In February 2026, Vadim Fîntînari asked his AI assistant to help with his blog. The agent needed to push code. It found his SSH key, authenticated to GitHub, committed changes, and created a public repository. He had not instructed it to use the key. After the incident, he added rules restricting what the agent could do with credentials and infrastructure, then observed that the pattern of adding rules after incidents is reactive, exhausting, and does not scale. Technical permission to perform an action is not the same as authority to perform every consequential action that permission makes possible. That is the problem in its precise form: prompts and instructions operate on anticipated paths. Agent authority is a different question, answered at the moment of execution. Updated 22 August 2026: Google's Agent Gateway, generally available since June 2026, now runs a documented Semantic Governance Policy check that evaluates a proposed agent action against user intent at the moment the model proposes it, independent of whatever IAM permission the agent already holds. Updated 23 August 2026: Microsoft has published its own account of operating Azure SRE Agent since its March 2026 general availability, describing internal failures from the year that followed, including an agent that reconstructed a credential flow on its own after a token expired mid task. Microsoft's response moves reasoning into a trusted runtime while model authored code and tools run inside a separate microVM that cannot touch its own provisioning, policy or credential flow, and states plainly that its more granular guard for judging a specific action against its target and the evidence behind it is still being built. Moona Intelligence has separately verified Cloudflare's WriteGuard, published 5 August 2026 and added to this record only now: Cloudflare states it could not rely on client side skills or elicitation prompts as the authoritative boundary for its own write enabled MCP fleet, because their behavior varies by harness and users can disable them, and it moved that decision into a shared server side policy, attribution and auditing layer that can block a critical write before its handler runs. Cloudflare's internal MCP portal grew from 13 servers in April 2026 to 27 by the time of the August article. The customer facing version remains a private beta, not a generally available product. Updated 23 August 2026: USC Viterbi has newly surfaced AEGIS, a pre-execution firewall and audit layer for AI agents built by Aojie Yuan of USC's FORTIS Lab and first posted to arXiv on 13 March 2026, within a broader university account of its agent-audit research program published 19 August 2026. AEGIS treats the agent's own model as an untrusted proposer: an SDK instruments supported frameworks, intercepts a proposed tool call before it reaches the tool, and submits the tool name and arguments to an independent, server-side Gateway that returns allow, block or pending and holds high-risk calls for a human decision, recording the outcome in a signed, hash-chained audit trail. Moona Intelligence independently confirmed the public MIT-licensed repository exists and inspected its current implementation directly rather than relying on the paper alone. The paper states plainly that AEGIS does not protect a tool or API call made outside its instrumented SDK, and remains an arXiv preprint with no independent evidence of peer review found by this record; the reported 48-of-48 blocked attacks, 500 benign calls with 6 false positives and single-digit-millisecond interception latency are author-run, curated results, not an independent or production measurement. Updated 24 August 2026: Britive announced ARC, Agentic Runtime Control, stating an agent acting for a person can receive authority at or below that person's own authority, narrowed further for the agent, the task, the resource or the content in question, with individual MCP tool calls evaluated against policy before they reach a downstream server and active authority able to change while a task is running as Shared Signals Framework events arrive. Moona Intelligence could not fetch Britive's own site or its 24 August 2026 release directly, this session's network egress proxy blocking both, and independently phrased searches did not surface the specific release the way they did for other blocked sources in this record; what is verified instead, against Britive's own independently locatable pages and an earlier, separately dated Shared Signals Framework release, is that ARC bundles capability Britive had already been building, that the connection path qualifier on its SSH and SQL enforcement claim is real and narrower than a universal guarantee, and that task and stated intent read as contextual inputs to a policy decision rather than a documented, durably bound mandate. Updated 25 August 2026: a research preprint posted to arXiv on 3 August 2026 names a failure this record's AEGIS section had already flagged as unresolved, a retried call riding an authorization issued for a different call, and proposes durable state over the authorization itself rather than over the token that represents it as the structural answer. Updated 25 August 2026: an Internet Draft called Authorization Receipts for High Risk Agent Actions, revision 12, dated 16 August 2026, from EMILIA Protocol, Inc., defines an evidence artifact binding a named approver's key to one exact, hashed action before it runs, and requires a conforming client to render the human facing presentation from that same covered object rather than a separately supplied description. The draft states in its own words that a receipt is evidence, not authorization, that a local human interaction is not itself an authorization decision, and that offline verification does not establish current revocation status, global non replay, human comprehension, legality, safety or execution. This record reads that as evidence about a layer just before the decision this piece has tracked since February, not a substitute for it. Updated 26 August 2026: this is a missed earlier signal, not a new development. PraisonAI's own npm package documented createAgentLoop()'s onToolCall callback as an approval mechanism, and in versions 1.4.0 through 1.7.1 it was not one. GHSA-h2w2-v7j6-xqm4, published by PraisonAI on 17 June 2026 and assigned CVE-2026-57137, found that AgentLoop.step() called AI SDK's generateText() with tools whose execute handlers ran unmodified, so the tool's side effect had already occurred and its result was already built before onToolCall was ever called; a denial afterward only set finishReason to tool_rejected, a status recorded whether or not the tool had already run. Moona Intelligence read the vulnerable and the patched commit directly from PraisonAI's own GitHub history rather than the advisory's account alone. The fix, committed the same day, does not adopt AI SDK's own pre execution needsApproval mechanism, which the same codebase documents elsewhere as a separate, opt in utility; it wraps each tool's own execute function inside AgentLoop's constructor so the approval check runs first, ahead of the tool's real logic, whenever that function is called. Version 1.7.2 is patched. The advisory's own proof of concept is deterministic and local, a mock AI SDK and an in memory side effect counter, not a demonstrated attack against a production deployment, and this record preserves that distinction precisely. Updated 26 August 2026: a verification pass on the Microsoft Azure SRE Agent material already added to this record on 23 August 2026 found that Command Line's own account of who calls a shared agent names four roles, readers, users, operators and administrators, distinct from the three role Reader, Standard User and Administrator taxonomy Azure SRE Agent's own product documentation uses, and this record now keeps the two apart. Search convergence also surfaced a concrete destination-lock example for the credential handle, a worked restart-versus-deallocate example for the still building operation, target and evidence guard, and Microsoft's own sentence that authority is issued per task and expires with it, along with the task types that statement covers, an incident investigation, a failed deployment response, a timed scheduled check, or an interactive Review mode session. Updated 26 August 2026: a cluster of five already patched vulnerabilities across Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit for Python and two Vercel AI SDK harness packages, discovered independently and reported to each vendor before disclosure, is added here as newly surfaced evidence rather than as developments occurring on this date. AWS's managed InvokeHarness API let a caller-supplied tool-use block in a request's final message dispatch a configured tool directly, bypassing the model; AWS's own server side fix, applied automatically before its 4 August 2026 bulletin, rejects that block before it reaches the event loop. Google's ADK let a forged session event stand in for a tool confirmation actually bound to its original call; ADK 2.5.0, released 16 July 2026 and verified here against its own fix commit, now checks the target tool's registration, its actual confirmation requirement, and its name and arguments against the recorded original invocation, and separately, in a different commit the same release, rejects a user-authored message containing a function call outright. Vercel's harness-codex and harness-opencode packages let a sandboxed process's own command line, checked for a helper script's path, stand in for a bridge-observed model event; both were patched in one 10 July 2026 pull request that replaced the process-path check with exact, short-lived, one-time authorization bound to a specific tool name and input. Independent researchers named the cross-platform pattern CoreBreak and presented it at Black Hat USA 2026, reported by The Hacker News on 6 August 2026. New sections verify each fix against its own primary commit or advisory, keep the three vendors' distinct mechanisms from being treated as one, and keep AWS's patched managed service separate from what Strands' own open source runtime documents today as a caller's responsibility for message history it does not control. Updated 26 August 2026: OpenClaw, the agent runtime, merged five separate authority fixes on 25 and 26 August 2026. A public caller could forge owner status and reach owner-only tools until PR #104872 stripped owner claims from public ingress and bound authenticated ownership to a live, revalidated plugin capability rather than a caller-supplied flag. An agent could send input into a terminal an operator had opened without the session's own execution mode being checked until PR #129604 put every terminal write behind one fence that revalidates the live run, an admission receipt, the Gateway instance and the terminal's owner immediately before the keystrokes reach the process. A reusable approval for a shell command could be replayed from a different working directory than the one a person actually reviewed until PR #129636 bound the approval to the exact directory and argument vector together. A recurring cron job's approved command used to mint a permanent, job-independent allowlist entry that outlived the job itself until PR #129526 replaced it with a standing grant scoped to that exact job, its configuration revision and its operation, revalidated against current state immediately before each occurrence runs. And an MCP App view could keep listing and reading a server's resources after its own interaction grant had been revoked, including on a request already in flight when revocation happened, until PR #129550 made every resource operation recheck that grant twice, once before contacting the server and once before releasing the result. Five different mechanisms, one organization, and a single recurring lesson: none of the five failures were about whether an approval had ever been granted. Each was about whether the system kept checking that the approval still matched what was actually happening. Updated 26 August 2026: Reco's State of Agent Security 2026 report keeps three datasets separate in its own methodology, anonymized telemetry from 62 large enterprises across financial services, healthcare, retail and consumer, and telecommunications observed between 1 January and 1 August 2026, a static capability analysis of 500 publicly available MCP servers drawn from the npm registry, and a review of National Vulnerability Database disclosures, and this record keeps them separate too. Reco found four in five AI tools in its own platform telemetry operating without IT oversight, defined precisely as observed in use without IT or security approval, a governance fact distinct from execution time approval for any specific action. Separately, among the 500 MCP servers, 62 percent combine local file-read access with outbound networking, half can execute shell commands, more than eight in ten can read or write local files and roughly three-quarters can make outbound network calls, capability findings this record does not promote into demonstrated execution. Reco's own central claim is that an agent's effective authority is often a composition of user permissions, OAuth grants, service accounts, API access and workflow access, each individually legitimate and separately administered, that together can expose data or trigger actions beyond what any one application owner approved, and that orphaned agents, whose owners left the organization, whose credentials were never revoked and whose access is still live, show that authority can persist after the purpose or ownership behind it changes. Moona Intelligence could not fetch Reco's, GlobeNewswire's or Infosecurity Magazine's own pages directly this session and represents these findings at the corroborated, manual-review evidence level this record already applies to other blocked sources. Updated 26 August 2026: Token, a biometric identity assurance company, first extended its TokenCore biometric hardware to agentic workflows on 17 June 2026 and is now commercializing that capability as Token for AI Agent Gateways, restated in a 26 August 2026 announcement that also named a new board appointment. The mechanism intercepts an agent's proposed tool call before it executes and classifies it as allow, gate or deny; a gated, high-consequence call, Token's own examples name moving money, changing access and reaching production, stops until the specifically authorized human completes a live fingerprint verification on a TokenCore device, which Token describes as bound to the transaction. Token's own framing is precise about the gap it targets: an agent may already be authenticated and holding a live session, and credential possession alone is not sufficient for the actions it names. Moona Intelligence read that as identity of the approving human, verified through hardware-bound biometric matching, rather than as proof that the approving human was actually entitled to authorize the underlying action, the same distinction this record has already drawn for Nuggets' Authority Control Plane and for Britive's ARC, and reads it apart again here. This record also keeps Token's general biometric authentication hardware, FIDO2 and WebAuthn, an EAL5+ secure element, on-device fingerprint matching and physical proximity, separate from the AI Agent Gateway product's own maturity, which this record found undocumented on general availability status, named customers, participating hardware and specific agent-gateway integrations. tokencore.com and every syndicated copy of the 26 August 2026 announcement were blocked to direct fetch this session; what follows is corroborated through multiple independently phrased web searches converging on consistent wording, at the manual-review evidence level this record applies to other blocked sources. Updated 28 August 2026: DeepSeek AI's open-source DeepSeek Harness, in developer preview since 13 August 2026, bundles a sandbox-mode knob and an approval-policy knob into named presets its own documentation says own no enforcement themselves, workspace-write paired with ask and danger-full-access paired with never by default. Moona Intelligence read the current source directly rather than the package documentation alone and found that a sandbox-denied command's same-turn retry, with a strictly wider mode plus a justification, is resolved through an approval seam whose strict-widening check and fail-closed absence handling are enforced in code, while the instruction that a retry follow a real prior denial and never be speculative exists only as text the model reads, with nothing in the runtime tracking whether a denial actually preceded the request. The approval request itself carries the agent, the tool name, the call id and a written reason, not the command's own argument bytes, so the binding between a grant and the exact command that runs rests on the call id, not on any hash of the command inside the approval payload. The grant is one-shot and outranks a session-level sandbox override that is itself pinned at session creation, yet an escalated command sent to run in the background keeps running under the wider mode for as long as the job takes, after the one-shot approval that authorized it has already resolved. DeepSeek's own SAFETY.md says plainly that the project has had no security audit and that even correctly enforced restrictions cannot protect a resource the host process already reaches; its sandbox documentation says confinement covers file effects only, not network access or process visibility. Updated 28 August 2026: Microsoft's Command Line published Agent Hooks, versioned AGENT-HOOKS-0.1 and still marked Draft, a framework-neutral specification of what a cooperative agent host must do once an interceptor at one of eight fixed lifecycle points returns allow, deny or transform, rather than another policy engine competing with the ones already in this record. Moona Intelligence read the specification, its conformance test kit and its governance file directly from the public responsibleai/agent-hooks repository, since commandline.microsoft.com is already blocked to direct fetch elsewhere here. The spec text confirms that an unresolved escalation is represented as a denial carrying an empty approval block rather than a separate pending state, so it stays denied until lifted; that its default context_identity provider hashes a closed, canonically ordered projection of exactly the fields shown to an approver, deliberately excluding the approver's own identity and session, so a resolution's echoed identity must match that projection or the host must reject it; and that the eight interception points explicitly do not guarantee complete mediation, a limitation the project's own threat model says has no mechanism for detecting a host that silently skips a hook or ignores a verdict. Fifty-one numbered conformance vectors exist; Microsoft Agent Framework's own agent-framework-core, which ships an experimental, opt-in AGENT-HOOKS-0.1 middleware, filed a claim of 47 of 51, the remaining four capability-gated and skipped, reported as 100 percent of applicable vectors, and a second claim the project's own conformance file names agent-control-spec, almost certainly Microsoft's own Agent Control Specification, reports 46 of 47 applicable. The changelog's own entry for the spec's first alpha, dated 8 July 2026, describes it as an initial extraction from the Agent Control Specification, and the project's governance file names a single maintainer under the responsibleai GitHub organization, with a second code owner and third-party conformance claims both listed as not yet in place. The specific worked refund-threshold demonstration and the eight-framework demo suite Microsoft's own article is reported to describe rest on that one blocked source alone, and this record does not assert their exact figures as independently confirmed. Updated 28 August 2026: JFrog announced expanded Package Traffic Controller integrations with Zscaler, Cloudflare and Netskope on 27 August 2026, moving the decision of whether a requested package may enter an organization off the coding agent and the package manager and onto the network path itself. Traffic Controller configures an organization's existing SASE platform, Zscaler Internet Access, Cloudflare Gateway or Netskope One SSE, to detect a direct request to a public package registry and redirect it to Artifactory's package-reroute endpoint, where JFrog Curation evaluates the package against configured security, license and quality policy before it enters the environment; a compliant package is delivered unchanged, a non-compliant one is blocked, and, where JFrog's separately configured Compliant Version Selection feature is enabled, a policy-compliant version is substituted and returned without the developer being told a different package shipped. JFrog's own stated reason is that agents, like developers, do not reliably honor proxy configuration, approved package lists or package-manager settings, so the redirect requires no agent-side configuration and reaches whatever traffic actually crosses the configured security edge, regardless of what the requester is. What that architecture does not establish is who the requester was: JFrog's own documentation states that a redirected request reaches Artifactory as a system account, package-reroute, that does not forward the caller's own credentials, so the audit record Curation produces names that system user rather than the individual developer, agent or automated process that issued the request. jfrog.com and docs.jfrog.com are blocked to direct fetch in this session's tooling environment; what follows is corroborated through multiple independently phrased web searches converging consistently on the same wording across JFrog's own product page, its technical documentation and its limitations page, at the manual-review evidence level this record already applies to other blocked primary sources. New sections near the end verify the interception mechanism, the three package outcomes, the ecosystem and identity limits JFrog itself documents, and read Traffic Controller against this record's own Authority Provenance ledger. Updated 29 August 2026: the UK's National Cyber Security Centre published interim practical advice on managing the cyber risk of agentic AI on 20 August 2026, explicit that the field is still evolving and that it is developing formal guidance that will expand on, and eventually supersede, this blog. NCSC treats network access, credentials, compute, data, human oversight and incident shutdown as separate surfaces an operator must each address, and states plainly that safeguards built into a model or its harness can be bypassed or prove insufficient in higher-risk environments and should not be relied on as the sole control where the consequences of failure exceed an organization's tolerance. Its network recommendation denies connectivity by default where possible, permits only required connections through allowlists, and, where an allowlist cannot cover every legitimate case, describes considering a protocol- or service-aware proxy that permits connections by exception and requires manual approval before a communication outside the agreed scope proceeds. On credentials, NCSC states that what an agent can reach, API keys, OAuth grants, SSH keys and authenticated sessions among them, forms part of its blast radius, that every agent should carry its own unique identity distinct from the human or system account it runs under, that permissions should be limited to what a task requires with the shortest viable credential lifetime, and that a proxy can inject a credential into a request without ever exposing it to the agent, so the agent cannot carry that credential to an unexpected endpoint it discovers on its own. It distinguishes human-in-the-loop, human-on-the-loop and human-out-of-the-loop autonomy, recommending human oversight alongside technically enforced controls, not instead of them, for higher-risk deployments, and states organizations should always be able to halt autonomous agent activity immediately if an incident is detected or reported, a capability it says may require more than stopping the agent process alone and may extend to restricting network access and interrupting communications with model-inference infrastructure. New sections near the end read NCSC's own recommendations against this record's Authority Provenance ledger and separate NCSC's own stated facts from this record's interpretation of what they do and do not establish. Updated 29 August 2026: this record re-opened the AID-Guard lead named in its own 25 August entry above, a brief describing AID-Guard, Stateful Authorization for Delegated Agent Effects, attributed to Yingzhe Tong, Leyu Dai and Songhui Guo at arXiv 2608.21159 and submitted 21 August 2026, and again could not locate a paper under that title, that identifier or that author combination. Direct fetch of arxiv.org, export.arxiv.org's Atom API, the Semantic Scholar API, Hugging Face's paper index and alphaXiv all remain blocked at this session's network egress proxy, so this record depended again on web search, and repeated, independently phrased queries against the exact title, the exact author names and the bare identifier returned no matching paper; several of those searches instead returned a summary asserting the paper existed, complete with an invented page, figure and table count, while the underlying result list carried no such paper at all, a pattern this record reads as the search tool completing a distinctive quoted phrase back to the person asking it rather than reporting a genuine find. This record does not publish the checkpoint semantics, the commit time revalidation, the ambiguous delivery handling, the successor authority rule, or the Stripe and Resend evaluation counts a commissioning brief attributed to AID-Guard, because none of it traces to a locatable primary text. What this record already carries on this class of gap, durable authorization state surviving retry, replanning and crash recovery, remains CapLease, arXiv 2608.01710, verified above on its own terms and unchanged by this entry. Updated 29 August 2026: PAuth, a research paper revised on arXiv (2603.17170v2) on 25 August 2026 and separately hosted by Microsoft Research, argues the same execution-time distinction this record has tracked since February from underneath OAuth itself, that a scope such as transfer authorizes an operator rather than the specific operation, transfer $100 to Bob, a user's task actually implies, and proposes a signed natural-language task as the authorization object each participating server independently checks a live call against. It is a documented research design with an author-run prototype and an author-run benchmark, not an adopted standard or a Microsoft product. Updated 31 August 2026: independent verification of Agent Hooks finds a named byline on Microsoft's own article, Mohammad Abuomar, Caitie McCaffrey and Sarah Bird of Microsoft's Responsible AI and CoreAI teams, confirms its worked refund demonstration and its opening customer-support scenario are both illustrative material rather than a disclosed production incident, and finds a .NET interception contract already merged into Microsoft Agent Framework eight days before that article was published while the project's own conformance file still files no matching .NET claim. A pull request merged the same day this record was re-verified removed the experimental agent-hooks extra from Microsoft Agent Framework's own core package in favor of a standalone package, and two further pull requests this record read directly show the conformance discipline behind the contract catching one real fail-open defect and leaving one context-projection gap still open. Operant AI announced Semantic Firewall, an inline layer that returns allow, block or redact for a proposed prompt, tool call, command or data movement before it executes, classifying intent with Operant's own models rather than the agent's underlying frontier provider. Its Scope Guard component holds an agent to the purpose an administrator assigned it in natural language and re-evaluates that purpose against every turn of a session rather than only its first one, treating drift caused by manipulation and drift the agent produces on its own initiative as the same failure. operant.ai is blocked to direct fetch in this session, and this record represents the mechanism at the manual-review evidence level it applies to its other blocked primary sources. Updated 31 August 2026: this record also made a renewed attempt to fetch Britive's own ARC launch release and named product documentation pages directly rather than leaving the 24 August 2026 network limitation unrevisited. Every attempt was blocked by the identical condition documented then, and while independently phrased search this time located the release's own exact title and a syndicated copy's URL, neither could be read directly, so every evidence grade in this record's Britive material remains exactly where 24 August 2026 evidence put it. Delinea's own issuer dated release states it delivered Runtime Authorization for AI Agents on 29 July 2026, available now as part of the Delinea Platform, evaluating each tool call, database query, SSH command, Kubernetes action and cloud console operation an agent attempts inside an already authorized session and individually allowing it, blocking it or escalating it to a human before it executes, a capability built on the Cedar based policy engine Delinea gained through its acquisition of StrongDM, agreed 15 January 2026 and closed 5 March 2026. Delinea's own material states a credential is injected just in time at the connection layer, scoped to the task rather than inherited from the person who deployed the agent, and revoked automatically when the task completes, with the agent process itself never holding the credential. StrongDM's own product material states its fine grained, real time SQL action blocking and column redaction cover Postgres and Microsoft SQL Server today, a narrower claim than the general database coverage Delinea's own release names, while SSH and Kubernetes sessions are documented at command level recording, replay and real time, context sensitive session termination, a shape this record does not read as equivalent to the same statement level parsing documented for those two database engines. Delinea's own MCP Gateway material states it authorizes each MCP tool call before it executes and that the agent never holds a credential, only the action gets authorized, naming Delinea and StrongDM as the enforcement layer rather than a property MCP itself supplies, and Delinea separately states agents reaching databases, SSH hosts, Kubernetes clusters and cloud consoles directly, not only through an MCP server, are authorized and recorded through the same single control point, a product coverage claim this record keeps distinct from proof that every external path in a customer's own environment is actually routed through it. A named customer, Telnyx, is quoted by Dhruv Kumar, its Infrastructure Product Manager, stating that every action is now tied to a named identity and recorded at the action level; this record found no independent corroboration of that account beyond Delinea's own release and its syndicated copies, and represents it as vendor published customer testimony rather than independently audited deployment evidence. New GISEC Global 2026 coverage that surfaced on 31 August 2026, the current date of this record, restates this same 29 July capability under the conference theme From Access to Action: Governing AI at Runtime, and this record does not describe that date as the launch. delinea.com is blocked to direct fetch in this session; what precedes is corroborated through multiple independently phrased web searches converging consistently on the same wording across Delinea's own syndicated release, StrongDM's own product material and independent trade coverage, at the manual-review evidence level this record applies to its other blocked primary sources. Updated 1 September 2026: OpenAI's Codex CLI 0.151.0, released 29 August 2026, merged two fixes this record reads as answering a version of its own question from underneath execution itself, whether an authorization result computed under one state can keep authorizing an action after the system has moved to a different one. Pull request 41192 preserves a restored session's own permission profile across routed turns and a change of working directory rather than re deriving it through a coarser, three mode sandbox representation that could discard or, in OpenAI's own words for the working directory case specifically, weaken what the original profile actually covered; the release's own changelog states this precisely as preventing slash cd from weakening sandbox restrictions, a narrower claim than the pull request's own broader description of discarding permission detail in an unstated direction, and this record preserves that distinction rather than collapsing it. Pull request 41196, bundled with two unrelated fixes this record does not evidence here, binds a Guardian v2 automatic reviewer's cached, asynchronously scored classification to the exact local and, for a subagent thread, root authorization state it was scored against, so a low risk score computed before a genuine user answer or a history reset arrives can no longer approve an action once one has. OpenAI's own pull request states the rule directly: bind cached Guardian classifications to current local and root authorization state so stale scores cannot approve actions. Moona Intelligence read both pull requests' own merged source and their added regression tests directly from OpenAI's public codex-rs repository. Neither fix carries a CVE, a security advisory or a stated severity, and this record represents both at that evidence level rather than as a disclosed vulnerability; new sections near the end verify each mechanism against the source directly and read Codex CLI 0.151.0 against this record's own Authority Provenance ledger. this record adds Ping Identity's Identity for AI, a first party non human identity and runtime authorization architecture built from Agent IAM Core and its own Agent Gateway, verified against Ping's 24 March 2026 architecture announcement, its 31 March 2026 general availability release notes, its Agent IAM Core and Agent Gateway product pages, its 22 April and 16 June 2026 material on integrating PingOne Authorize with Google Cloud's own Agent Gateway and later AWS and Cloudflare paths, and its 28 July 2026 material extending the same capability to Ping's self managed Advanced Identity Software. Ping's own language states Agent IAM Core moves the security boundary from login to authorization at the moment of action, evaluating each action against context, policy and risk, scoped to what its configured authorization plane actually mediates rather than every technical action an agent can take. Ping's own Agent Gateway sits in front of MCP servers and validates, scopes and audits each tool call through McpValidationFilter, McpProtectionFilter and McpAuditFilter before a request reaches the backend, qualified to traffic actually routed through the configured gateway. OAuth 2.0 token exchange lets an agent exchange a human subject token for a downscoped token, carrying act and may_act claims that name the human subject and the agent actor separately, a real identity distinction this record keeps apart from proof that the named human held organizational entitlement to authorize the underlying action, which remains unestablished. Human in the loop approval through CIBA is documented as available; approver eligibility, requester and approver separation, action binding, timeout and replay handling for it are not. Direct fetch of every pingidentity.com and developer.pingidentity.com page was blocked at this session's network egress proxy; what follows is corroborated through convergent, independently phrased web searches, at the manual-review evidence level this record applies to its other blocked primary sources. Updated 1 September 2026: Broadcom announced AgentMinder on 31 August 2026 at VMware Explore 2026, stating it is generally available and positioning it inside VMware Private AI Cloud's agentic AI security architecture alongside VMware vDefend and VMware Avi Load Balancer. Broadcom's own material describes AgentMinder as treating an autonomous agent as an enterprise grade identity whose authority is bound to a declared mission, permitted intents, approved tools and authorized resources, independently verifies that identity, and then evaluates every tool invocation through a cloud native gateway against identity, tool, intent, resource and current risk context before the call reaches an enterprise backend, integrated with an organization's existing authorization stack through the AuthZEN standard rather than a separate policy stack of its own, and audited through OpenTelemetry. investors.broadcom.com and every syndicated copy of its 31 August 2026 releases were blocked to direct fetch this session, so this record verifies what follows at the manual-review evidence level it applies to its other blocked primary sources, and narrows what Broadcom's own account does not establish: the representation format of a declared mission, whether the gateway achieves complete mediation across every supported tool call, AgentMinder's specific role inside an AuthZEN exchange, and whether its own internally reported daily API call volumes represent distinct mission or intent authorization decisions rather than broader identity platform traffic. A new section near the end reads AgentMinder against this record's own Authority Provenance ledger and against Google's Agent Gateway, Drata's Mission Control, Rubrik's Agent Identity and Delinea's Runtime Authorization, already verified above. Updated 1 September 2026: Enterprise Management Associates surveyed 202 enterprise IT and security leaders, roles EMA's own material names as CIOs, CTOs, CISOs and IT directors, at organizations with 1,000 or more employees deploying or evaluating agentic AI, for research EMA conducted and Cequence Security sponsored and co published on 31 August 2026 as Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise. EMA reports that 94 percent of respondents are confident their agents do not hold more access than necessary while only 33 percent actually provision agents with least privilege access, that only 34.2 percent evaluate an agent's authorization at the moment it actually attempts a specific action, that 65 percent have experienced an agent act outside its intended scope, splitting into 29 percent reporting measurable organizational impact and 36 percent catching the action before one occurred, that 32 percent can detect and contain such an action within minutes through automated means against 55 percent who need hours and manual steps, and that 31 percent of agentic AI pilots have been paused indefinitely, discontinued or abandoned. This is self reported enterprise survey evidence commissioned in part by a vendor whose own runtime authorization product competes in the market the findings argue for, not infrastructure telemetry or an audited account of what any specific agent did, and this record represents it at exactly that evidentiary level. www.cequence.ai, www.globenewswire.com and www.enterprisemanagement.com were each blocked to direct fetch at this session's network egress proxy on every attempt, including the report's own download link; what precedes is corroborated through more than a dozen independently phrased web searches converging consistently on the same figures and wording, at the manual-review evidence level this record applies to its other blocked primary sources. Updated 2 September 2026: Mambu launched Intelligent Core, uniting Mambu Core, Mambu Payments and a new Mambu Agentic layer that connects AI agents directly into the ledger through a Model Context Protocol solution, pre-built action agents and a curated AI Insights data layer. Mambu's own material for both the launch and its June 2026 MCP article carries a Limited Release notice, not yet through Mambu's standard release process and provided as-is for evaluation, and this record narrows its claims to that maturity rather than to the more confident current-tense language Mambu's own marketing uses elsewhere. mambu.com was blocked to direct fetch in this session; every Mambu claim here is corroborated through convergent, independently phrased search rather than a direct read, and this record could not corroborate a claim that Mambu Agentic ships a distinct capability named Process Orchestrator, since the only Process Orchestrator this record could verify is the legacy Mambu Process Orchestrator that Mambu's own documentation states will be fully decommissioned. Updated 3 September 2026: OpenClaw's PR 132407, fixing issue 131947 and merged 31 August 2026, closes the gap between a permission mode saved to a session and that mode actually governing a run already executing under the old one; it shipped in the v2026.9.1 release published 3 September 2026, and old tools, an old prompt and pending approval claims are each replaced or revoked before a successor continues rather than left running under stale authority. Updated 4 September 2026: a preprint posted to arXiv the day before as 2609.03884, A Blind Trust, the Bloody Thrust, names its own subject as attacker-controlled lifecycle-hook updates steering AI agent harnesses toward malicious behavior, verified by this record only as far as its existence, exact title and seven-author byline, since arxiv.org and every mirror this session attempted were blocked; independent of the preprint's own unverifiable specifics, Claude Code's own current documentation, read directly, confirms that a plugin can bundle lifecycle hooks binding an event to a host command in its own hooks/hooks.json, that a bound command fires as a subprocess with no fresh model decision required, and that a marketplace update is applied by version signal with no described mechanism to diff, flag or gate a change to that hooks.json specifically. Updated 4 September 2026: LangChain merged a `langchain.mcp` namespace and an `MCPAdapter` class on 3 September 2026, preserving an MCP tool's own annotations, including a snake-cased `destructive_hint`, its `_meta` field and the serving server's connection-scoped identity under a structured `mcp` namespace on the resulting LangChain tool; a companion example reads that hint to build a `HumanInTheLoopMiddleware` approval map dynamically, from whatever destructive tools a server happens to expose, rather than from a hardcoded list, so an approve or reject decision genuinely blocks execution rather than only logging it. This record's own reading of the source states the boundary precisely: MCP's own specification requires clients to treat a tool annotation as untrusted unless it comes from a trusted server, so a hint LangChain now surfaces is an input a client can build a policy on, not a grant the server itself is making. Updated 4 September 2026: SpaceXAI, the company operating under that name since folding in xAI, made Grok Bot, its persistent computer-use agent introduced in early beta on 11 August 2026, available to enterprises on 3 September 2026, adding an organization-wide enable switch, Network Controls, Action Recording and audit tooling around a Bot documented as having no identity or credentials of its own, acting only as the signed-in member it represents, and independently bounded by team and personal policy, an Auto Review model that each member can still switch off, per-action approval that binds to a matching rule rather than a permanent grant, and enterprise network policy that defaults to allow-all and does not reach an already-running computer until it is recreated. Updated 4 September 2026: OpenClaw's PR 136019, merged 2 September 2026 and shipped in the same v2026.9.1 release, makes a Codex Allow Always decision for an MCP tool on an OpenClaw-configured server durable across sessions, stored as an exact agent, server and tool tuple that deliberately leaves future arguments unbound, minted only when a live mcpToolCall on that server can be unambiguously correlated to the approval and failing closed otherwise, applied at the next thread preparation rather than inside the session that granted it, and subordinate to an explicit prompt policy that keeps asking regardless. This record keeps that tool-scoped grant distinct from PR 129526's own job-scoped cron automation standing grant already in this canonical, and distinct from PR 132370's own process-local, non-persisted Codex placement-reuse grant bundled under the same release note heading. Updated 5 September 2026: Solo.io open-sourced agentdesktop on 3 September 2026, an Apache 2.0 workstation control layer, v0.1.0, that translates a central filesystem and network policy into Claude Code's and Codex's own native sandbox configuration and, in controller-managed mode, issues a short-lived gateway JWT only after a device certificate minted from a locally generated, never-exported private key and a valid user SSO token both check out. Its own documentation states the token's client_id is an asserted client label useful for routing, policy and attribution, not cryptographic proof of the calling executable, a limitation this record reads as sharpening rather than contradicting its own recurring argument: a strongly verified user and device is not the same fact as a strongly verified executing agent process. Updated 7 September 2026: GitHub issue 32091 against vm0-ai/vm0, the public repository for Okou, describes Pi Memory's own Stage 1 admission check excluding a same-user, same-organization agent-authenticated chat send from persistent-memory learning on the same footing as an unrelated automation or webhook. Okou's own merged fix, verified here directly against its current public source rather than the issue's own account, disambiguates the shared "agent" trigger-source value through an independently required, server-verified owned Chat Thread, not by relaxing the label itself, so its own first-party maintenance dispatch, which carries that identical trigger-source value, stays excluded through that same missing-Chat-Thread requirement. Updated 7 September 2026: GitHub issue 11115 against NVIDIA's NemoClaw, a 22,400-star open source reference stack for running agents including OpenClaw, Hermes and LangChain Deep Agents inside NVIDIA OpenShell sandboxes, opened 5 September 2026 by ericksoa, names a gap distinct from every MCP tool-authority record already in this canonical: OpenShell's own proxy genuinely and correctly enforces a per-tool deny_rules entry an operator hand-edits into a generated policy, but NemoClaw's own registered intent for that MCP server carries no field to represent a denied tool, so NemoClaw reads the operator's own working restriction as configuration drift, `HERMES_MCP_CONFIG_DRIFT`, refuses `mcp restart`, and, in the issue's own verbatim words, "the in-sandbox supervisor quarantines the next gateway respawn." This record reads that as a different failure shape from the CLI Agent Orchestrator gap already verified above: there, no path on any provider ever computed a denial covering an MCP tool at all; here, the tool-level denial exists and works, at the one place it is actually enforced, and the gap is one layer further along, whether NemoClaw's own persisted, canonical description of authority can represent and durably carry a narrowing the operator has already made. An unmerged draft pull request, #11135, opened 6 September 2026 by the same reporter and carrying 16 commits at this record's own verification, proposes exactly the missing field: a `--deny-tool` flag persisted in the registry entry and rendered deterministically into the generated policy, an `mcp update` path limited to replacing or clearing that list, and, in its own changes description, journaling replacement intent "so an interrupted update remains restart-recoverable and a failed narrowing update leaves the MCP route blocked" rather than silently widening it. New sections near the end verify the mechanism directly against the issue's and pull request's own text, read the still-open, still-unmerged state of PR 11135 against this record's own Authority Provenance ledger, and state precisely what NemoClaw's own current, shipped behavior does and does not establish. Updated 7 September 2026: EKKOLearnAI's Hermes Studio issue #2941, opened the same day by a reporter using the handle Gerrylinux against hermes-web-ui v0.7.18, reports that clicking Allow on a dangerous-pattern approval card produced a UI "session expired" message and a silent 300-second agent-side timeout that reclassified the decision as no consent, while the harmless command the approval gated never ran. Moona Intelligence cloned EKKOLearnAI/hermes-studio directly at its current main-branch tip and confirmed the reported version, the 300-second timeout constant, and a pre-bridge session-access gate in the primary chat path capable of dropping an approval response before it ever reaches the shared Hermes Agent bridge; the bridge's own approval_respond wire payload, read directly, carries no session identifier at all, narrowing rather than confirming the issue's own suspected session-key-mismatch cause. Root cause is stated as unknown; #2790, merged eight days earlier, is kept as related pending-interaction timeout UX history, not as a fix for this specific mechanism. Updated 9 September 2026: langchain-ai/deepagents pull request 6149, whose final commit landed on the default branch with content identical to pull request 6173, fixed a Talon `update_mcp_server` auto-approval guard that enumerated only `command`, `args` and the derived transport as fields a redacted-secret-reusing update must not change, omitting `url`; the guard now denies by default, requiring every managed field but the two tool-filter fields to stay unchanged whenever a redacted value is reused. Moona Intelligence cloned the repository directly and confirmed the omission, the fix and its two added regression tests against source rather than the pull request's own page description alone. Updated 12 September 2026: Atlassian announced Agent loops in Jira on 10 September 2026, ahead of its 22 September State of AI SDLC summit, describing an always-on workflow that continuously scans the backlog for well-defined, unassigned work items, delegates each one to the Jira Coding Agent for execution and testing, and opens a ready-to-review pull request, gated by an AI Review agent and, Atlassian states, a human reviewer before anything ships. Its own named governance answer to exactly this record's own objective-versus-action distinction, Agent Context Controls, Standards and AI Review, leaves unstated in every source this record could reach whether a work item merely being well-defined and unassigned is itself what the loop treats as sufficient to begin executing and testing code against it, what the Jira Coding Agent can reach once delegated a work item beyond the Jira and Confluence space access Agent Context Controls itself governs, whether the pull request a human approves is bound to the exact diff that later merges, and what happens to an in-progress loop's own mandate if the work item it started from is edited, reassigned or closed while execution continues.
