The Agent (data plane) runs on the customer’s cluster(s) and accesses/processes/stores all of the customer’s sensitive data.

It communicates securely with the Control Plane to sync insensitive metadata.