Intelligence
Join the waitlist

Enterprise Adoption

How organisations are actually deploying agents, and what breaks once the deployment leaves the pilot. Procurement, review capacity, on call, audit and the operational cost of oversight.

Foundational reading

42 pieces
14 August 2026

Your AI Agent's Permissions Did Not Change. Its Authority Still Did.

Google announced Gemini 3.7 Flash on 13 August 2026 and said Gemini Spark would start using it the same day. Google describes better multi step planning, better tool calls, better recovery from roadblocks, fewer retries and less manual oversight. Spark's permission surface, the connected apps, the local and remote browser, the confirmation prompts, is unchanged. That is the part worth thinking about. Effective authority can move without a single permission being edited.

Agent Authority22 min read·Moona Intelligence

More in this topic

29 September 2026

Neue Innovationen bei Okta for AI Agents verbessern die Transparenz des Agentenverhaltens, sichern Verbindungen zur Laufzeit und setzen eine kontinuierliche Agenten Governance durc

This review examines Neue Innovationen bei Okta for AI Agents verbessern die Transparenz des Agentenverhaltens, sichern Verbindungen zur Laufzeit und setzen eine kontinuierliche Agenten Governance durc. It distinguishes what the retained source describes from evidence of deployed controls or an independently established execution result.

Enterprise Adoption1 min read
29 September 2026

Zenity Named in 2026 Latio and SACR AI Agent Security Reports

This review examines Zenity Named in 2026 Latio and SACR AI Agent Security Reports. It distinguishes what the retained source describes from evidence of deployed controls or an independently established execution result.

Enterprise Adoption1 min read
29 September 2026

AI Agent Governance: Your Control Plane for Agent Security

This review examines AI Agent Governance: Your Control Plane for Agent Security. It distinguishes what the retained source describes from evidence of deployed controls or an independently established execution result.

Enterprise Adoption1 min read
29 September 2026

Why AI Agent Security Belongs at the Decision Point

This review examines Why AI Agent Security Belongs at the Decision Point. It distinguishes what the retained source describes from evidence of deployed controls or an independently established execution result.

Enterprise Adoption1 min read
29 September 2026

Zenity's Black Hat USA 2026 AI Agent Security Recap

This review examines Zenity's Black Hat USA 2026 AI Agent Security Recap. It distinguishes what the retained source describes from evidence of deployed controls or an independently established execution result.

Enterprise Adoption1 min read
29 September 2026

Zenity for Cursor: MCP Visibility & Governance for AI Coding Agents

This review examines Zenity for Cursor: MCP Visibility & Governance for AI Coding Agents. It distinguishes what the retained source describes from evidence of deployed controls or an independently established execution result.

Enterprise Adoption1 min read
13 September 2026

Exiger's Agents Route Workflows Inside Roles You Set. Which Role Is the Question.

Exiger's 1EXIGER.AI launched 10 September 2026 as an AI-native execution layer across supply chain, procurement, trade and compliance. Its own product material states agents investigate, monitor, assess, route and initiate workflows within configured roles, permissions and review points, and that a disrupted supplier or changed regulation is mapped to exposed entities and available courses of action. This record reads that language as a further known example of technical eligibility standing in for legitimate authority, connects it to Moona's existing Risk Registry weakness on the same gap, and states what the vendor's own material does not establish: the mechanism binding one workflow's objective, action, target and current state, whether a review point blocks execution or only records it after the fact, and whether authority is re-verified once the supplier or regulatory condition that triggered a course of action changes again.

Agent Authority6 min read
13 September 2026

The Agents Prepare the Filing. An Intent Preview Is Not the Filing.

Filtax.com's 12 September 2026 launch states that parallel agents autonomously reconcile source records and prepare tax computations, that CAs receive an Intent Preview and must review, adjust and approve it before final government-portal submission, and that reconciliation, classification and filing steps carry append-only, tamper-evident digital audit logs. Fullestop's own separate GSTR-2B AI reconciliation product page states plainly that the underlying reconciliation depends on GST portal data import and refresh. Neither source states what happens to a prepared, approved Intent Preview when the portal or source evidence it was built from changes before the approved computation is actually submitted; that revalidation, mutation-invalidation and inter-agent delegation semantics remain unknown.

Agent Authority5 min read
12 September 2026

Gartner Tells Chief Audit Executives What Their AI Governance Actually Lacks

Gartner's Audit AI: A Practical Guide for CAEs, published 9 September 2026, reports that 83 percent of audit leaders identify AI governance as a 2026 priority while only 34 percent are confident they can actually address it. Gartner names limited visibility into deployed AI as a major assurance risk and recommends a current AI inventory, deployment specific risk assessment, controls integrated into workflows, and audit ready evidence generated during work rather than reconstructed after the fact.

Governance & Policy5 min read
12 September 2026

i-Mandate Lets an Agent Choose the Fix. Which Institution Actually Authorized That Choice?

YES BANK and Open Financial Technologies announced i-Mandate, a joint agentic recurring-payments platform, on 11 September 2026. An AI Payment Agent forecasts a likely debit failure and helps a customer pick from four named alternatives before it happens. Institutions are stated to retain control of permitted actions, timing, consent requirements and approval or risk controls. Moona Intelligence reads this as evidence of a bounded, institution-controlled agent decision model in live recurring payments, not as evidence of how any one alternative's consent is bound to its own execution once the mandate's state has moved.

Agent Authority5 min read
12 September 2026

Penguin Ai Keeps the Specialist in the Decision. What Exactly Does the Approval Bind?

Penguin Ai's 11 September 2026 launch of Intelligent RCM places a specialist between an AI worker's drafted claim or appeal and its submission: AI workers pull the evidence, check the claim and draft the appeal, pre-submission review checks eligibility, authorization, coding, medical necessity and payer policy, evidence and reference data stay inspectable, and the release states the specialist owns the review and the final approval while the customer controls submission. This is evidence that a healthcare revenue-cycle vendor is building the same prepare-and-enact separation this desk already tracks elsewhere, not evidence that a specific approval is bound to a specific submitted artifact, that a later mutation or payer policy change invalidates it, or that a failed pre-submission check blocks submission by itself.

Agent Authority5 min read
10 September 2026

Caseware Keeps the Auditor in the Decision. What Exactly Does That Approval Cover?

Caseware has placed two human decisions inside a connected agentic audit workflow: suggestions may be reviewed and approved before Excel changes are applied, and an auditor alone decides whether a client submission is accepted. Once accepted, that information becomes engagement data available to later workpaper workflows. This is evidence that action approval is becoming part of ordinary professional software, not evidence that every downstream use inherits the original decision. Caseware does not publicly specify the exact approval binding, mutation invalidation, approver authentication, retained provenance, or downstream revalidation semantics in this announcement.

Agent Authority4 min read
9 September 2026

Zayo Put a Production MCP Server in Front of Its Network. What Does Agent Approval Actually Cover?

Zayo launched Agentic Networking for DynamicLink on 8 September 2026, a production Model Context Protocol server sitting in front of DynamicLink, its Network-as-a-Service platform in production since 30 September 2025. Zayo states approved AI agents can understand network context, access network tools and execute authorized network actions, with enterprises determining which information, tools and actions an agent can reach, and automation, governance and human oversight described as part of the operating model. Every www.zayo.com page for this record returned EGRESS_BLOCKED to direct fetch; content is corroborated through independently phrased search retrieval converging on the same wording across five outlets. What is not stated anywhere reachable is the mechanism that evaluates one specific requested network or security action against whatever an enterprise scoped in.

Agent Authority5 min read
3 September 2026

The Agent Can Build the Cart. Anthropic Still Did Not Give It the Card.

Anthropic's commerce-agents repository, published 2 September 2026, ships a shopping agent for the storefront and a merchant agent for the back office, with a safety document that separates what the reference code enforces from what it only asks the model to do. The shopping agent's backend interface defines no order placing or charging method at all, so checkout renders the cart for the host application to complete rather than the model completing it. The merchant agent may stage a change to a listing, a price, a promotion or a campaign, but apply_change accepts only change ids that a staging call returned within that same session, guardrails run once when the change is staged and again against current configuration when it is applied, and with require_host_approval on, which the documentation states is the default, apply_change succeeds only for ids the host has separately marked approved through a portal route or an SDK tool, never through a preview card or an approval typed in chat. Anthropic's own documentation also states that a deployment can turn that default off, at which point a chat approval does count, so the separation between staging and commit is a configurable reference design, not a fixed property of the software.

Agent Authority11 min read
1 September 2026

The First Human Approved It. The Agent Was Still Not Authorized to Finish.

Zendesk announced human in the loop and multi step sequential approvals for action flows on 31 August 2026, a blocking option for the Send approval request step that had, since 6 April 2026, only ever fired and moved on. Since 13 May 2026, a configured Zendesk AI agent can invoke action flows, and through them external actions and MCP connectors, which is what makes this a change in Agent Authority rather than a change in ticket process. Moona Intelligence reads the new capability narrowly and precisely: a workflow can now require more than one distinct human authorization, at more than one checkpoint, before a later step is allowed to execute, and an earlier approval clears only the transition it was attached to, not everything downstream of it.

Agent Authority13 min read
28 August 2026

CEOs Own the AI Budget. Who Owns the Agent's Actions?

A LinkedIn post citing a 72% figure and an unverifiable 14% figure sent me looking for the research behind it. BCG's AI Radar 2026, a survey of 640 CEOs among 2,360 executives across 16 markets and nine industries, is the real source of the 72% figure. The same survey shows CEOs committing over 30% of 2026 AI investment to agents, and its most aggressive adopters already running agents end to end. Nowhere in it does anyone ask who authorizes what one of those agents is actually allowed to do.

Agent Authority6 min read
28 August 2026

Drata Used to Help You Prove the Control Existed. Now It Wants to Enforce It Before the Agent Acts.

On 4 August 2026, Drata opened Limited Availability for AI Agent Governance, a product built on three components it calls Sensor, Mission Control and Chain of Custody. Drata's own material states that Mission Control evaluates every agent action against approved policy in real time and blocks violations inline, before they execute, using policies a team writes in plain English and Drata compiles into enforceable rules. The release covers agents running on Anthropic today, with OpenAI, Google Vertex AI and AWS Bedrock described as in active development. Drata is a compliance evidence company. What it just tried to ship is not another audit report. It is a claim to sit at the moment an agent is about to act and decide whether it may.

Agent Authority12 min read
28 August 2026

The Employee Can Open the File. Somansa Says the Agent Still Might Not Be Allowed To.

Korean trade press reported on 26 August 2026 that Somansa had launched Privacy-i AIDR, an addition of AI agent detection and response to its existing endpoint detection and response product, built to find so called shadow AI agents installed on employee machines without company approval. The reported core claim is that an administrator can restrict, by business purpose, which files, programs and system permissions an AI agent may use, distinct from the human account it runs under. Somansa says the product is being validated through proof of concept work in large enterprise environments and plans a next generation version in the fourth quarter of 2026. Moona Intelligence verifies the launch chronology, states exactly what is and is not documented about agent identification, permission scope, enforcement order and audit evidence, and narrows every claim this record could not independently confirm. Updated 1 September 2026: Reco announced general availability of Browser Guard, a third boundary this record now tracks alongside Somansa's endpoint and Okta's cloud identity layer. Reco says Browser Guard inspects prompts and agent activity from AI assistants, copilots, coding agents, autonomous workflows, shadow AI and personal AI accounts reached through the browser, correlates that activity with an identified user, data, destination, account type and business purpose, and can detect, guide, block or stop it before data is exposed or an unauthorized workflow starts. Reco's own privacy policy documents the mechanism precisely: a Chrome extension deployed to an enterprise's managed browsers, collecting authentication and session signals, account identifiers, SSO redirect events, hashed AI prompt metadata rather than prompt text, device fingerprint data and browser extension inventory, sent to the organization's own Reco tenant. This record reads that as the same distinction it already applies to Somansa: the browser session reaching a destination is not the same fact as the AI agent acting through that session being authorized to use it, and states precisely what remains undocumented about agent identification, business purpose provenance, enforcement mechanics and what sits outside the managed browser path Browser Guard actually mediates. Updated 1 September 2026: CrowdStrike unveiled Falcon Guardian at Fal.Con 2026, extending its Falcon sensor into a control point for AI agent activity on managed Windows and macOS endpoints, the same layer Somansa's own product occupies, now with independent, major incumbent evidence behind it. CrowdStrike says Guardian discovers known and shadow agents, records who deployed them, connects agent activity to a causal chain from prompt through tool call to downstream execution, defines which agents may run and blocks unauthorized ones, and detects and contains malicious agent behavior at runtime. This record keeps that separate from Continuous Identity for AI Agents, a different CrowdStrike capability unveiled 15 June 2026 that authorizes each agent action in real time using a SPIFFE based agent identity and evaluates the agent's owner, its caller and device risk before granting, denying or revoking access, and states precisely what CrowdStrike's own material does and does not establish about each. Updated 3 September 2026: a further verification pass corroborates the CrowdStrike and OpenAI Codex partnership this record could not confirm on 2 September 2026, correcting that finding, and confirms CrowdStrike introduced the Agentic Identity Provider, Agentic IdP, on 2 September 2026, an upstream registration and identity layer CrowdStrike says fills a gap in Continuous Identity. Agentic IdP is verified in full, against its own Authority Provenance ledger, in Moona Intelligence's own Google Agent Identity record rather than here. Updated 7 September 2026: a further verification pass, run because no new CrowdStrike material dated after 3 September 2026 was found bearing on availability, instead surfaced one specific technical detail this record had not yet carried: CrowdStrike's own material names the Shared Signals Framework, SSF, alongside SPIFFE as one of the modern identity standards behind Continuous Identity's real time authorization, while separately describing CrowdStrike as helping advance SSF and the Continuous Access Evaluation Profile as ongoing industry standards work rather than stating SSF as a specific, shipped mechanism inside Continuous Identity's own decision beyond that naming. This record adds that distinction precisely, changes no availability finding, and states plainly that no CrowdStrike development since 2 September 2026 was found altering any claim already verified here.

Agent Authority58 min read
26 August 2026

Ask DataHub Requires Human Approval. One Setting Decides Whether It Still Does.

DataHub Cloud v2.1 made Ask DataHub generally available on the strength of one claim: the chat agent pauses for human in the loop approval before applying a metadata edit on the web. DataHub's own release notes document the control underneath that claim directly, an environment variable called DATAHUB_AI_TOOL_APPROVAL_ENABLED, default true, re read per chat turn, that switches every mutating tool from paused to auto applied. Moona Intelligence reads that as two separate authority questions stacked on top of each other. The first is whether one write gets a human's yes. DataHub answers that one. The second is who is allowed to decide that future writes stop needing a yes at all, and on the evidence available, that decision sits outside anything DataHub's own permission model documents. Updated 1 September 2026 with AuditBadger, a SOC 2 and ISO 27001 compliance platform that opened its own compliance workflow to external agents including Claude, ChatGPT and Codex the same day, and claims a different answer to the same question: an agent surface with no direct write path at all, so there is no switch to go looking for who controls it. That is a vendor claim about an architecture Moona Intelligence could not independently inspect, not a demonstrated one, and this record reads it against DataHub's configurable pause rather than as proof the harder problem is closed.

Agent Authority19 min read
25 August 2026

Your Admin Can Change It. Does That Mean Their AI Agent Should?

OpenAI's 25 August 2026 announcement describes an Admin plugin that lets a workspace administrator review activity and credit usage, add or remove members, update groups, adjust usage limits and approve or deny spending requests, entirely from a ChatGPT Work or Codex conversation. The plugin's own documented boundary is that it operates within each user's existing role and permissions, does not grant broader access, and maps administrator instructions to supported read or write actions. OpenAI describes pending usage requests routed to Slack or Microsoft Teams for an authorized reviewer to approve or deny, feature access requests granted automatically when predefined criteria are met with exceptions routed for review, and broader impact changes admins can review before they are applied. Moona Intelligence verifies that architecture against OpenAI's supporting plugin and admin control documentation, and separates four things this record keeps distinct: the administrator's own workspace role, the workspace's decision to install and configure the plugin and its underlying app, the specific operations the plugin currently supports, and the review step that applies to some of those operations and not others.

Agent Authority16 min read
25 August 2026

If You Can Do It in Salesforce, Your AI Agent Can Do It Too

Salesforce's Headless 360 MCP Server has run in open beta since July 2026, and a 19 August 2026 expansion, republished to Salesforce's Asia Pacific newsroom on 25 August, layers new Data 360, Slack and skills capability around it at varying maturity levels. The server's own documentation states plainly that every transaction executes as the authenticated user, scoped through an External Client App carrying a dedicated mcp_api scope, with object permissions, field level security, sharing rules, profile permissions and permission sets all applying before the Dispatch tool is allowed to run. If a person cannot perform an action in Salesforce, their agent cannot perform it through the MCP server either. Moona Intelligence verifies that claim precisely, narrows what inherited trust actually composes to, and finds a real, working boundary for technical permission sitting directly beside an undocumented one for organizational mandate: nothing in the architecture establishes that a user who can deactivate a colleague, deploy an Apex trigger or assign a permission set was ever asked whether an AI agent should be allowed to do the same thing on their login. Updated 28 August 2026 with Salesforce and Anthropic's 26 August 2026 Claudeforce announcement: Salesforce in Claude, a Plugin shipping to pilot customers with 37 prebuilt sales skills, calls the same Salesforce MCP architecture this record already verified, with Salesforce's own language stating explicitly that no new permissions model needs to be built.

Agent Authority31 min read
25 August 2026

The Dealer Had Permission to Hedge. Your Bourse Let an AI Agent Use It Too.

Your Bourse, the FX, CFD and crypto trading infrastructure provider, published a content hub piece on 18 August 2026 describing MCP for Trade Server, a connection that lets a broker link a compatible AI assistant to its Trade Server backend. Finance Magnates corroborated the same day that broker staff can query live data and initiate permitted hedges or position closures. Your Bourse's own material states the assistant inherits the permissions attached to the connected user's existing Trade Server credentials, that instructions affecting positions or funds return a preview before anything executes, and that execution follows only after a person approves it and is then recorded in Trade Server the same way as an action taken through the ordinary interface. Moona Intelligence verifies each part of that claim separately, keeps the employee's technical login permission apart from any organizational mandate to delegate it to software, and finds Your Bourse has not documented whether the confirmation step is enforced inside Trade Server itself or depends on the connected AI client honoring it.

Agent Authority15 min read
24 August 2026

Seeing What an Agent Did Is Not Stopping It. Okta's Case for a Cross Platform Kill Switch.

Harish Peri, Okta's SVP and General Manager of AI Security, published When AI Agents Go Rogue: The Case for an Enterprise Kill Switch on LinkedIn on 20 August 2026. The piece argues that an enterprise watching an agent is not the same as an enterprise that can stop one, that agents crossing several systems in a single task make manual containment impractical, and that the resulting enforcement layer has to reach across applications and vendors rather than stay inside one company's own product. Moona Intelligence verifies Peri's role and reads the argument against Okta's own six month public record making the same case, and keeps two things separate throughout: what a kill switch is argued to do, and what any implementation, Okta's included, has actually been shown to do.

Agent Security9 min read
24 August 2026

NIST Wants an Identity for the Agent. Authorization Is a Separate Question.

The NCCoE's concept paper, published 5 February 2026 with public comment open through 2 April 2026, proposes a practical demonstration project applying identity and access management standards including OAuth, OpenID Connect, SPIFFE and SPIRE, SCIM and Next Generation Access Control to software and AI agents in enterprise settings. Moona Intelligence verifies what the paper actually establishes: a draft proposal exploring a demonstration project, not a finished standard, not enacted policy, and not a completed practice guide. Its most useful contribution is not a technical answer but a structural one, that an agent's identity, its authorization to act, the human authority it acts under, and the record of what it did are four separate things a system has to get right, and having one does not prove the others.

Governance & Policy10 min read
24 August 2026

Your Employee Has Access. Whether an Agent Inherits It Is Not Their Call.

Okta's Cross App Access did not launch today. It was announced 23 June 2025, expanded to a 25 plus partner ecosystem on 23 June 2026, and given Auth0 implementation guidance on 6 August 2026 that named 24 August 2026 as when integrations including Anthropic, Asana, Canva, Cloudflare, Cursor, Datadog, Docker, Figma, VS Code and Zoom were expected to reach the Okta Integration Network. Two days before that, on 22 August 2026, the Model Context Protocol's own Lead Maintainers published a new roadmap making agent identity and enterprise ready security one of five top level protocol priorities, naming cloud workload agents, absent users and subagent delegation as cases the current browser consent model does not serve, and pointing at DPoP, Workload Identity Federation and the ID JAG grant behind Enterprise Managed Authorization as the intended path. Moona Intelligence verifies each stage of that chronology separately, reads the protocol's own mechanics and its own roadmap post directly, and separates what is confirmed stable from what remains directional specification work. Updated 1 September 2026: Okta's own newsroom confirms that expected 24 August milestone was Agent SSO, folding Cross App Access into core Okta SSO at no additional cost, reaching general availability that day, and this record now independently re-verifies Claude's own integration maturity alongside it. The distinct question underneath all of it, unchanged by that confirmation: Cross App Access moves the decision to let an AI agent inherit an employee's application access from a consent screen the employee clicks through to a policy an administrator configures once, and the employee whose access is exercised is not necessarily the actor who was organizationally entitled to make that decision, a question the new roadmap now extends to cloud workloads and to agents acting for other agents.

Agent Authority57 min read
23 August 2026

The Agent That Wrote the Code Cannot Approve It

The AI-native SDLC playbook describes six stages, Plan, Design, Build, Test, Deploy and Maintain, run as a loop rather than a line, with AI embedded at each point. The part worth reading closely is not the stages. It is what Anthropic puts at the seam between them: a hook, described as the deterministic control behind an advisory instruction, that can allow, ask or block before Claude acts, a production deploy hook that holds a release until a named release manager authorizes it, and a rule that a non interactive agent run carries its own identity so a pipeline log can tell what the agent did from what the engineer did.

Agent Authority11 min read
22 August 2026

You Can Approve Every Trade. Or You Can Delegate the Subaccount in Advance.

Binance introduced Agent OS on 20 August 2026 as a developer platform linking compatible AI applications, including ChatGPT, Codex, Claude Code and Cursor, to Binance trading, market data, wallet, payment and onchain capabilities, gated by user configured permissions. TechCrunch's reporting, built on an interview with Binance VP of Product Jeff Li, describes the primary constraint as a dedicated subaccount with withdrawals blocked by default, and quotes Binance describing a genuine choice between per order approval and autonomous execution once permissions are configured. Binance's own MCP Server documentation, modified the next day, describes something narrower: every order, cancellation and transfer inside that subaccount confirmed by the user before it executes, with no autonomous mode documented alongside it. Moona Intelligence reads this against what a human can delegate in advance, where that delegated envelope actually ends, and what is vendor statement rather than documented enforcement. Updated 23 August 2026 with the MCP Server's own confirmation requirement, the subaccount's empty starting balance, the absence of a withdrawal scope, an itemized revocation path and a direct comparison against Robinhood's bounded autonomous execution, on top of the 22 August Authority Provenance ledger verifying who is documented as entitled to grant an agent trading authority. Updated again 25 August 2026 after Moona Intelligence's radar flagged further Binance explanatory material on the same permission and approval model. That specific material could not be independently reached in this environment. This update instead adds a second, independent secondary account of the confirm before execute pattern, and records plainly that the underlying findings, and their open questions, are otherwise unchanged. Updated again 2 September 2026 with a Binance Support FAQ, 'What Is the Binance MCP Server?', that independently verifies the MCP Server's scopes, supported products, subaccount funding boundary, absence of a withdrawal scope and revocation channels as first party documented fact rather than secondary corroboration, correcting this record's earlier, stronger reading of Emergency Stop to the FAQ's own narrower language of disabling agent access and stopping active activity, with canceling open orders as its stated example; and with a 1 September 2026 Binance blog post documenting a user's Codex connected purchase of BNB with USDT through a propose, review, approve, execute flow, plus further conversions and a Spot to USDⓈ-M Futures transfer by the same user. That is first party documented implementation evidence layered on top of documented architecture. It does not establish where confirmation is technically enforced, whether an approval binds to an order's exact parameters, or whether an autonomous mode is now first party documented, each of which this update leaves as it found them: unresolved.

Agent Authority36 min read
21 August 2026

The Agent Can Move the Money. It Still Does Not Hold the Keys.

BNB Agent Studio v2 launched on 13 August 2026 and gained a second wallet option, Altana, on 18 August 2026. Altana lets a builder keep custody of a wallet's underlying keys while an agent acts through a session key bounded by a spending limit, a contract allowlist and an expiry, recorded on chain so the bound can be checked from outside the agent and revoked in one transaction. Moona Intelligence reads what is actually being separated: the ability to transact from the authority to redefine what transacting is allowed to mean.

Agent Authority10 min read
21 August 2026

Slack Put the Approval Where the Conversation Is. It Did Not Put the Enforcement There.

On 20 August 2026 Slack, a Salesforce company, launched Slack Code: a new channel type that partner coding agents create through a Slack API, carrying a plan, a repository and branch, code diffs and a live preview. Slack documents that anyone in the channel can pause, redirect or stop an agent mid task, that agents inherit Slack's permissions and admin controls so no new identities are provisioned, and that the channel archives itself into an audit log when the task ends. Slack also says that for high stakes moves, like pushing code to production, the agent packages its work for an expert to sign off on, right in the channel. That is a description of a workflow, not of an enforcement mechanism. Slack states plainly that Slack Code is not a coding model, a harness or an agent runtime, which means the code does not execute in Slack and neither does the deployment. Nothing published establishes who counts as an expert, whether a sign off binds to a specific diff, commit or deployment, whether an agent can proceed without one, or what downstream system enforces the decision. Moona Intelligence reads the launch as the approval moment moving onto a general purpose chat surface while the enforcement point stays somewhere Slack does not document.

Agent Authority10 min read
21 August 2026

Enterprises Are Picking Orchestration Platforms on Whether They Can Constrain the Agent

VentureBeat Pulse Research surveyed 107 organizations of 100 or more employees in a single July 2026 wave about how they run and buy agent orchestration. Flexibility across models and tools led the reasons for picking a platform at 29%. Security and permissions came next at 17%, with control over agent execution and production reliability at 15% each. Looking forward, 30% named security and permissions enforcement as a planned investment over the next twelve months, second only to agent monitoring and debugging at 31%. And 53% expect their primary control plane to be hybrid by the end of 2026, with the risk most associated with a provider resident control plane being that provider's security and permissioning limitations, at 37%, ahead of vendor lock in at 23%. This is a small, self selected, technology heavy sample. It is a directional signal about a specific set of AI active enterprises, not a measurement of enterprise behaviour in general.

Enterprise Adoption5 min read
17 August 2026

Fortinet Bought an AI Security Company. Look at Where It Puts the Control.

On 17 August 2026, Fortinet announced it had acquired Virtue AI, describing the company as an innovator in AI runtime protection, automated AI validation, and security for autonomous AI systems. Financial terms were not disclosed. The interesting sentence is not about the deal. In the capability list, Fortinet writes that the technology monitors agent behavior and blocks malicious tool calls before they act. Virtue AI describes the same capability on its own site under the name Action Guard: monitor agent behavior as it happens and block malicious tool calls before they fire. Traditional security is largely organised around detection and response after activity occurs. A control that decides at the tool call is organised around something else: the moment before a consequential action executes.

Enterprise Adoption3 min read
17 August 2026

The Agent Did Not Make the Payment Alone. It Passed Your Authority Down a Chain.

Alipay announced a full stack agentic commerce platform and the AHA cross agent protocol system at its AI Ecosystem Partner Conference in Hangzhou on 17 August 2026, with more than 20 device makers, automakers and model companies joining an interconnection plan. Alipay's own documentation reports 300 million agent payments and 100 million users across 12 commercial scenarios, and describes several distinct authorization modes. Moona Intelligence reads the launch as an authorization propagation problem: when one instruction crosses several agents before producing a real payment, connectivity between those agents is not the same thing as inherited authority. Updated 23 August 2026 with newly surfaced evidence from Uber Engineering, published 21 May 2026, describing a production actor chain architecture that carries a human user's identity and every intermediate agent's identity through a chain of short lived tokens, verified against a strict Authority Provenance ledger. Updated again 24 August 2026 with the AI AGENT Act, introduced in the Senate as S.5051 on 21 July 2026 and now referred to the Committee on Commerce, Science, and Transportation, and with Aashis Luitel's 13 August 2026 analysis in The Conversation of a cross system evidence gap: an agent provider, a merchant and a payment provider can each hold an individually accurate record of one transaction while none of them, alone, can show the user authorized that specific action as part of that specific task. Updated again 26 August 2026 with this desk's own independent verification of S.5051: the bill's own official short description at Congress.gov, the precise scope of the redelegation restriction, the duties a permitted downstream delegate keeps, the FTC's registration process and its authority to set specialized terms for particular commercial settings, what a large online platform may do on its own side of a revocation, and the exact capabilities the bill directs NIST to identify or build standards for, with introduction date, sponsor and committee status confirmed unchanged as of 26 August 2026. Updated again 29 August 2026 with the Payment & Clearing Association of China's Self-Regulatory Convention on Agent Payment Applications, issued 24 August 2026 under People's Bank of China guidance: an industry self-regulatory instrument, not a statute or a PBOC regulation, that asks member institutions to sort out an authorization boundary between a user and an agent payment application, sign clear authorization agreements, verify transaction intent, protect a user's right to revoke, cap standing authority through transaction limits, and explore both a Know Your Agent mechanism built on top of KYC and a trusted evidence mechanism spanning user authorization, model decision, payment instruction and risk control, read against the same distinctions between authentication, agent identity, authorization and intent this record has kept separate throughout, and against PBOC Vice Governor Lu Lei's 27 August 2026 public call for market participants to actively implement it. Updated again 1 September 2026 with Reuters' reporting, citing three sources familiar with the matter, that India's National Payments Corporation of India is preparing a Unified Agent Protocol for agentic UPI payments, expected to build on UPI Circle and Reserve Pay and to be unveiled at the Global Fintech Fest, corroborated by Business Standard's earlier July 2026 reporting on the same NPCI development and read against this record's own Authority Provenance ledger, with NPCI's non confirmation to Reuters preserved as the current source state. Updated again 2 September 2026: this record corrects its own 1 September 2026 claim that UPI Circle showed no software delegation precedent, after locating NPCI's own OC 201-B addendum of 8 October 2025 extending UPI Circle's Full Delegation to a Device and a Software secondary user category, and adds NBSL's 25 November 2025 BHIM Full Delegation press release as further primary-adjacent corroboration. Updated again 10 September 2026 with NPCI chairman Ajay Kumar Choudhary's on-record confirmation at the Global Fintech Fest 2026 that NPCI is examining protocols to identify and authorise digital agents within the UPI ecosystem while preserving interoperability, auditability and settlement finality, strengthening Reuters' earlier sources-say reporting; final UAP mechanics, authorization bindings, revocation, RBI approval and launch timing remain UNKNOWN. Updated again 10 September 2026 with Reuters' same-day report that NPCI is also building a registry to verify and monitor AI agents transacting on UPI as part of its planned Unified Agentic Protocol, read here as an identity artifact distinct from transaction authority, with liability for wrong or unauthorised payments reported as still unresolved. Updated again 12 September 2026 after an AMP-mirror discovery candidate for the same Economic Times article led this desk to re-verify its already-captured raw artifact and surface one further Choudhary quote: an authoriser must independently verify identity, mandate, limits and consent regardless of what an agent interprets as intent, with settlement kept as a separate, rule-based, legally final layer; the mandate object's exact form, transaction binding, delegation, expiry/revocation and mutation-revalidation semantics remain UNKNOWN.

Agent Authority96 min read
14 August 2026

You Authorized the Goal at 9 AM. What Is the Agent Allowed to Do Until 5 PM?

WRITER announced Palmyra X6 on 13 August 2026 and says it can hold a single objective for up to eight hours without supervision, planning, executing, verifying its own output and correcting its work. WRITER Agent batches tasks, delegates to sub agents, calls MCP tools and connectors, and recovers from errors with fewer interruptions. Every one of those is a real improvement. Together they also mean that one authorization at the start of the day can sit behind a very long sequence of decisions nobody sees until the work comes back.

Agent Authority34 min read
14 August 2026

The AI Security Agent Found the Problem. Now It Has Authority to Fix It.

IBM and OpenAI announced an expanded cybersecurity partnership on August 13, 2026. IBM describes its Autonomous Defense Agents as providing automated policy enforcement and rapid remediation across IT and security tools, and its Autonomous Threat Operations Machine as orchestrating multiple AI agents and executing remediation at machine speed. When a security agent can take that kind of action, the transition from detection to remediation is also a transition in authority. The question is what governs what the agent is permitted to do at the moment it decides to change something in a live environment. Updated 27 August 2026 with Mate Security's Gamebooks, an independently built architecture that separates an organization's investigative mandate from the path an AI agent chooses and from the execution layer that reaches a real system. Updated the same day with Visa's Vulnerability Agentic Harness (VVAH), a shipped, open-source implementation that predates the day's corporate announcement by two months. Verified directly against the repository's current main: the shipped default profile runs remediation and validation automatically after every scan, the remediation stage can write a candidate fix into the target's actual working tree using only Read/Glob/Grep/Edit/Write with Bash denied on every shipped profile, and no commit, push or merge call exists anywhere in the codebase. A second, read-only panel scores the candidate without touching the target. Visa's own account, corroborated by VentureBeat, places human review before the tool runs, on the specific patch, and again before anything merges. That is evidence that mutation authority and adoption authority are separate transitions, not one boundary.

Agent Authority19 min read
14 August 2026

Claude Code Just Automated the Decision to Ask You for Permission

Anthropic has made auto mode the default permission mode for new Claude Code sessions on Pro, Max and Team plans, starting 14 August 2026. Auto mode is not unrestricted execution: a separate classifier reviews each tool call, deny and explicit ask rules still fire first, and repeated blocks fall back to manual prompts. The interesting shift is architectural. The decision about when a human is needed has moved up a layer. Updated 26 August 2026: Anthropic says Claude in Chrome, generally available on every paid plan, now decides the same question for actions Claude takes inside a browser, through websites a person is already logged into. The classifier moved from a terminal to a browser tab. What it is actually deciding, and what it cannot decide, did not move with it. Updated 28 August 2026: Claude Code v2.1.248 adds a --restricted launch mode that removes the built-in tools that run commands or code and WebFetch by default, confines file tools to the working directory, refuses bypassPermissions, and loads only managed settings, leaving project, local and user settings files unread. Where auto mode decides whether an available action may proceed, restricted mode decides which actions are available to the session at all, and this record reads what Anthropic's own current documentation does and does not establish about that difference. Updated 29 August 2026: v2.1.251 narrows the gap between a permission decision and the resource it actually reaches, fixing a symlink that could be swapped after a file tool's permission check, a matching gap in Grep and Glob's deny rules, a Workflow tool script path read before its own permission check, and consolidating Claude in Chrome onto Claude Code's own permission checks, while server managed settings that weaken the sandbox boundary now require the developer's approval before they apply. Updated 3 September 2026: v2.1.259 keeps going in the same direction, and this time the subject is what happens after a decision is made. It adds a headless option where anything that would prompt is denied instead of quietly allowed, makes Claude Code refuse to start when a managed settings source cannot be parsed rather than run with that policy silently unenforced, and fixes a Stop that did not actually stop background agents and workflows in remote control sessions. Updated 10 September 2026: Anthropic flips two Enterprise browser controls, the Claude in Chrome extension and the Cowork built in browser, from default off to default on starting 10 September 2026 unless already disabled. Both surfaces share per site prompts, a high risk site blocklist and per action safety checks, and the Cowork side panel defaults to Automatically approve. Extension role entitlement and the built in browser's gradual rollout mean default enablement is not universal deployment or action authority. Updated 10 September 2026: Claude Code v2.1.268 fixes deny and ask permission rules on symlinked system directories not applying when a path was addressed by its already-resolved real location, and a Read or Edit deny rule not applying when an env -C, eval or similar unanalyzable command shared its line, two further cases of a declared rule failing to bind to the target it actually governs; the same release also has auto mode name the specific rule that blocked an action and ask Claude to try a safer method and finish unrelated work before stopping to ask a person, read here against this record's own distinction between a policy declared, evaluated and enforced. Updated 13 September 2026: the same v2.1.268 release separately fixes a respawned in process teammate picking up tools or a system prompt from a same named agent file in a folder never trusted, a configuration provenance gap at agent respawn rather than a resource or command matching gap.

Agent Authority54 min read
13 August 2026

Nobody Told the Agent to Use the Camera. It Worked That Out on Its Own.

RebelDot describes a coding agent that was asked to run a robot arm data collection task with two unlabelled cameras. Nobody told it to capture reference frames, copy them over SSH or use the cubes on the table as a landmark. It did all of that, inferred the mapping, and then paused for human confirmation before proceeding. The interesting question is not the vision. It is what authorizes the steps an agent invents for itself. Updated 28 August 2026: Anthropic's Model Hardware Standard research preview, opened 27 August 2026, gives the actuator side of that question a concrete architecture, a common driver with read and write primitives and device level safety limits, and this record reads it as first party evidence for the sensor and actuator distinction argued below.

Agent Authority15 min read
13 August 2026

Robinhood Didn't Just Add a Chatbot. It Authorized Software to Move Your Money.

On 27 May 2026 Robinhood opened Agentic Trading and the Agentic Credit Card to third-party AI agents, letting a connected agent place real trades and real purchases inside a customer's account. The safeguards Robinhood built are real. The harder question is what execution-time control means once software, not a person, decides whether an action actually runs.

Agent Authority9 min read

Where to go next

All topics →
Governance & Policy
Regulation, standards and internal governance for autonomous systems.
Incidents
Agent failures in the real world, read for the control boundary that was missing.