What Is a Control Plane for User Research?

In a world where AI has made building fast and cheap, it still harder than ever before to build the right thing. At Rally, we believe product teams should be talking to their users now more than ever before to know what to build next.

With agents, it's now easy to spin up studies and connect with users. But when it comes to your real users, important details like managing PII, consent, incentives, brand, email outreach, and more can't be trusted with agents or skills.

Without the right controls, a single bad prompt can trigger hundreds of bad emails to the wrong customers before anyone on your team can notice.

How can you keep research safe and compliant while your team adopts agents for user research?

That is what Rally's User Research Control Plane is for: the system that enforces your guidelines and policies that all user research agents operate through.

What is a Control Plane?

A Control Plane is a layer within your system that governs, configures, and oversees AI agents.

The agents themselves take actions: calling tools, reading data, sending messages, running workflows. The control plane sits at the foundation and enforces governance:

• What data is each agent allowed to access?
• Which tools and sources can it reach?
• What needs human approval?
• What policies apply, such as compliance, PII handling, and spend limits?
• What did each agent actually do? This covers logging, audit trails, and observability.

A general-purpose control plane can decide whether an agent is allowed to use a tool, but it doesn't know your cooldown rules, consent language, or incentive budget. A control plane purpose-built for user research does. Those rules might look something like:

• Who can contact which participants, and how often
• What every study must include, like your approved consent form
• How much can be spent on incentives, and by whom
• Who can see PII

Skills are suggestions, not controls

Most teams have started building their own custom skills for Research: written instructions that tell an agent how to do a job, like building a study. Skills are useful, and they make it more likely the agent gets the work right, but they aren't guaranteed controls.

Here's what can slip through in the context of user research:

• A screener ships with 20 questions
• A study goes out without the consent form
• The quarter's incentive budget is gone in a week
• The wrong segment gets invited, or far too many people at once

Skills need constant upkeep. A first version takes an afternoon, but making it reliable takes many rounds of feedback, and the work starts over when the model changes.

Skills guide an agent through the work, telling it how to do the job, which steps to take, and in what order.

When a skill and the rules embedded in a Control Plane disagree, the Control Plane wins. That's what allows anyone on your team write and share skills while your standards still hold.

Rally is the Control Plane for User Research

Our belief is everyone should be talking to real users, and our job is to make that safe and easy so it happens at scale. Rally is the Control Plane for research agents, so whichever agent your team uses, whether it's the Rally Agent, Claude or ChatGPT, or an agent you custom built, it connects your team with real users inside the eligibility, consent and governance rules your research team sets.

Here's what it enforces today:

• Governance rules. Cooldowns, blocklists and opt-outs apply before anyone is contacted.
• Permissions. Every request acts with the permissions of the person making it: their role, their team, their read/write access, and the participants they're allowed to see.
• Templates. Your approved study, screener, consent and incentive templates carry your standards into every study an agent builds.
• Approvals. The agent surfaces actions for your approval, and nothing goes out until you approve it.

What matters is what that makes possible:

• Research Architects set the rules once, so they stop being the bottleneck and get time back for strategic work.
• Product Builders talk to real users when they need to, from the tools they already use.
• Researchers spend their time researching, not coordinating.

The agent runs the operations: the setup, the outreach, the scheduling, the incentives. The conversation stays human, and so does the decision about what to do with what you learned.

Try it on your own setup

Not sure where to start? The prompt below will run a quick audit of your own setup. Paste it into Claude or ChatGPT and fill in the brackets.

You'll get back the rules your research agents should follow, how (or if) they are being enforced today, and three next steps to tackle first. This is a great starting point to share with your research and product teams.

<sub>I work in [role] at [company]. Today, research here works like this: [who runs studies, and which tools, agents or skills they use]. Using this article on control planes for user research as a guide: [article URL]

1. List the rules our research agents should never break, based on how we work.
2. For each rule, tell me whether something enforces it today, or whether we're relying on people and written instructions to remember it.
3. Recommend the first three rules to enforce, and what would change if more of our team could talk to users safely.</sub>

Talk to our team today about giving more of your company safe access to your users.

‍