In October 2025 Gartner published its first Magic Quadrant for the category it abbreviates BOAT, evaluating 20 vendors. The press releases followed within hours. ServiceNow, Pega and Appian announced Leader placements. Camunda announced a Visionary position. Every vendor in the quadrant refreshed its messaging around “AI orchestration platform” and “agentic enterprise backbone”.
Gartner defined the category broadly, as platforms that “unify process orchestration, connectivity and agentic features to enable enterprise-wide automation.” It projects that 70% of enterprises will consolidate onto a single orchestration platform by 2030, up from 5% today. That prize sent every incumbent after the category.
Part 1 argued that AI increases fragmentation and creates demand for a neutral control plane. The usual objection is that Camunda, Temporal or LangChain will build it. They have the resources, they are closest to the problem, and they already serve the customers who need it.
The objection is reasonable. The answer is structural. Each of them earns its revenue from the perimeter a neutral control plane has to cross.
What a control plane requires
A control plane for agent workflows needs:
- Vendor independence. It governs an agent whichever model provider it calls, whichever framework built it and whichever runtime executes it.
- Runtime observability. It sees what agents do while they do it, beyond what the process definition prescribed.
- Readable intent. It holds business intent in artifacts that compliance officers, regulators and other non-engineers can read and audit.
- Portability. Its process definitions survive a change of runtime and a vendor consolidation cycle.
- Enforcement outside the loop. The mechanism that enforces a policy runs outside the agent’s execution environment, so the agent cannot get around it.
Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, and inadequate risk controls are among the causes it names. The Composio AI Agent Report 2025 found that 12% of enterprise agent initiatives reach production. Both figures point at what surrounds the agents.
The BPM school
Camunda, Appian and Pega built their businesses on process modelling, consulting practices and design-time tooling. Two decades of BPMN diagrams, workflow studios and implementation services created real value: audit artifacts for regulators, decision tables a business analyst can change without touching code, process definitions a compliance team can review without an engineer.
Camunda 8.7, released in April 2025, put AI agents inside BPMN ad-hoc sub-processes. Each agent runs inside a sub-process that fixes its available tools at model time. When the model decides a tool call is needed, Camunda activates the matching BPMN activity and logs the event. It is a real architectural extension of a durable modelling tradition.
Its governance stays at design time. The agent’s tool scope is set in the BPMN definition before execution begins. The model’s reasoning between logged tool invocations stays outside Zeebe’s event-sourced append-only log. Camunda’s own developer documentation names the limit for enterprise automation suites: visibility into agent behaviour and prompts may be limited or tied to the vendor’s own AI tools, and external agents may not get the same level of governance.
Flowable went further. Flowable 2025.1, released in July 2025, added an AI Agent Engine to both its BPMN and CMMN engines. It ships a family of agent task types: simple prompts, document extraction, RAG retrieval, delegation to an external platform, and Google’s A2A protocol. An Orchestrator Agent sits over a whole CMMN case, detecting intent and steering the case through a natural-language interface. It is the closest thing on the market to a case engine with declarative agent governance built in.
Its governance also lives entirely inside Flowable’s runtime, evaluated by Flowable’s engine over Flowable’s case model. A more capable in-platform agent is still in-platform. A control plane that governs only the agents built and deployed on its own platform is a perimeter.
The deeper conflict is incentive. Camunda’s customers pay for process modelling and design-time control. Appian’s regulated clients pay for compliance controls embedded in Appian’s workflow platform. Pega’s Next-Best-Action decisioning lives inside Pega’s CRM and BPM stack. Governing other vendors’ agents means giving up the platform stickiness and services revenue these businesses run on. Every consulting relationship, implementation engagement and multi-year licence assumes the customer stays inside the perimeter.
The durable execution school
Temporal, DBOS and Restate solve a different problem: what happens when a workflow crashes halfway. Temporal names OpenAI, Stripe, Netflix, Coinbase and JPMorgan Chase among more than 2,000 companies running it in production. When frontier labs put agent workflows into production they reach for durable execution, and Temporal does that job well.
In July 2025 OpenAI and Temporal announced an integration, built and maintained by Temporal against an extension point in OpenAI’s Agents SDK. It runs an agent’s orchestration logic as a Temporal workflow, with each model call and each tool call as a separately retryable activity. It reached general availability in March 2026. OpenAI’s agent SDK now has a supported production path onto Temporal’s execution guarantees. It ships with no governance layer, no process semantics and no audit trail a regulator can read without a developer.
Durability and governance are separate properties.
Temporal’s documentation calls it “Workflows-as-Code” and says it is “not a no-code Workflow engine”. Its event history records every step, retry, failure and signal. Reading it takes a developer. ISACA’s research on auditing agentic AI found that agentic AI offers no human-readable reasoning unless it is explicitly programmed to log it. A compliance officer cannot review Temporal’s history without help, and a regulator cannot take it as a submission.
JPMorgan Chase runs Temporal in production. JPMorgan has also published a separate governance architecture for agentic AI in treasury management, a layered accountability model that assigns responsibility across builders, risk functions and senior managers. None of those layers lives in Temporal. JPMorgan built the execution layer and the governance layer as different systems.
Temporal was absent from Gartner’s BOAT evaluation, where all 20 vendors are visual BPM or low-code platforms. Gartner’s definition asks for process orchestration, connectivity and agentic features unified with governance. Temporal supplies durable execution, one of the three. A neutral control plane above Temporal would weaken the case for running Temporal’s SDK on Temporal’s cloud, and that case is the business.
The agent framework school
LangSmith, LangChain’s closed-source observability and tracing platform, is the company’s commercial engine. Its value is the observability layer above the framework. A neutral observability standard, built on OpenTelemetry and portable across frameworks, would commoditise it.
The protocols follow the same incentives. As of mid-2026 four agent communication protocols compete: MCP, A2A, ACP and ANP. Each addresses a different tier. None covers the whole stack or bridges natively to the others. Forrester’s evaluation of the emerging agent control plane market found three standards gaps blocking vendor-agnostic implementations: incomplete OpenTelemetry semantic conventions for AI, no portable agent identity format, and no cross-plane schemas for propagating policy. An agent’s governance identity does not yet travel with it.
Framework lock-in through proprietary memory formats, custom tool schemas and incompatible agent communication patterns is deliberate. It turns developer adoption into platform revenue.
The structural reason
Each school optimised for what made it successful. BPM vendors optimised for design-time modelling and consulting relationships. Durable execution engines optimised for developer experience and execution reliability. Agent frameworks optimised for developer adoption and conversion to a managed platform.
Those optimisations built real businesses, and each one disqualifies its owner from neutrality. A control plane that governs across vendors, runs outside the execution loop and enforces policy an agent cannot bypass has to come from a company that is neither the modelling vendor, the preferred runtime nor the framework capturing developers.
The vendors best placed to market a control plane are the ones whose business models stop them building a neutral one.
How Kirto takes the job
The same test applies to Kirto. Flow is a process engine, and an engine that governs only the agents it runs fails the test the incumbents fail. Kirto meets it by splitting the job in two and putting the governing half on the request path, where every vendor’s agents pass.
Gate holds the request path for agents Kirto did not build. It is an inline gateway in front of model providers, MCP servers and A2A peer agents. Any client that speaks the OpenAI or Anthropic API, MCP or A2A calls through it by pointing at Gate’s address in place of the provider’s. A gateway-issued key identifies the caller. Access rules written in CEL decide which models, tools and peer agents that key may reach. Budgets meter it. Detectors inspect the content before it leaves. When client and provider speak the same dialect, Gate forwards the request byte for byte, so it takes no side on which model provider wins. It also runs beside a gateway you already operate, as an inspector over ext_proc that makes no routing decision.
Flow runs the processes agents work inside. It executes BPMN, CMMN and DMN as the standards specify, and runs an AI agent as a step in the process. The agent’s model, tools and approval gates are declared in a versioned spec pinned when the case starts, so publishing a new version cannot redirect a run in flight. The spec takes a base URL for the model provider. Pointed at Gate, Flow’s agents answer to the same keys and rules as every other vendor’s.
Both write records a third party can check. Gate chains each decision record to the one before it by hash and signs it with the node’s ed25519 key. kirto-gate audit verify reports every record that was altered, removed, moved or forged, and a trail that stops short of a head the cluster witnessed. Flow writes an append-only record of each case in the same transaction as the engine’s state change: branch conditions with their expressions and results, dispatched commands, agent turns with the raw model response, human approvals. kirto-flow-replay re-feeds the recorded inputs through a fresh engine and diffs what it derives against what was stored.
In the split, Flow’s agents reach models and tools through Gate on the same path as anyone else’s.
flowchart LR V["Agents from any vendor"] --> G subgraph F["Flow"] P["BPMN, CMMN, DMN process"] --> A["Agent step"] end A --> G["Gate: key, rules, detectors"] G --> M["Model providers"] G --> T["MCP servers"] G --> R["A2A peer agents"] G --> S["Signed audit trail"] F --> C["Case record, replayable"]
Kirto has no model to sell and no agent framework to adopt. It does sell a process engine, and that is why Gate treats Flow’s agents as one more caller.
What stays yours
Standards are the artifact that survives vendor consolidation. Flow’s process definitions are BPMN, CMMN and DMN documents, readable by any engine that implements the standard and by any auditor who knows it. Gate’s rules live in a configuration document you hold. Its trail is emitted on OpenTelemetry Logs to the collector you choose, and it verifies without trusting the node that wrote it. Both products run in your network.
When the market converges on a few orchestration platforms, the enterprises that come through it with their process definitions, policies and audit trails intact will be the ones that owned them. Part 3 defines the agent control plane those pieces make up.