Governance

Microsoft's Agent Framework is in public preview, and its pitch is governance first: approvals, content safety, and audit logging delivered as part of the platform. The contrast is Orca, which keeps the guardrail outside the agent.

StreamNative's Orca makes governance a property of the runtime instead of a layer over it. Base Compute's Superfluid gives one laptop a scheduler for several agents. The two edges of the stack the control-plane story left out.

Three open-source tools landed in the first week of October 2026, each aimed at one named symptom of 'agent sprawl': Red Hat's Rossoctl for discovery, Tuskira's gateway for credentials, and LiteLLM's Moyai for cost. The remediation layer is now shipping as modular, self-hostable building blocks rather than a platform you wait for.

Microsoft's Agent Control Specification and CSA's AARM both name the runtime-governance layer, from opposite ends. AARM writes mandatory requirements, including universal pre-execution interception and tamper-evident receipts. ACS writes the interface: lifecycle hooks, normalized verdicts, fail-closed enforcement. What was a gap diagnosis now has two competing specs.

OpenClaw Enterprise launched September 29 as MIT-licensed, self-hostable control-plane software for fleets of persistent agents, built inside OpenAI and donated outward with Red Hat and NVIDIA contributing. The open question is whether the enterprise control plane ends up a product or a protocol.

Docker's Sandbox Kit Spec packages an agent, its tools, and its requested permissions into one signable OCI image, turning 'what may this agent do' from a runtime reconstruction into a diffable artifact.

As AI agents shift from single-turn chatbots to persistent production workloads, a new infrastructure layer is emerging to manage governance, identity, and execution.

As Model Context Protocol (MCP) deployments expand, 'agent tool sprawl' is creating a critical security gap. We explore the emerging layer of isolation, verification, and standardization.

Five enterprise vendors shipped near-identical three-layer agent governance stacks built on MCP, clustered most densely between August 31 and September 8, 2026. The open question is whether bundled governance is plumbing or a moat.

NIST's April 2026 concept note for an AI RMF profile on critical infrastructure imports the vocabulary of functional safety, deterministic behavior, graceful degradation, and fail-safe operation into a framework built for probabilistic systems. Here is what that collision means for OT and ICS operators.

Agentic AI is deploying faster than anyone can govern it. The missing layer is not the model but the control plane around it, and the MCP CVE wave shows what happens when write access ships before that layer exists.

NIST's Center for AI Standards and Innovation launched the AI Agent Standards Initiative in February 2026, the first federal program targeting autonomous-agent governance. Here is what it signals, the compliance gap it exposes, and how organizations should prepare before voluntary guidance hardens into procurement and audit requirements.

An agent is a loop whose branches are decided at runtime by the model, which a fixed control catalog like CMMC cannot enumerate. Access Control and Audit and Accountability break first. The emerging fix moves authorization outside the loop and makes the execution trace the audit artifact.

Three years of LLM security were spent on the input. The next boundary is proving what an agent did after the prompt left the model, which means turning execution traces into audit trails that are complete, tamper-evident, and portable across vendors.

Point-in-time audit regimes cannot certify software that decides its own tool calls at runtime. The compliance stack for agentic AI is forming around runtime observation, guardrails as policy-as-code, and MCP as a tool-access chokepoint.