[kcanini]

Yes, you're right. To guarantee causation, you need to either directly manipulate the variable, or control for every other variable in the universe (impossible). The more extraneous variables you control for, though, the more evidence you have for causation.

[smu3l]

Not true, you do not have to control for everything. You have to control for everything that may have an effect on both the treatment and the outcome. That implies you have to assume that everything you don't control for does not affect both the treatment and outcome, (though something can affect one). This assumption is not testable but sometimes reasonable.

You also have to assume that it's possible for every person/unit of study to have a non-zero probability of receiving either treatment for all levels of the variables you are controlling for in order for the effect you're estimating to be defined. That is more likely to be violated the more things you have to control for.