Agentic Data Plane

Summary

What it is

The infrastructure layer governing data accessed autonomously by AI agents — MCP servers, catalog-enforced authorization, and gateway-level control composed into one policy surface between agents and storage.

Where it fits

One level up from the Catalog-Centric Control Plane: the catalog decides *what* a principal may touch; the agentic data plane extends that boundary to autonomous, asynchronous consumers and adds explainability — an audit trail for why an agent read what it read. Redpanda's AI Gateway, Polaris/Gravitino MCP enforcement, and AWS Labs' first-party MCP servers are the same pattern from three directions.

Misconceptions / Traps

Not a product — a composition pattern. Buying an "AI gateway" without catalog-level grants leaves the enforcement gap open.
Text-to-SQL with a service account is the anti-pattern this replaces; restricted MCP tool calls carry the principal's actual grants.

Key Connections

augments Catalog-Centric Control Plane — extends catalog governance to autonomous consumers
depends_on MCP Gateway — the enforcement chokepoint for agent tool traffic

Definition

What it is

The emerging infrastructure layer that governs, routes, and provides policy explainability for data accessed autonomously by AI agents — the composition of MCP servers, catalog-enforced authorization, and gateway-level control that sits between agents and the storage tier.

Why it exists

The primary consumer of data infrastructure is shifting from human analysts running static queries to autonomous agents traversing data asynchronously. Human-era controls assume a person behind every query; agents need the same authorization boundaries, row-level masking, and policy grants enforced *mechanically* at the data plane — plus an audit trail that can explain, after the fact, why an agent was allowed to read what it read. Vendors are converging on the pattern from different directions: [Redpanda](/node/redpanda)'s AI Gateway governs MCP servers and agents centrally, [Apache Polaris](/node/apache-polaris) and [Apache Gravitino](/node/apache-gravitino) enforce that an agent request respects the same grants as a human principal, and AWS Labs ships first-party MCP servers for its storage services.

Primary use cases

Letting AI agents query the lakehouse under enterprise RBAC, centralized governance of MCP server fleets, agent-access audit and explainability, replacing raw text-to-SQL execution with restricted, policy-checked tool calls.