News · August 17, 2026
Introducing Orcher, the agentic control plane
One layer between the enterprise and every model it uses, responsible for authority, routing, cost, compute, data boundary and evidence.
By Odero Otieno — Founder, CEO & CTO, Dipp AI Technologies, Inc.
Orcher is the first product from Dipp AI Technologies: a control plane that governs agentic execution at the point of execution. This announcement sets out the seven components, the refusal semantics that make them enforceable, and how the record they produce compounds into Dipp Intelligence.
Orcher is now introduced. It is a control plane: a single layer that sits between the enterprise and every model, agent and tool it uses, and that is responsible for the decisions no agent framework makes on the enterprise's behalf — who is answerable, which model should run this, what it may cost, what data it may touch, and what evidence remains afterwards.
The distinction from orchestration is deliberate. Orchestration decides the order of steps. A control plane decides whether a step is permitted at all, and under what terms. Everything in Orcher follows from that: each component has an explicit refusal condition, and refusal is a first-class, recorded outcome rather than an error.
Select a component to reveal its Vol. I excerpt.
Fig. CP-01 · The seven-component control plane
Seven components
- Role Identity Fabric — every directive is bound to a named human role holding a bounded standing grant.
- Dynamic Model Routing — tasks are matched to model tiers by stakes, data class, latency and jurisdiction.
- Cost Governance — spend ceilings are evaluated before dispatch and enforced by downgrade or refusal.
- Elastic Compute — capacity is allocated against real demand rather than provisioned against peak fear.
- Data Control Gateway — the enterprise data boundary is verified architecturally, per payload.
- Immutable Audit Ledger — tamper-evident evidence is written as a precondition of completion.
- Dipp Intelligence — the verified record compounds into a permanently owned operating asset.
Authority before execution
The first gate is identity, and it is the one most stacks skip. An agent presents a directive; the fabric resolves whether a named human role holds standing authority for that class of directive, within the value, data-class, jurisdictional and temporal bounds of the grant. If it does, execution proceeds with that role attached to every downstream record. If it does not, execution stops and escalates to the role that could grant it.
FIG. A02-01
Review after the fact, versus authority before it
Step through the cycle
Lane A — Human-in-the-Loop
01 Agent plans
The agent composes an action from context nobody scoped in advance.
02 Agent acts
Execution happens against the production system of record.
03 Reviewer sees a result
A plausible-looking summary arrives in a queue, on a clock.
04 Approve or miss
Under volume, approval becomes the default. Nothing proves scope.
05 Damage is historical
The record starts after the fact, if it exists at all.
Lane B — Human-in-the-Role
01 Directive issued
A named professional states intent under their own authority.
02 Role bound
Role Identity Fabric binds the directive to that authority, cryptographically.
03 Gates evaluated
Authority, action and data-boundary gates run in sequence, halting by default.
04 Action commits
Only a directive that cleared every gate reaches the system of record.
05 Evidence written
The Immutable Audit Ledger records the cycle — including any halt.
Refusal semantics
| Component | Refuses when | Recorded as |
|---|---|---|
| Role Identity Fabric | No grant covers the directive | Escalation to the granting role |
| Dynamic Model Routing | No compliant model satisfies policy | Unroutable, with the failing constraint |
| Cost Governance | The action breaches the envelope | Downgrade or refusal, with remaining budget |
| Data Control Gateway | The payload would cross an unauthorised boundary | Boundary refusal, with data class and policy version |
Evidence as a precondition
Most systems log after the fact, into stores that are mutable, sampled and retained for as long as a cost policy allows. Orcher treats the ledger write as part of the action: the directive, the authorising role, the routing decision, the boundary decision, the realised cost and the outcome are written as a tamper-evident entry. An action that cannot be evidenced is not considered complete.
components
Independently useful, jointly necessary
gates before dispatch
Identity, routing, cost, boundary
record per action
Immutable and attributable
What compounds
The by-product of governing execution is a structured record of governed execution. Over time it becomes the enterprise's most accurate description of its own work: which directives recur, which roles carry them, which tiers are sufficient, where refusals cluster, what an outcome truly costs. That is Dipp Intelligence, and unlike a model licence it is owned outright and improves with use.
Dipp Intelligence
What compounding actually looks like
Step through the cycles
A claims adjuster's directive is verified against policy language and precedent. The outcome, approved with specific reasoning, becomes a Dipp Intelligence entry.
“A control plane earns its place the first time it refuses something the business would have regretted.”
Sources
Sources for every figure in this article.
Where a number comes from Dipp AI's own analysis or an observed deployment, it is labelled as such and is not presented as an independently audited third-party finding.
- Dipp AI Technologies, The Enterprise Superintelligence Report, Vol. I (August 2026)
Written by Odero Otieno.
Writes the Dipp AI record on enforced governance for agentic systems — authority, enterprise data boundary, cost and compute. Every figure in this piece carries a source, and corrections are published on the record rather than made quietly.