent doesn’t make one model call. It searches a codebase, plans changes, edits files, runs tests, handles failures, retries, and produces a reviewable output. A clinical or legal agent doesn’t simply produce text. It touches regulated data, invokes tools, follows approval paths, and leaves an audit trail.
Anthropic’s Fable/Mythos launch made the pattern visible
Anthropic’s Claude Fable 5 / Claude Mythos 5 launch is the clearest public example of capability governance. Anthropic describes Fable 5 as a Mythos-class model made safe for general use, while Mythos 5 is the same underlying model with safeguards lifted in some areas, initially deployed through Project Glasswing, in collaboration with the US government, to a vetted group of cyberdefenders and infrastructure providers. When Fable 5’s classifiers flag a request as touching cybersecurity, biology/chemistry, or distillation, the response is handled by Claude Opus 4.8 instead of the Mythos-class model, and the user is told when it happens.1
What most people will see
- Better coding and reasoning benchmarks
- Longer autonomous work
- Stronger vision and scientific capabilities
- Higher-value use across cyber, software, and biology
What the infra lens sees
- Capability tiers, not one universal model surface
- Risk classifiers deciding access at runtime
- Fallback routing to a safer / lower-capability model
- Trusted-access programs for high-risk domains
- Retention and audit as part of product design
Why the details matter
Anthropic says Fable 5 and Mythos 5 are priced at $10 per million input tokens and $50 per million output tokens, and that the fallback triggers in under 5% of sessions. By its own account the safeguards are tuned conservatively, catching some harmless requests on purpose. It will also require 30-day retention for all traffic on Mythos-class models, on both first- and third-party surfaces, to detect complex attacks, novel jailbreaks, and patterns that operate across many requests.1
That last clause is doing more work than it looks: the lab’s policy now travels with the model wherever it’s served. Fable 5 went GA in GitHub Copilot the day it launched, with the retention requirement attached in the changelog.2 Within 24 hours, one lab’s governance decision had propagated into another company’s developer product, as our June 10 briefing flagged for anyone about to flip the org-wide default.
The trusted-access roadmap is even more telling. The biology program Anthropic describes will ship Fable 5 with the biology and chemistry safeguards removed but the cyber safeguards still in place.1 Capability policy is no longer one dial. It’s per-domain, per-user unbundling, decided at serving time. That is not model-release strategy. That is a policy engine, shipped as a product surface.
And it isn’t one lab’s quirk. OpenAI gates API access to its most capable models behind government-ID organization verification. Capability tiers enforced through identity rather than classifiers.3 Different mechanism, same architectural statement: access to frontier capability is becoming a runtime decision made in the serving stack. One lab keys the decision to what you’re asking; the other keys it to who you are. The control plane this essay describes is what happens when something fuses both.
Old world: prompt → model
- User sends a prompt.
- App chooses a model.
- Model responds.
Optimizes for: quality, latency, cost.
Control surface: basic moderation / prompt filtering.
Mental model: “Which model should I call?”
New world: capability-governed execution
- User or agent sends a request.
- Identity + workflow context attached.
- Risk / domain classified.
- Policy decides the capability tier.
- Routed to frontier model, safer fallback, cheaper model, or blocked.
- Tools, actions, logging, and retention governed.
Mental model: “Should this capability run for this workflow, under this policy?”
OpenRouter is close. Traditional IAM is adjacent. The missing layer is capability access.
The natural question is whether this is simply model routing or traditional access control. It’s related to both, but identical to neither.
Traditional IAM / IGA
Governs resource access.
Helps organizations manage who can reach which applications, systems, and data. An important input to the AI control plane. But it usually doesn’t understand model capability, semantic risk, tool actions, or multi-turn agent behavior.
Asks: “Who has access to what resource?”
Model routing / gateways
Routes model & provider access.
Platforms like OpenRouter abstract many models and providers behind one interface and support routing, fallbacks, provider policies, privacy settings, budgets, and guardrails.4
Asks: “Which model or provider should handle this request?”
Capability control plane
Governs capability access.
Combines identity, workflow context, semantic risk, model routing, retention, tool permissions, approvals, and multi-turn adversarial detection.
Asks: “Should this user/agent access this level of intelligence for this task?”
The crisp distinction
Traditional access control governs resources. Model routers govern model selection. The missing layer governs capability access.
It would integrate with identity tools, model gateways, and AI-security products. But its core value is AI-native: semantic risk classification, capability-tier authorization, model fallback, tool/action permissions, retention/audit, and multi-turn adversarial detection.
Reference architecture: the AI capability control plane
Architecturally, the missing layer is not a prompt filter. It is an execution control plane that sits between users/agents, identity systems, AI-security tools, model routers, tool runtimes, and audit systems.
User / agent request
Prompt, files, memory, tool intent, objective.
Identity + context
Who is asking? Role, org, customer, workflow, data sensitivity.
Semantic risk
Cyber? Bio? Finance? Code execution? Distillation? Adversarial?
Policy engine
Allowed? Needs fallback? Approval? Retention?
Routing engine
Frontier, safer fallback, cheaper, self-hosted, or block.
Execution + output
Result, tool calls, actions, audit trail, session replay.
Identity / access
Users, roles, entitlements, app/resource permissions.
AI security + guardrails
Prompt defense, data-leak prevention, policy enforcement.
Model routing / gateway
Provider abstraction, fallback, latency/cost routing.
The four product layers
1. Identity + context
The system needs the user, organization, role, customer, workflow, data classification, tool permissions, and autonomy level.
2. Semantic risk classification
It must classify intent and risk across prompts, retrieved data, tool calls, outputs, and multi-turn behavior.
3. Routing + action policy
It decides whether to allow the frontier model, route to fallback, require approval, redact data, block, or restrict tool use.
4. Audit + observability
It reconstructs why a model was chosen, what data was sent, what tools were called, what policy fired, and what the agent did.
Everyone owns a piece. Security platforms are buying the rest.
The category is spread across model routers, AI gateways, enterprise governance tools, LLM firewalls, runtime-protection vendors, DLP, observability, and evals. But “fragmented” no longer means “up for grabs.”
In about a year, four of the most-cited independents were absorbed by security platforms: Palo Alto Networks took Protect AI in July 2025,5 SentinelOne announced Prompt Security in August 2025 and closed it within a month,6 Check Point completed its reported ~$300M acquisition of Lakera in November 2025,7 and Palo Alto closed Portkey in May 2026, framing it explicitly as a “control plane to monitor, orchestrate, and govern autonomous AI agents.”8
Capital followed the same path on the neutral side: in May 2026 OpenRouter raised a $113M Series B led by Alphabet’s CapitalG (with NVIDIA’s NVentures, ServiceNow, Snowflake, MongoDB, and Databricks all in the round) at a reported ~$1.3B valuation, on volume that grew from 5T to 25T tokens a week in six months.9 Consolidation isn’t a risk to this analysis. It’s the current state of the market, and the buyers and backers have already named the prize.
OpenAI gates frontier API access behind government ID
Organization verification (passport or licence plus liveness check) becomes the key to the most capable models. Identity enters the serving stack.3
Palo Alto Networks closes Protect AI
The first big security-platform move on AI-model security: posture, scanning, and red-teaming for models and applications.5
SentinelOne buys Prompt Security (~$250M announced)
Runtime GenAI inspection (prompts, responses, data leakage) folds into an endpoint-security platform.6
Check Point completes Lakera (~$300M reported)
The best-known LLM firewall becomes the AI-security R&D core of a network-security incumbent.7
Anthropic opens Project Glasswing
Claude Mythos Preview (the first Mythos-class model) ships to vetted cyberdefenders in collaboration with the US government. Trusted access becomes a deployment model.1
Palo Alto announces and closes Portkey
An AI gateway processing trillions of tokens a month, bought to be the “control plane” for autonomous agents inside Prisma AIRS.8
OpenRouter raises $113M Series B at ~$1.3B
Alphabet’s CapitalG leads; NVIDIA, ServiceNow, Snowflake, MongoDB, and Databricks join. The neutral-gateway seat gets strategically capitalized, by the companies whose models it routes.9
Read the timeline as one motion, not eight events: security platforms bought the inspection layer and then the path; the biggest neutral path got funded by the model owners themselves; and both frontier labs shipped capability governance keyed to classifiers or identity. Everyone is building toward the same junction from their own corner.
What the roll-up has not produced is a product that owns the whole question. To see why, stop reading these companies as competitors on one field and look at where each one physically sits. They occupy different positions along the execution path, and each position fixes what a product there can and cannot govern.
Five architectures, five blind spots
Identity & entitlements
Controls: which humans (and increasingly which agents) may hold which apps, roles, and entitlements. Access requests, reviews, joiner-mover-leaver. Now standardizing agent access itself: Okta’s Cross App Access extends OAuth for agent-to-app connections.10
Blind spot: never sees a prompt, a tool call, or a model choice. It governs standing access before any request exists, not execution.
Agent & data governance
Controls: which data, tools, and actions an agent may use mid-task: permission-aware retrieval, approvals, audit logs.
Blind spot: reach ends at its own platform. Agents built anywhere else never pass through it.
Gateway / router
Controls: every call that transits it (provider choice, fallback, budgets, caching, rate limits, coarse policy) across all providers at once. Early identity hooks are arriving: OpenRouter’s guardrails already attach budgets, model allowlists, and ZDR policy to org members and keys.4
Blind spot: thin context. It knows the key and the member, rarely the workflow, data classification, or semantic risk behind the request. And it owns no model capability.
Security inspection
Controls: classification of prompts, outputs, tool calls, MCP and agent-to-agent traffic; blocks, redacts, and alerts at runtime. And the frontier of the category is pushing into agentic access control with policies keyed to user role and data sensitivity.11
Blind spot: an advisory seat. It inspects what it is shown but owns neither routing nor fallback. It can say “no,” it cannot say “run it safer.”
Model lab
Controls: capability tiers, classifier-triggered fallback, retention, trusted access. The deepest control that exists anywhere in the stack, now reaching across surfaces via policies that travel with the model.
Blind spot: ends at its own fleet. Anthropic’s tiers govern Anthropic’s models; nothing it ships governs a competitor’s.
This is why the market feels crowded and empty at the same time. These are not five competitors; they are five floors of the same building, and each floor’s product is shaped by what its position lets it see. It is also where loosely-used names sort themselves out: Lumos, sometimes cited as an AI control plane, is an identity-governance product. It works several floors above the request path, governing entitlements rather than execution.
That is a real and growing job as agents acquire identities, but it is a different machine from what Anthropic built. Anthropic’s tiers decide at the moment of inference which capability runs; an IGA product decides, ahead of time, who is allowed to hold which keys. Different altitude, different objects, different architecture.
Lay these five against the request flow in Diagram 3 and the gap is explicit: identity systems own step 02, inspection owns step 03, gateways own step 05, and the labs own steps 03–05 inside their own fleet. No shipping product owns 01 through 06 across providers.
The only residents of the junction today are labs. And a lab’s governance stops at its own fleet.
Anthropic and OpenAI hold the corner because they own both the models and the controls around them; nothing either ships governs a competitor’s models. Gateways climb in from the right with thin-but-thickening identity context; inspection and governance vendors climb in from the left without routing; the security platforms that bought them are assembling the pieces but haven’t yet joined them; identity vendors are standardizing the rails from above. The provider-neutral version of that corner (deep capability governance fused with cross-provider routing) is still unowned. The closing section is a call on who claims it.
Anthropic (Fable/Mythos)
The deepest controls in market: capability tiers, classifier-triggered fallback to Opus 4.8, 30-day Mythos-class retention, trusted access, inside its own serving stack only.1
OpenRouter
Closest public comp for neutral routing: budgets, member- and key-level guardrails, model/provider restrictions, zero-data-retention enforcement4, now backed by a $113M Series B led by Alphabet’s CapitalG, with NVIDIA among the backers, at a reported ~$1.3B.9
Portkey / Palo Alto
The clearest convergence signal: an AI gateway acquired into a security platform and framed as the control plane for monitoring, orchestrating, and governing autonomous agents at scale.8
Cloudflare AI Gateway
Network/infrastructure gateway with caching, rate limiting, guardrails, dynamic routing, and data-loss prevention. Distribution through the existing edge.12
Lakera / Check Point
LLM firewall: prompt defense, jailbreak and injection detection, content moderation, data-leak protection. Now the AI-security R&D core of a network-security incumbent.13, 7
Prompt Security / SentinelOne + Noma
Runtime agent-security surface: prompts, responses, tool calls, MCP interactions, agent-to-agent communication, and runtime enforcement, with Noma extending into policy-based agentic access control.11, 6
Credal
Enterprise-agent governance from the platform seat: permission-aware data access, policy controls, deployment, and audit logging for internal agents.14
The identity layer (Lumos, Okta, SailPoint)
Entitlements, access reviews, joiner-mover-leaver, now extending to agent identities, with Cross App Access (XAA) standardizing agent-to-app connections on OAuth rails.10 Governs standing access at the org layer, above the request path; it does not see prompts and does not route models.
The investable wedge isn’t “guardrails.” It’s policy-aware execution.
A simple prompt filter is too narrow. The more interesting wedge is a policy-aware execution layer for high-capability agentic workflows.
Where this matters first
Cybersecurity
The same capability can support defenders or accelerate attackers. The control layer has to distinguish defensive workflows from offensive misuse and govern tools/actions accordingly.
Life sciences
Scientific models can accelerate research while creating dual-use risk. Trusted access, audit, and domain-specific policy become product requirements.
Coding agents
Code agents need repo context, sandboxing, test execution, tool permissions, rollback, and human review. The model is only one part of the runtime.
Healthcare / legal
Sensitive data, compliance, retention, explainability, and human approval make generic routing insufficient.
Finance
Data sensitivity, regulated advice, audit requirements, and model-selection policy make governance inseparable from deployment.
Enterprise agents
Agents with internal tools and write access need contextual authorization, not just static app permissions.
Questions that separate a platform from a prompt filter
For companies building this layer
- Can you show the full inference and tool-call graph?
- Where do you attach identity, role, customer, and workflow context?
- Can policies vary by user, data sensitivity, customer, geography, and workflow?
- Can you route to a safer model instead of simply blocking?
- Can you detect multi-turn jailbreaks, or only single-turn attacks?
- Can you govern tool calls and write actions, not just prompts?
- Can you reconstruct what an agent did across an entire session?
For AI application companies
- What is your cost per completed workflow, not per API call?
- Which model calls are latency-sensitive vs. batchable?
- Where do retries explode?
- Which data is too sensitive to leave your environment?
- Where does human approval enter the loop?
- What actions can the agent take, and who owns the audit trail?
- Which part of the workflow would you pay to never think about again?
What’s next: the control plane forms at the junction
Pull the threads together and the structure of the argument is simple. Four verified forces are converging on one seat. First, capability governance exists and works. Anthropic runs classifier-gated tiers in production and OpenAI runs identity-gated tiers, so the question “should this request get frontier capability?” is already answered daily, just only inside each lab’s fleet. Second, the security platforms spent ~18 months and four acquisitions buying inspection and path. They have the CISO and the parts, not yet the joined product.
Third, the neutral gateway seat was just capitalized by the model owners themselves: Alphabet and NVIDIA priced OpenRouter’s seat at ~$1.3B in May. Fourth, identity is standardizing the missing rail. Cross App Access extends OAuth to agent connections, which means an in-path product no longer has to build the org graph; it can consume it.10
Capability governance, in other words, is becoming a property of the request path. And the ingredient that turns a pipe into a control plane is identity. Three players can plausibly assemble the junction:
Security platforms
The consensus winner. They own the CISO, and they bought inspection (Lakera, Prompt Security, Protect AI) and the path (Portkey). Missing: deep workload identity, and any ownership of model capability.
Gateways
The topological winner. The gateway is the only seat where cross-provider routing and in-line policy already coexist. And member/key-level guardrails show the identity hooks forming. Missing: the enterprise security buyer, and context richer than a key.
Model labs
The capability winner. Tiers, fallback, retention that travels to third-party surfaces (the deepest controls anywhere) but structurally confined to their own fleet. No enterprise will run five per-lab governance stacks as its control plane.
The identity vendors are the long shot: they own the org graph everyone else lacks, and with XAA they are writing the protocol the winner will speak. But they have never operated in the data path, and descending into it is a bigger leap than any the other three must make. The likelier outcome is that the winning seat consumes identity through integration, which is also the honest answer to where IGA products like Lumos land in this market: as the system of record the control plane reads, not the control plane itself.
Three takeaways
Our Call
By December 31, 2027, the default way enterprises govern frontier-model access will be an identity-aware AI gateway (an in-path product that sets capability tier per user, agent, and workflow), not a per-lab feature and not a standalone prompt firewall. At least one of Palo Alto’s Portkey line, Cloudflare AI Gateway, or a neutral router will ship capability-tier policy keyed to workload identity (XAA or equivalent), and it will appear as a named requirement in enterprise AI RFPs.
The case: four independents on this map were acquired into security platforms within roughly a year; the largest neutral gateway was capitalized by the model owners themselves; Anthropic normalized inference-time capability tiers, fallback routing, and cross-surface retention; OpenAI normalized identity-gated access to frontier models; and the identity layer shipped an open standard for agent access. Path plus identity is the only junction where every required signal already flows.
What proves us wrong: labs shipping cross-provider governance APIs that enterprises actually adopt (collapsing the layer into the model side), or agentic usage staying read-only long enough that inspection-style DLP suffices and gateways remain dumb pipes.
Settles: December 31, 2027.
References and research base
- Anthropic, “Claude Fable 5 and Claude Mythos 5,” June 9, 2026. Used for the same-model distinction, fallback to Opus 4.8, the under-5% fallback statement, conservative classifier tuning, pricing, Project Glasswing and the US-government deployment, the per-domain trusted-access programs, and 30-day retention across first- and third-party surfaces (detailed further in Anthropic’s retention policy note). Source.
- GitHub Changelog, “Claude Fable 5 is generally available for GitHub Copilot,” June 9, 2026. Used for day-one third-party availability and the attached data-retention requirement. Source; see also our June 10 briefing.
- OpenAI Help Center, “API Organization Verification.” Used for government-ID identity-gated access to OpenAI’s most capable API models and features. Source.
- OpenRouter documentation: Guardrails, Provider Routing, and Zero Data Retention. Used for member- and key-level guardrail assignment, budgets, model/provider allowlists, ZDR enforcement, and routing behavior. Guardrails, Provider routing, ZDR.
- Palo Alto Networks, “Palo Alto Networks Completes Acquisition of Protect AI,” July 2025. Used for the start of the security-platform roll-up. Source.
- SentinelOne, “SentinelOne to Acquire Prompt Security” (announced August 5, 2025; completed September 5, 2025). Used for Prompt Security as runtime GenAI security, data-leak prevention, prompt-injection enforcement, and the deal timeline. Source.
- Check Point, “Check Point Acquires Lakera to Deliver End-to-End AI Security for Enterprises” (announced September 16, 2025; completed November 11, 2025). Used for Lakera’s ownership and the consolidation timeline; deal size of roughly $300M as reported by Calcalist. Press release, Calcalist.
- Palo Alto Networks, “Palo Alto Networks Completes Acquisition of Portkey to Secure AI Agents” (announced April 30, 2026; completed May 29, 2026). Used for the “control plane to monitor, orchestrate, and govern autonomous AI agents” framing and the Prisma AIRS integration. Source.
- OpenRouter, “OpenRouter Raises $113M Series B,” May 2026; valuation of ~$1.3B as reported by TechCrunch. Used for the CapitalG-led round, NVIDIA/ServiceNow/Snowflake/MongoDB/Databricks participation, and the 5T→25T weekly token-volume figure. Announcement, TechCrunch.
- Okta, “Cross App Access,” an open protocol extending OAuth/OIDC to secure AI-agent and app-to-app connections, announced June 2025 with support from AWS, Google Cloud, Salesforce, Box, and others. Used for the agent-identity standardization claim. Announcement, Solution page.
- Noma Security, “AI Runtime Protection” and “Agentic Access Control.” Used for monitoring prompts, responses, tool calls, MCP-server interactions, agent-to-agent communications, and policy enforcement by user role and data sensitivity. Runtime protection, Agentic access control.
- Cloudflare AI Gateway docs. Used for caching, rate limiting, guardrails, dynamic routing, and data-loss prevention. Source.
- Lakera Guard documentation. Used for prompt defense, jailbreak/prompt-injection detection, content moderation, and data-leak framing. Source.
- Credal homepage and security pages. Used for enterprise-agent governance, permission-aware data access, audit logging, and policy enforcement. Homepage, Security.
Source-quality note
This analysis combines the Anthropic Fable/Mythos announcement and our own daily coverage with primary or official sources from Anthropic, OpenAI, GitHub, OpenRouter, Cloudflare, Palo Alto Networks, Check Point, SentinelOne, Okta, Credal, Lakera, and Noma. Every deal date, deal size, pricing figure, and product claim above was re-verified against these sources on June 11, 2026. Company-positioning claims (including market-map placement and the architecture diagram) should be read as a thesis map rather than a diligence conclusion; each vendor’s actual product depth would need customer calls and technical testing.
Revised June 11, 2026 (second revision): fact-checked all claims against primary sources; added the convergence timeline, OpenRouter’s $113M Series B, Palo Alto’s Protect AI deal, Okta’s Cross App Access, cross-surface retention and per-domain safeguard unbundling from the Anthropic launch; rebuilt the market map with named positions and direction-of-travel vectors; renumbered references in order of appearance. Earlier revision (June 11): corrected Lakera’s ownership (Check Point, November 2025); re-classified Lumos to the identity layer.