What the data plane does not do

It never authenticates, never assigns addresses, never decides policy, and never writes to a database. It only forwards, polices, filters, and counts, based on the session state the controller installed. Every decision it makes was pre-loaded by the control plane. That is the whole point of the split.

The Control Plane: The Subscriber Lifecycle

The controller is where subscribers are born, change state, and are torn down. At its heart is the Session Manager, an explicit state machine that models the life of every subscriber.