The Agentic Control Plane

Claude Code, Codex, Antigravity, Cursor, Cline, Copilot — what they actually are, how they work, and what the thin wrapper problem reveals about moats in the AI era.

What “Agentic Control Plane” Actually Means

“Control plane” is a networking term. In a network, the control plane is the layer that decides how data should flow — the routing logic, the policies, the orchestration. The data plane is what actually moves the data.

Applied to AI agents: the model is the data plane — it processes tokens and generates responses. The control plane is everything around it: what context the model sees, what tools it can call, what permissions govern those calls, how results feed back into the loop.

Claude Code, OpenAI Codex, Google Antigravity, Cursor, Cline, Roo, Copilot — they are all control planes sitting above a model. The model changes. The control plane is the product.

This is not a subtle distinction. It is the central business and architectural question of the current moment.

The Landscape (July 2026)

Tool	Type	Architecture	Model approach	Moat
Claude Code	Terminal agent	Agentic loop + React/Ink TUI	Claude-native, Messages API	Deep Anthropic integration, CLAUDE.md, Teams
OpenAI Codex	Cloud coding agent	Async sandboxed tasks → diffs and PRs; ChatGPT-embedded + standalone macOS app (Feb 2026)	GPT-native	ChatGPT distribution, GitHub-native delegation
Google Antigravity	Agent-first IDE	Parallel agents + manager view, browser-based verification, CLI	Gemini-native (launched with Gemini 3, Nov 2025)	Google ecosystem, multi-agent orchestration
Cursor	AI-native IDE	Fork of VS Code + agent layer	Model-agnostic	IDE depth, codebase indexing; now inside SpaceX
Windsurf	AI-native IDE	Codeium-based IDE	In transition — team to Google, IP to Cognition	Uncertain roadmap post-acquisition collapse
Cline	VS Code extension	Agentic loop, XML tool format	Model-agnostic	Open-source, extensibility
Roo	VS Code extension	Multi-agent, role-driven	Model-agnostic	Custom modes, agentic orchestration
GitHub Copilot	IDE + chat	GitHub integration + agent	Mostly GPT-4o / o1	GitHub ecosystem, enterprise distribution
Devin	Autonomous coder	Full autonomy, cloud-hosted	Proprietary	Deep autonomy, long-horizon tasks

The signal: all three frontier labs now ship their own control plane — Anthropic’s Claude Code, OpenAI’s Codex, Google’s Antigravity. Same layer, three philosophies: the terminal, the delegated cloud task, the agent-first IDE. When the companies that train the models each build an agent layer on top of their own models, the premise of this chapter stops being a thesis — it is the product strategy of the entire frontier. And the $60 billion Anysphere acquisition the foreword opened with is the market saying the same thing: the biggest checks in technology are now written for this layer.

How Claude Code Actually Works

A March 31, 2026 architecture analysis (community-sourced, later cross-checked against Anthropic docs) describes Claude Code as an agent runtime rather than a chat wrapper. The details evolve by version, but the core loop is stable. (source: Appendix E — Agentic Control Plane)

The Agentic Loop

You type a goal
        │
        ▼
Claude produces text + tool_use blocks
        │
        ▼
Tools execute (Bash, Read, Write, Edit, Glob, Grep, Agent...)
        │
        ▼
tool_result fed back to Claude
        │
        ▼
Claude decides: more tools, or final response?
        │
        └──► loops until final response with no pending tool calls

Key detail: Claude can emit multiple tool_use blocks in a single turn. That allows one model response to trigger several operations in sequence. This follows Anthropic’s Messages API content-block model and is one reason the system behaves like an orchestrator rather than a single-turn assistant.

The Tool System

Tool inventory changes across releases, so exact counts are less important than structure. In practice, each tool follows the same shape:

Input schema (validated before execution)
Permission check (allow / deny / ask)
Execution logic
UI rendering (how execution appears in the terminal)

The meta-tools are architecturally important:

Agent (formerly Task) — spawns a subagent with isolated context and returns a summary to the parent session. This is how Claude Code parallelizes work inside a session.
MCP integration — loads additional tools from Model Context Protocol servers at runtime, so project-specific capabilities appear alongside built-ins.

The closest OpenClaw parallel is sessions_spawn: not identical implementation, but the same design goal — isolate subtasks in child contexts and merge results back.

The Permission Model — Layered Controls

The specific names and modes vary with release, but the control pattern is consistent:

1. Tool-level safety checks
2. Allow/deny settings
3. Sandbox or environment restrictions
4. Active permission mode
5. Hook-based overrides

This is the same governance philosophy you see in OpenClaw (TOOLS.md + policy) and Flowwink (skill scope + approval gates): layered controls, explicit operator boundaries, and human override paths.

The Memory System

CLAUDE.md — project-level persistent instructions
Local memory/session artifacts in ~/.claude/...
Resumable session history

The strong architectural parallel to OpenClaw is workspace-grounded memory: both systems persist operator-authored instructions as files and inject them into runtime context.

Teams — Parallel Sessions

Claude Code also supports Agent Teams (experimental), including split-pane workflows with tmux/iTerm2 and inter-agent coordination. This is a different surface than Flowwink’s A2A routing, but the underlying problem is the same: one lead context coordinating multiple specialized execution contexts.

Because Teams is still marked experimental in Anthropic docs, treat it as a fast-moving capability rather than a fixed contract.

The Agentic Moat

The most important business insight from studying all these control planes is this: building agentic is how you build a moat.

A thin wrapper sits passively between the user and the model. It has no memory of your data, no deep integration with your environment, no accumulated context that compounds over time. If the model provider ships the same feature, the wrapper evaporates.

An agentic product is different in kind. It owns an environment. It accumulates data the model cannot access elsewhere. It builds integrations that create switching costs. It gets better the longer it runs — not because the model improved, but because the agent learned.

This is why the most valuable products in this space all converge on the same answer: the model is the commodity. The control plane, the environment, and the data are the product.

What That Looks Like in Practice

Claude Code: Anthropic is the model provider, so disintermediation risk is zero. The product is the model’s capabilities delivered through a control plane Anthropic controls. Every Claude improvement benefits Claude Code automatically.

Flowwink/FlowPilot: Business data as moat. The agent accumulates 18 months of your leads, your content performance, your customer interactions. That context is not portable. The model can be swapped; the learned business knowledge cannot.

The Three Sources of Agentic Moat

Every defensible product in this space has at least one of these:

Environment ownership — you own where the agent operates (the IDE, the terminal, the sandbox, the CMS/CRM)
Accumulated data — the agent’s memory is your data, not the model’s weights
Ecosystem depth — integrations, configurations, and community that compound over time

A thin wrapper has none of these. Any product that builds one becomes significantly harder to compete away — not because the code is complex, but because the value lives outside the model.

This is why the architectural decisions in this chapter matter beyond engineering. Choosing to build a real control plane — with memory, with integrations, with a loop that learns — is also a business decision. It is the decision that separates a product from a prompt.

”Anyone Could Have Built Claude Code”

True — and irrelevant. The architecture is not complex; every concept in it (agentic loop, tool system, CLAUDE.md, permission model) is described in this handbook. But anyone could have built Airbnb after Craigslist proved demand for peer-to-peer rentals. The technical barrier is never the real barrier.

What matters is who recognized the problem worth solving, who made the considered design tradeoffs, who built the community, and who has the feedback loop of real usage at scale. Anthropic had all four.

The real lesson: the window to build a defensible agentic product is open right now, precisely because the concepts are known but the implementations are still forming. Build the equivalent of Claude Code for your vertical — healthcare, legal, manufacturing — before the foundation labs do, and you own that space.

The window closes. It always does.

The Convergence

Looking across Claude Code, Cline, Roo, OpenClaw, and Flowwink, the same architecture emerges independently:

Concept	Claude Code	OpenClaw	Flowwink
Workspace config	`CLAUDE.md`	`AGENTS.md`	`agent_memory:agents`
Soul/identity	Auto-memory	`SOUL.md`	`agent_memory:soul`
Memory	`~/.claude/sessions/`	`memory/*.md`	PostgreSQL + pgvector
Skills	MCP servers	`SKILL.md` + ClawHub	`agent_skills` DB table

These are not coincidences. This is the architecture of an autonomous agent. Everyone building in this space discovers it.

The question is not whether you’ll arrive at this architecture. It’s whether you’ll arrive at it before or after the competition, and whether you’ll build something defensible on top of it.

The control plane is the product. The model is the commodity. The developer who understands what goes in the control plane — and builds it deeply, with real data and real integrations — is the developer who builds something that lasts.

Next: the industry found a word for everything this chapter describes — and mapped it into eleven components you can audit your own system against. The Harness →