Two planes, one product: Preloop and agentgateway

A security company can spend years reinventing agent lifecycle, policy authoring, and an HTTP proxy. We did not. ADR 0005 is explicit: Preloop is the control-plane foundation; agentgateway is the runtime. Intertrace owns composition, tenancy, authorize, telemetry, and the customer UX. That split is easy to draw and easy to violate the first time someone wants a quick admin page in the gateway or a second login in the foundation.

Customers should perceive one AI operating platform—not Preloop plus agentgateway plus Intertrace. After sign-in they connect environments, discover assets, route traffic, apply one policy plane, observe agents and models, investigate on one graph, and run governance workflows. Engineering default is reuse, then integrate, then extend, then contribute upstream. Replace a component only when it creates a measurable architectural limit. The rest of this essay is what that sentence costs in practice: pins, adapters, SSOTs, and a long list of things the foundations are not allowed to become.

Composition is not a vendor strategy dressed up as architecture. It is a bet that transport and lifecycle have matured in the open, and that the differentiated work is a security kernel: key-derived tenancy, fail-closed ExtAuthz, promptGuard, ExtMCP, authorize plus execution permits, SecurityEventEnvelope ingest, RLS, finding audit, and a product spine that does not leak upstream brands. If we rebuild the proxy, we will underbuild the kernel. If we ship the foundation’s console, we will split the operating picture. Both failure modes look like progress in a sprint review.

What each plane is for

The control plane, as composed, is discovery and onboarding patterns, agent lifecycle, and governance authoring. Those capabilities are wrapped behind lib/platform/preloop/. The pin lives in deploy/preloop/. A pin is not a deployed service. Adapter-only is the repository baseline. A remote Preloop process exists only when INTERTRACE_PRELOOP_BASE_URL is explicitly configured and operated. Docs that infer a live control-plane cluster from a VERSION file are how composition turns into fiction.

The data plane, as shipped, is Fly agentgateway at https://intertrace.fly.dev, currently pinned at v1.3.1, with --file YAML compiled in-repo. Clients present Bearer itr_rt_* keys. Planes live: LLM /v1/*, MCP /mcp, Inference, Service /service/* with a per-tenant registry, and A2A /a2a with deep inspect on message/send. Agentgateway owns routing, protocol translation, streaming, load balancing, rate limits, and multiplexing. It does not own policy decision SSOT, findings, org RLS, or the asset graph. The colocated Go enforcer is the security kernel on that path: ExtAuthz, promptGuard, ExtMCP, authorize plus permits, fail-closed.

There is a third feed that people keep trying to promote into a runtime. Agentregistry is catalog-only. We poll /v0/* from /api/cron/agentregistry-sync. Catalog entries enrich Estate. They do not terminate traffic. If a catalog row has no key and no event, it is a possibility. Treating registry as a second gateway is how you get two places that look like inventory and zero places that are true after a deploy.

• Control plane (compose): discovery and onboarding patterns, agent lifecycle, governance authoring—adapters under lib/platform/preloop/, pin in deploy/preloop/.
• Data plane (production): Fly agentgateway v1.3.1 at intertrace.fly.dev — LLM, MCP, Inference, Service, A2A — itr_rt_* keys, Intertrace Go enforcer on the hooks.
• Catalog feed: agentregistry poll-only. Not a second runtime, not a second console.
• Unified layer: Next.js product spine, Clerk identity, Convex entitlements, Supabase telemetry and RLS, authorize SSOT, SecurityEventEnvelope.

What we refuse to outsource

Key verification, org isolation, ExtAuthz decisions, promptGuard, ExtMCP, authorize plus permits, SecurityEventEnvelope ingestion, and RLS-backed investigation remain Intertrace. If a foundation grows a console, we still do not send customers there. The product spine—Connect, Estate, Traffic, Work, Graph, Policies, Labs—is the only operating picture. Directive labels from upstream (Overview, Discovery, Runtime, Gateway, Assets) map onto that spine in code. Customers should never have to know which open-source project contributed a pattern.

Authorize is the sharpest SSOT. Canonical pre-action API is POST /v1/actions/authorize plus a scoped, time-bounded execution permit. Legacy POST /v1/runtime/tool_calls/decision remains supported. Preloop CEL or YAML access rules, when reused, are authoring inputs that compile into Intertrace policy surfaces. They do not bypass authorize. They do not become a second decision engine because someone liked a DSL. Packs and framework mappings are likewise inputs. Readiness is computed from evidence. A composed platform that prints a compliance certificate from a YAML pack has composed a lie.

Identity is the next SSOT. Humans authenticate with Clerk on platform.intertrace.ai. Entitlements live in Convex. Telemetry lives in Supabase behind RLS. org_members is the membership source of truth for the dashboard; Mission Control’s organization_members stays in sync through triggers. Preloop JWTs, if a remote control-plane process is ever run, must federate into this plane. A second customer IdP is how you get two membership lists and one incident where a human can see findings in one UI and not the other.

Events are the third. Gateway and adapters emit into the same ingest path. OTel and access logs are enrichment. They are not the investigation store. If you let each foundation keep its own session explorer as the product, you will investigate with grep. SecurityEventEnvelope exists so Traffic, Work, and Graph share a schema: tenant_id, source, correlation, policy context. Changing the shape is a coordinated change, not a local convenience.

Pins, not vibes

deploy/agentgateway/ pins v1.3.1. deploy/preloop/ pins a commit. YAML for --file is compiled in lib/agentgateway/. That is how you compose open source without becoming a random git submodule of whoever tagged latest on a Tuesday. Fork only when blocked; document local diffs; track upstream releases and advisories; contribute fixes when practical; wrap behind interfaces so pin bumps do not leak into product code. Hygiene is slower than copying a binary into the repo. Hygiene is why a CVE in an upstream console is not automatically a CVE in the customer dashboard.

Config ownership follows the pin. Intertrace compiles agentgateway --file YAML. Agentgateway admin UI, arctl, and upstream consoles do not own product configuration. Pilot YAML is a development harness. Fly config.full.prod.yaml owns the hosted path. If an engineer can change production routing by clicking an upstream admin, composition has inverted: the foundation now owns the product, and the product is pretending.

The temptation of a second console

Preloop Console is a mature Lit UI. Agentgateway has admin surfaces. Both are useful to the people who build those projects. Neither is the Intertrace customer product. The temptation is always the same: a demo is easier if you send a design partner to the upstream UI that already has a session explorer or a route table. That demo teaches the customer that the product is two logins. It teaches engineering that mapping jobs onto the spine can wait. It teaches sales that screenshots can come from wherever. All three lessons are expensive to unlearn.

Mapping is mechanical once you refuse the second console. Discovery jobs land on Estate. Runtime and gateway jobs land on Traffic. Investigations land on Work. Policy authoring patterns land on Policies. Cost attribution dimensions land on Costs. Approvals extend existing notify/decide paths. Session replay models extend the Traffic timeline. Agentic flow workers, if integrated later, sit behind platform workflow APIs. None of that requires showing a Preloop brand. It does require not running Preloop’s model gateway or MCP firewall as a second data plane when agentgateway already owns connectivity.

Dual runtimes are the control-plane version of dual consoles. If Preloop terminates MCP and agentgateway also terminates MCP, you have two inspect points, two failure modes, and a customer who will pick the weaker one. ADR 0005 is explicit: do not run Preloop’s model gateway or MCP firewall as the customer data plane. Reuse authoring and lifecycle. Enforce on Fly. The Go enforcer is fail-closed on ExtAuthz, promptGuard, ExtMCP, and authorize plus permits. A second proxy that fails open “for authoring convenience” undoes the kernel.

Tenancy and the data plane

Composition does not relax tenancy. ExtAuthz calls POST /api/runtime/verify-key. The key maps to an organization. Caller-supplied org headers never override it. Every subsequent event, finding, and RLS query is bound to that org. If verify-key fails, the request does not proceed. Preloop discovery that creates assets must write into the same org_id space. A discovered agent that is not joinable to a runtime key is an Estate gap, not a second tenant model.

Human identity remains Clerk; machine identity remains itr_rt_*. Using one credential for both is convenient and wrong. Humans revoke sessions. Agents rotate keys. Incident response needs to disable a workload without locking an operator out of the dashboard. Composition makes this easier to get wrong, because each foundation has its own idea of a principal. The unified layer has to be rude: your JWT is not a runtime key, your runtime key is not a plan flag, your plan flag is not a finding.

Four hosts, still one product

Marketing lives on intertrace.ai. Auth and dashboard live on platform.intertrace.ai. Mission Control is mission.intertrace.ai. Docs are docs.intertrace.ai. Middleware 308s product paths off the apex. Hosts exist so marketing, product, mission operations, and documentation can have different auth and caching stories. They are not an invitation to fork the UX along foundation lines. Customers should not see a Preloop host or an agentgateway admin host. Internal muscle memory will try to collapse everything onto localhost or the apex. Resist that, and also resist inventing a fifth host for an upstream UI “just for now.”

Detection stays on the kernel

ADR 0004 freezes regex.go and riskgate pattern counts in CI. New misses go to intent-router prototypes, classifier eval and feedback, or tenant OPA. Protected assets always ForceAI. Benign skip is opt-in via INTERTRACE_INTENT_ROUTER_ALLOW_SKIP and default off. Composition does not mean the foundation’s string lists become the product. Org-specific constraints belong in tenant policy, not in a global MustCompile that happened to ship in an adapter. If a Preloop authoring input wants a deny rule, it compiles into authorize or OPA. It does not grow the frozen files.

Findings stay in the unified layer. Status changes append to finding_status_history via trigger. Application code passes status_change_source through withFindingChangeSource(). Structured attachments go in finding_evidence. Incidents are not auto-created for every finding or event; the product exposes manual create. A composed platform that opens a ticket in an upstream workflow for every classifier miss will train operators to ignore both queues. Work is the investigation hub. Graph is the relationship view. Neither is a dump of foundation logs.

How traffic actually flows

A customer app or agent sends a Bearer itr_rt_* key to the Fly edge. Agentgateway authenticates at the edge, routes by plane, and calls the Intertrace enforcer. Structured SecurityEventEnvelope events publish to ingest. Control-plane adapters enrich assets and can trigger governance workflows. The unified platform layer powers UI, APIs, analytics, and investigations. Operators define policies, approvals, budgets, and workflows in the Intertrace UI. Authoring inputs compile into policy bundles and asset control state. Intertrace publishes runtime-config and agentgateway YAML. Agentgateway enforces connectivity; Intertrace enforces security decisions.

1. Client → https://intertrace.fly.dev with itr_rt_*.
2. ExtAuthz → POST /api/runtime/verify-key → org_id. Failure is deny.
3. Plane route: /v1, /mcp, Inference, /service/*, /a2a.
4. promptGuard / ExtMCP / authorize+permits as applicable, fail-closed.
5. Permit presented at tool or MCP execution; chat-time suggestion is not authorization.
6. Envelope ingest off the user-visible hot path. Dashboard reads org-scoped rows under RLS.

What “one product” requires of engineering

Public routes remain under Intertrace /api/* and /v1/*. Hubs remain under /dashboard/*. Internal adapters may call a remote Preloop process or agentgateway admin APIs in environments that have them. Public customers do not. Screenshot capture, Clerk redirect URLs, and docs examples must use platform.intertrace.ai for product flows and intertrace.fly.dev for runtime examples. A README that still says to point at Railway for new work is a composition bug, not a style nit.

Capability inventory lives in lib/platform/composition.ts. When someone asks “do we have session replay?” the answer is not “Preloop does.” The answer is whether the spine surface exists, what the adapter wraps, and whether evidence lands in our store. Maturity language for industry solutions is even stricter: catalog-approved wording, evidence-computed readiness, packs as inputs. Composition does not let us borrow an upstream marketing claim.

The work we should still do ourselves is the work the foundations are not: discovery depth that joins keys to assets, ASPM-ish posture over AI estates, behavior analytics on traces, investigation graph, attack-path analysis, compliance mapping that stops at evidence, security copilots that cite envelopes. Reimplementing LLM/MCP/A2A transport is how a dual-plane architecture collapses back into a monolith that is worse than either upstream.

What breaks if you blur the planes

If the runtime starts owning findings, investigators will live in access logs and the dashboard will be a replica that is always slightly wrong. If the control plane starts terminating MCP “just for authoring,” you will have two inspect depths and a customer who picks the weaker path. If the unified layer starts minting org headers for the gateway to trust, key-derived tenancy is theater. If Mission Control writes membership only to organization_members, Estate on platform.intertrace.ai will disagree about who can see a row. Composition failures are rarely spectacular. They are two sources of truth that both look maintained.

The YAML compiler is the tell. When Intertrace compiles --file YAML, the product owns the data-plane config even though agentgateway executes it. When someone edits production routes in an upstream admin because it was faster than a pin bump, the tell has inverted. Better a slow compiler change than a fast click that is invisible to git. Better a slow compiler change than a fast click that is invisible to git. Pins exist so Tuesday’s upstream tag is not Wednesday’s customer incident. Adapters exist so Thursday’s Preloop CLI improvement can land as an Estate job without a second login.

Closing

Two planes, one product is a constraint, not a slogan. Preloop is the control-plane foundation: adapters, pins, authoring and lifecycle patterns. Agentgateway is the runtime: Fly, v1.3.1, all planes, itr_rt_* keys, Go enforcer on the hooks. Intertrace is the kernel and the spine. Customers never see the seam. Engineering sees the seam every day, and the job is to keep it from becoming a second login, a second runtime, a second IdP, or a second decision engine. Draw the diagram until that is boring. The first time it is exciting again, someone is about to ship a console.