ClearRoute launches open-source AI control plane runkora

ClearRoute has released runkora in alpha as an open-source agentic AI control plane for software engineering. The consultancy's Australian engineering team unveiled the product in Sydney.

runkora is designed to manage how AI agents operate in software delivery and DevOps environments. The cloud-agnostic platform aims to address governance, compliance and access control issues as companies move from using AI for code generation to broader autonomous tasks in production systems.

The launch reflects wider industry concern about the scale of agent oversight. ClearRoute cited Gartner research predicting that by 2028 the average global Fortune 500 enterprise will have more than 150,000 AI agents in use, while only 13% of organisations believe they have the right governance in place.

ClearRoute chose an open-source model so organisations would not be tied to a single agent framework or cloud provider. The platform is intended to provide a common control layer for AI agents, rather than separate controls for each deployment.

James Jarvis, Chief Executive Officer of ClearRoute, linked the release to persistent delays elsewhere in the software delivery process.

"We've already seen how AI can speed up writing code, but that's only 20% of the software development lifecycle. The bottleneck comes next, because the remaining 80% requires testing, security, compliance, governance and release orchestration before any software can safely go into production," Jarvis said.

He also pointed to approval delays in enterprise change management.

"Our Route to Live research shows that some organisations are still waiting four to eight weeks just for change approvals. AI might help developers produce code faster, but unless businesses address the engineering processes around it, they risk accelerating development without actually improving their time to market," he said.

Jarvis said adding more AI agents would not by itself resolve operational complexity.

"Organisations think they can keep deploying AI agents to tackle the problem. However, if humans are struggling with complex processes, adding AI agents won't necessarily solve the problem and could make it worse. As the number of agents grows, ensuring they only perform authorised actions gets really difficult, really quickly," he said.

Control layer

ClearRoute said runkora governs how work enters a system, how agents execute tasks, what resources they can access, and what audit evidence they leave behind. The platform's design includes identity controls, policy and authorisation, short-lived credential handling, isolated execution environments, model access rules, enterprise connectivity and observability.

It argues these functions are necessary as organisations adopt more autonomous AI processes, including what it described as "dark factories", where agents operate in the background with limited human intervention. In those settings, controls over credentials, permissions and activity records become central to managing operational and security risks.

Justin Wilkin, Global Head of Engineering and AI at ClearRoute, said the practical challenge grows quickly even with a small number of agents.

"If you consider the fine-grained access these AI agents need, with just 10 agents deployed you will be rotating 20-30 secrets every month. Imagine updating passwords, API keys, certificates, tokens, and other access credentials with 150,000 AI agents - it quickly becomes impossible or at least very expensive to manage. runkora solves this by centrally controlling agent identities, credentials, permissions and actions, confining agents to authorised environments while giving humans visibility of any attempted activity outside those boundaries," Wilkin said.

He also drew a distinction between products that route traffic and those that enforce agent behaviour directly.

"A lot of vendors are talking about agentic AI control planes when they really should be referring to them as agentic AI gateways, which assume agents will follow prescribed boundaries and controls. As AI becomes more autonomous, businesses need enforceable boundaries built on zero-trust principles. Rather than simply acting as a gateway, runkora enforces controls on agents themselves, providing a secure, compliant 'golden path' for them to operate alongside human developers," he said.

Wilkin added that the wider platform engineering model is as important as the software itself.

"This is where platform engineering becomes critical, making secure, compliant ways of working the easiest and most consistent path for every agent, rather than expecting individual teams to build and maintain controls themselves," he said.

For ClearRoute, the release is also a statement about where software development is heading. While AI is increasing coding speed, the consultancy said, many enterprises still take 30 to 45 days to move software through testing, approvals and release processes.

"AI is amplifying the strengths of high-performing engineering organisations, but also exposing the weaknesses of those still reliant on manual processes and fragmented infrastructure. Despite the accelerated use of AI in software development, enterprise delivery still typically takes 30 to 45 days. runkora provides the foundational control plane for all non-human work for organisations to create a truly governable, AI-augmented, automated delivery ecosystem at scale and turn faster development into faster delivery of business value," Jarvis said.