Your AI Vendor Is a Control Plane

A model endpoint can feel like electricity. Your tools call it, work comes back, and the connection becomes so ordinary that nobody treats it as a decision anymore. Then a commercial dispute, policy change, acquisition, account review, or new interpretation of the terms turns that connection off. The model still exists. Your right to build on it does not.

That distinction matters more as agents take over repeatable delivery work. A chat subscription going dark is an inconvenience. A factory losing the model behind planning, implementation, review, and release is an operating event. Work stops across several stages at once because the organization mistook rented access for owned machinery.

The lesson is not that vendors are villains. They are companies with their own contracts, incentives, partners, and risk decisions. Their job is to protect that system. Your job is to make sure a decision inside their system cannot quietly become the only decision your factory can obey.

Teams often review terms as paperwork around the product. In an agent-run operation, the terms are part of the runtime. They define which account may call which capability, how credentials may be used, whether access can pass through another product, and what can trigger suspension. Those are execution rules even when they arrive in legal prose.

Put them next to the other boundaries that can stop work. Track which factory stages depend on a particular account, plan, interface, or permission. Know which uses are explicitly supported and which survive only because nobody has challenged them yet. If the route depends on an exception, a personal credential, or a generous reading of vague language, label it as fragile instead of promoting it to architecture.

This is governance with teeth. The inventory should name the operational consequence: which queues stop, which evidence can no longer be produced, and which release paths close. A renewal date belongs on a calendar. A revocable permission belongs in the failure model.

Multi-model support is easy to claim and hard to prove. Changing a model name in a configuration file does not make a factory portable. Prompts carry assumptions. Tool schemas differ. Context limits change. Safety behavior changes. One provider may support the exact interaction pattern another provider forbids or handles poorly.

Real portability starts with a stable factory contract. The stage receives a defined input, gets narrow authority, and must return evidence in a known shape. Provider-specific instructions sit behind that boundary as adapters. The acceptance gate stays outside them. When an adapter changes, the work still has to survive the same tests, policy checks, and release conditions.

Then exercise the second route before you need it. Run representative work through it. Measure where behavior changes. Confirm credentials, limits, and billing are actually ready. A fallback nobody has invoked is not resilience. It is a diagram of resilience.

Do not answer vendor risk by building an abstraction layer so broad that it erases every useful capability. That produces the lowest common denominator and leaves you maintaining a platform instead of shipping software. Isolate the dependency at the stages where substitution matters. Let an adapter use a provider's strengths, but do not let those strengths redefine the factory's evidence or authority model.

Separate identity from execution as well. Company-owned accounts, bounded credentials, documented scopes, and mechanical rotation give you a route that survives a person leaving or a subscription changing. Personal accounts and copied session credentials turn ordinary access changes into production failures and make the real dependency hard to see until it breaks.

The same discipline applies to data. Know what context a provider receives, what must stay inside your boundary, and what can be reconstructed elsewhere. Portability that requires leaking a different class of information is not portability. It is a second failure waiting behind the first.

Our position is that model access will become less dependable as a source of advantage and more important as a governed utility. Capability will keep moving between vendors. Contracts will keep changing around it. Companies will form partnerships, draw lines, and enforce them according to interests you do not control.

You cannot own those decisions. You can own the route your work takes when one of them lands. Encode the stage contract. Keep provider authority narrow. Test another adapter against the same proof. Make the switch a rehearsed operation instead of an emergency rewrite.

Agent factories are supposed to remove human coordination from repeatable work. If one vendor decision sends the whole organization into a week of calls, migrations, and improvised approvals, the coordination was never removed. It was concentrated behind somebody else's switch. Build the factory so the switch can move and the work can keep going.