Long-Running Agents Need a Control Plane

When an agent works for hours or days, the key product is no longer the prompt box. It is the control plane around execution: identity, environment, permissions, checkpoints, logs and intervention. OpenAI’s Ona acquisition announcement explicitly links long-running agents to secure, customer-controlled cloud infrastructure. Enterprises should evaluate agent platforms as operating systems for delegated work, not as upgraded chat subscriptions.

What the evidence shows

AI use is moving from discrete questions toward persistent work. OpenAI says more than five million people use Codex weekly, with knowledge workers representing about 20% of users and growing more than three times as fast as developers. The company describes users running multiple tasks in parallel to research, analyze data and create work products.

Persistence changes the failure modes. A chat response is reviewed immediately and then disappears into a document or decision. A long-running agent accumulates context, touches tools, creates intermediate files, waits for outside events and may resume after the initiating user has moved on. Small ambiguities compound. Credentials can outlive the moment that justified them. A stalled task can retain resources or block another process.

The infrastructure response is visible in the product roadmap: customer-controlled cloud execution, remote environments, managed configuration and agent-native telemetry. OpenAI’s internal deployment description lists sandbox boundaries, approval policies, network controls and logs for prompts, tool calls, approval decisions and network events.

The operating consequence

This makes agent adoption an operations question. Procurement cannot stop at model quality and token price. Security needs to know where the agent runs, which identity it uses, what it can reach and how access expires. Business owners need to know who reviews intermediate decisions and who owns the result when work crosses team boundaries. Finance needs to understand how parallel tasks consume compute and paid services.

Traditional application logs answer what process ran. Agent logs also need to preserve why the action was attempted: the user’s request, the plan, evidence retrieved, approval state and tool result. That context is necessary for audit, incident response and learning. It is also sensitive. Retaining every prompt can expose commercial or personal information unless access and retention are designed carefully.

The pricing logic may change as well. A seat is easy to count, but persistent agents create value through completed workflows and capacity. Buyers will increasingly compare cost per resolved job, review burden and cycle-time reduction.

What operators should do now

Define an agent job as a first-class object. It should have an owner, objective, allowed systems, credential scope, budget, deadline, review points and completion test. Do not let a general workspace permission become the default authorization for every task.

Use graduated autonomy. Read-only research can proceed within defined sources. Drafting can create artifacts without publishing. External messages, payments, production changes and irreversible actions should stop for explicit approval unless a narrow pre-authorization exists. Time-limit those approvals.

Instrument the full chain. Capture the initiating request, plan changes, tool calls, data accessed, model and policy versions, approvals, outputs and exceptions. Give operators a live view of active tasks, spending, blocked steps and stale jobs. Build cancellation and credential revocation as normal controls.

Measure completed useful work rather than activity. Track cycle time, accepted output, human correction, exception rate, abandoned tasks, security events and cost per outcome. Parallelism is valuable only when coordination and review do not become the new bottleneck.

Start with a small job taxonomy rather than a universal autonomy policy. Research, analysis, code changes and external communications have different failure costs and review needs. A clear type system lets permissions and checkpoints follow the work instead of relying on every employee to redesign controls from scratch.

Plan for handoffs, too. Persistent work often outlasts a meeting, a shift or the person who started it. Another authorized owner should be able to understand the objective, see what changed and stop or resume the job without reconstructing its history. Continuity is part of reliability, not an administrative extra.

The decision

Long-running agents make software more capable and more stateful. The durable advantage will come from making that state observable and governable. Enterprises do not merely need smarter agents. They need a reliable place for delegated work to live, stop, resume and be held accountable.