# Every AI agent and every run, in one console.

> The admin console: every agent starts with a budget, an access list, guardrails and a record. See the fleet, trace any run, pause any agent at any time.

- Canonical: https://secondstack.ai/platform/controltower/

---

SecondStack is an AI agent platform. This view covers ControlTower, its admin console for AI agent governance: owners, budgets, the record of every run and the pause button.

ControlTower is the admin console for AI agent governance: administrators see every agent, its budget and its access, and a record of every run. Below, a single run, line by line.

Illustrative example. The entry of the named agent @finance-analyst in ControlTower: owner Finance, budget $4.96 of $50, access Google Sheets and Slack, last run Monday 07:00, completed.

## AI agent governance starts before the first run.

Nothing to bolt on before the first run: a new agent already has a budget, an access list, your privacy rules, an approved-model list and a record, and it can be paused. Each rule, except the pause, writes one line on the run's record, shown next.

- **Budget**: Its sponsor's (the person or team that funds it), or the caller's. A run with no budget does not start.
- **Access**: Only the tools and data it was given.
- **Guardrails**: Personal data and secrets masked by the rules you set.
- **Models**: Through SecondGate, the LLM gateway, from the models its team approved.
- **Records**: Every run on a record administrators can read, not change; conversations stay in your own database.
- **Pause**: Its owner or an admin can pause it, any time.

## Follow one run, line by line.

An ordinary run: the named agent @finance-analyst writing its Monday vendor report. Its record has eight lines. The two ControlTower owns, cost and record, open below; the other six open under Agents and Gateway.

Every run's record has the same eight lines: started by, set-up, access, AI model, privacy, result, cost, record.

### Every run lands on a budget someone owns.

A named agent is charged to its sponsor, the person or team that funds it, or to whoever called it; your personal agent to you. Alerts go out when spend passes a threshold you set.

### Trace any run to its sources and cost.

In Agent Activity, ControlTower's log of runs, administrators follow a run from any channel down to what it asked the AI model, what it read, where the result went and what it cost. Administrators can read the record but not edit it. It holds what ran; the chat itself stays in your own database.

## Every named agent on one list.

The Agents list in ControlTower shows every named agent: owner, budget for the month, last run and anything still missing from the set-up. The pause button is here.

## Questions administrators ask.

### What does ControlTower record?

Agent Activity records each run: what started it, its model and tool calls, where the result went and what it cost, with a trace reference and credentials stripped out. Administrators can read it, not change it. Conversations stay in your own database, and a deleted conversation leaves no copy in the record. Guardrail findings are logged too; your administrators choose whether they keep no text, masked text or the original.

### Who decides which models an agent may use?

Your administrators, in ControlTower. Which models a team, a person or an agent may use is a list they set, from the providers where you already have accounts, including Anthropic, OpenAI, Google and self-hosted models, on your own keys. We do not host or resell models.

## Further reading

- [LLM governance: a working framework](https://secondstack.ai/blog/llm-governance/)
- [Shadow AI: what it is and how to detect it](https://secondstack.ai/blog/shadow-ai-detection/)

## See one run, from request to record.

On the demo call we follow one run the way an administrator sees it in ControlTower: who owns the agent, which budget paid and what the record keeps.

Book a demo: hello@secondstack.ai