What_Just_Became_Commercial

In June 2026, Zafin announced AIOS - an end-to-end platform for orchestrating and governing agentic work across regulated financial institutions. Proof-of-work validation, cost controls, workflow registration. Also in June, New Relic shipped Autopilot (managed SRE agent) and Ground Truth (observability-data exposure for customer agents). Two infrastructure plays, both landing in territory the control-plane argument had already mapped out months earlier.

Then came August. Guidewire, on 3 August, released Qusar's Agentic Framework - model-agnostic, governed AI agents with native, secure, real-time access to insurance-system policy, claims, and billing data. Salesforce, on 5 August, announced Agentforce 360 achieving DoD Impact Level 5 authorisation. Black Hat 2026 saw Rubrik launch Agent Identity (scoped tokens per tool call, Okta and Entra ID federation) and SailPoint ship Agentic Fabric (non-human identity governance, unmanaged-agent discovery via endpoint sensors).

The narrative is obvious: agentic governance is becoming a commercial category. The vendors are filling a gap. The gap is filled.

Except it isn't. Not the one that matters.

The vendors' wave addresses a real and previously-unsolved problem: infrastructure for agent governance at scale. Non-human identity tokens scoped to individual tool calls. Authorisation vaults separating agent credentials from human user contexts. Observability integration so you can see agent decision paths before deployment. Managed control planes so the agent doesn't run unconstrained against arbitrary APIs.

Zafin's AIOS handles workflow registration and cost governance for financial institutions - you define the agent's lane, set its budget, register its outputs into audit logs. Guidewire's framework gives agents secure, real-time access to insurance-system policy, claims, and billing data so they can act on the systems they need without holding raw database credentials. New Relic's Ground Truth exposes observability data as machine-readable tool definitions so your agents can query their own dependencies and understand failure modes.

Rubrik's Agent Identity solves a specific, concrete problem: when an agent makes a tool call, it shouldn't use the calling user's credentials. It should use a token scoped to that specific tool invocation, issued from a dedicated agent-identity authority, ephemeral, auditable. SailPoint's Agentic Fabric inverts the problem: find every agent running in your environment - managed by you, deployed by vendors, shadow-agents spun up by other parts of the organisation - and extend non-human identity governance to all of them.

These are not trivial problems. They are infrastructure problems, and they have infrastructure solutions.

What_Remains_Unsolved

The vendors have solved: where do agents get credentials? and can I see what an agent did?

They have not solved: should this agent have done that?

Three problems remain unsolved, and they are unsolved because they are not infrastructure problems. They are operator-judgment problems.

I've explored the first two of these - trust-tier calibration and gate placement - in an earlier piece on platform-native orchestration ("The Declarative Turn: What Platform-Native Orchestration Solves, and What It Doesn't", August 2026). That piece maps the same split: the platform's job is to enforce the mechanics of agent action; the operator's job is to decide whether agents should act at all. What Declarative Turn did not address is how to classify actions by reversibility and stakes - which actions are cheap and reversible enough to delegate unsupervised, and which demand human judgment regardless of track record. That distinction - Problem 3, blast-radius classification - is where this audit opens new ground.

Problem 1: Trust-tier calibration. How much autonomy has this agent earned? Does it run queries and post results, waiting for human review? Does it fix issues within a bounded scope and log everything for post-incident review? Does it have singular decision authority and you find out after? Trust tiers are not technical problems. They are calibration problems. I've written about this before ("Every Agent Needs a Passport", August 2026): an agent's credential tier is a claim about its trustworthiness, and that claim is grounded in track record, scope boundary, and what reversibility means for the work it touches. Rubrik's scoped tokens solve the issuance problem. They do not solve the judgement problem - the human still has to decide whether this agent gets a token with these permissions at all. No vendor tooling this week addresses trust-tier calibration.

Problem 2: Gate placement. Where does the human review happen? Before the agent acts, after, or conditionally depending on reversibility? Salesforce's DoD IL5 authorisation tells you where gates happen (in a government-grade authorisation vault). It does not tell you when. A financial-services agent processing a mortgage application: does every decision go to an underwriter first? Only decisions above a certain confidence threshold? Only denials? Only approvals? That judgement belongs to the organisation, not the platform. Zafin registers workflows and logs outputs. It does not choose whether a gate is a soft stop (log it, alert, human can override) or a hard stop (human must approve before execution).

Problem 3: Blast-radius classification. What makes an action reversible enough to delegate unsupervised, and what makes an action so consequential that it needs human judgment regardless of the agent's track record? A query is cheap and reversible. A deletion is expensive and partially irreversible. An email sent to the wrong person is reputational damage. A financial transfer is a liability. The same control plane that regulates all of these carries no logic for distinguishing them. I wrote about this in "The Control Plane Problem", June 2026: the infrastructure can enforce how actions are called (credentials, audit logs, rate limits). It cannot evaluate whether they should be called. That evaluation lives in human judgment about reversibility and stakes.

None of these three problems is new. "The Control Plane Problem" named all three. But the infrastructure wave this August has not addressed any of them. The vendors' solutions are necessary. They are not sufficient.

Why_This_Matters

The gap matters because it separates the solved from the still-unsolved, and organisations buying governance platforms are going to confuse the two.

You can buy Rubrik's Agent Identity system and ensure every agent gets properly-scoped, ephemeral credentials. You have solved the technical governance problem. You have not solved the organisational governance problem. If you haven't decided whether the agent gets token refresh authority, or whether it can call the deletion API at all, the token is irrelevant. Rubrik's infrastructure is load-bearing; your own judgment is not delegable to a product.

Same pattern with Salesforce's DoD authorisation. Impact Level 5 is a stamp on the infrastructure. It is not a stamp on your gate placement. You still have to decide: does this agent need human review before every action? Before actions above a cost threshold? Before actions that touch PII? The authorisation level answers "can we build this infrastructure securely in government." It does not answer "should this agent run this action unsupervised."

The vendor wave is real. The infrastructure is necessary. But the gap that opened is: operators will ship governance platforms without solving operator judgment, and then will blame the platform when an agent acts outside its proper scope. The platform's job is to enforce how agents act. The operator's job is to decide whether they should.

What_This_Changes_from_the_Prior_Frame

Earlier this summer, I named the infrastructure gap directly: we did not have commercial platforms for agentic identity, we did not have control planes that separated agent credentials from user credentials, we did not have authorisation frameworks that understood non-human identity as a distinct security surface.

All of that has changed. The infrastructure exists now. Three separate vendors can now do most of the identity-and-control-plane work that a year ago required building it yourself.

The gap has not closed. It has shifted. Now the vendors are solving infrastructure fast enough that the unsolved part - operator judgment about trust, gates, and reversibility - looks like the missing piece instead of a category error. The problem statement has evolved from "we need identity infrastructure" to "we have identity infrastructure; now how do we make smart decisions within it?"

That problem statement is one I've been working inside, not outside. "Earned Layers" is the frame: agents earn trust through track record and scope constraint. The governance vendors have built the infrastructure for enforcing constraints. The earning part - the calibration - still lives with the operator.