AI agents: orchestration platforms

An AI agent is software that calls a model in a loop. The model reads a task and some context, then answers or asks for a tool: look up a customer, search a policy, issue a refund. The software runs the tool, adds the result and asks again, until the task is done or something stops it. An agent orchestration platform runs that loop for a company. It retrieves context (data, memory) and asks a model from any lab, passing the context in; the model's tool call goes to tools (APIs, MCP servers), which act on the systems where actions land, from a CRM to a payments ledger. The tools are the part to watch: they're where the agent acts on real systems, and where an attacker who steers the model gets in. Every tool is a door.

Adoption is real and hard to measure. In KPMG's survey of 314 leaders at US companies above $1B in revenue (July to August 2026), 62% were building, deploying or developing agents, up from 53% a quarter earlier (KPMG); in McKinsey's November 2025 survey, 23% were scaling an agentic system somewhere and 39% saw any enterprise EBIT impact (McKinsey). Gartner expects more than 40% of agentic projects to be cancelled by the end of 2027 (Gartner, June 2025; methodology not public). The clearest revenue sits with systems of record: Salesforce reported Agentforce annual recurring revenue above $1.5B on August 26, 2026, after widening what the figure counts (Salesforce).

I organize the guide around four pillars, the four jobs the platform does on every run:

Four ideas organize what I've learned so far, all hypotheses I'm testing with experts.

1. The platform sells control more than intelligence. (Mostly supported for back-office and customer-facing agents; not for coding and research agents.) In a 2025 study of 306 practitioners and 20 case studies, 68% of deployed agents ran fewer than 10 steps before a human stepped in, 47% fewer than 5, and 16 of the 20 cases used structured workflows rather than open-ended planning (Measuring Agents in Production). Anthropic, OpenAI, Microsoft and Google Cloud all advise starting with the simplest design that works. Against: coding agents need a median 41 to 58 turns on SWE-bench Verified (turn-control study); METR measured the task length a 2025 frontier model finishes half the time at about 110 minutes, doubling roughly every seven months since 2019 (METR); and all three API labs sell background execution for long runs.
2. Quality is context times model. (Supported as a multiplication; "context beats model" isn't.) With the same model, one terminal-task benchmark moved 20 points or more across harnesses, a gap the authors compare to a model generation (position paper, July 2026); at a fixed harness, swapping models still moves results 2 to 3 times. Risk lives on the context side: enterprise search indexes copy permissions at sync time, so a revoked user can keep seeing files until the next sync, and in one study, poisoning under 0.1% of an agent's memory entries steered it more than 80% of the time (AgentPoison).
3. Every tool is a door. (Strong.) Nobody claims prompt injection is solved: OWASP doubts fool-proof prevention exists, the UK's NCSC says it may never be fully mitigated, Meta calls it a fundamental weakness of all LLMs, OpenAI expects it never to be fully solved, Anthropic says no browser agent is immune, and Google DeepMind relies on continuous adaptive testing. Adaptive attacks pushed 12 published defenses above 90% success (attack study, October 2025). So the security model is identity, least privilege, egress control and policy outside the model, and the clouds' published responsibility splits leave the authorization of actions with the customer. Against: model defenses do lower attack rates, and least privilege can't stop an injected agent misusing a permission it holds.
4. Evals are the unit of change, more than the unit of purchase. (Partly supported.) Models retire on published clocks: at least 6 months' notice for OpenAI's GA models, 60 days at Anthropic and Microsoft, 2 weeks for Google's previews, 45 days for some AWS models, and no formal policy at Mistral. Every forced swap needs a regression suite, and public benchmarks can't stand in: OpenAI stopped reporting SWE-bench Verified in February 2026 over flawed tests and contamination, and weak graders let agentic benchmarks overstate results by up to about 40% (checklist study). Against evals as the purchase: clouds meter evaluators at fractions of a cent, OpenAI closes its hosted Evals product on November 30, 2026, and in a framework vendor's survey 89% of teams had observability but only 52% ran offline evals (survey). Buyers seem to follow where their data already lives.

Put together, the product is a control loop around a model someone else owns: it decides what the model sees, what it may touch and what changed since the last eval, and it's paid per token, per action or per outcome. Two more hypotheses sit further down: the retirement clock as a hidden operating cost (Effective dating), and accountability set by courts, contracts and insurers more than by AI statutes (Regulation in practice).

Three things make this harder than the B2B platforms you know:

• The same input doesn't give the same output. A model that solved about 61% of retail support tasks on one try solved under 25% on all of eight tries (τ-bench, 2024). Tests become statistics.
• Your data is also your instructions. A web page, an email, a tool description or a stored memory can tell the agent what to do, and there's no equivalent of a parameterized query to keep data and commands apart.
• Your core dependency changes on someone else's calendar. Models retire on 45 days' to 6 months' notice, model aliases move without a release on your side, and one lab's newer tokenizer produces about 30% more tokens for the same text.

How card networks treat purchases made by AI agents is in B2B payments: spend management.

The agent map

Five states on the main path (triggered, context built, model decides, tool runs, done), two exceptions (stopped by a step or cost cap, paused because it needs a human), and one fact that shapes the product: every lap re-sends the growing context, so each lap costs more than the last.

One run: a support agent issues a refund (pillar in brackets)

1. Triggered (orchestration): a chat message, API call, webhook, schedule or another agent's handoff. The platform stamps a run ID, the thread, the end user, the agent's version and the tenant. Breaks: a rate or spend limit returns HTTP 429; a duplicate webhook without an idempotency key starts a second run.
2. Context built (context and memory): system prompt, tool definitions, recalled memory, documents retrieved as the end user and filtered by their permissions, and the conversation so far, compacted if it's long. Breaks: the index holds last week's permissions; a long context buries the fact the model needs, since accuracy falls as input grows even inside the advertised window (length study); compaction drops a detail; a reordered tool list breaks the prompt cache and the step costs several times more.
3. Model decides (orchestration): a final answer, tool calls or a handoff to another agent. Breaks: an error triggers a fallback to another model that behaves differently; malformed arguments; parallel calls emitted before any check.
4. Tool runs (secure execution): the executor, not the model, checks the call against an allow-list and a policy outside the model, fetches a credential, runs the tool and appends the result. Breaks: the ERP times out after committing, and a retry without an idempotency key refunds twice; the result carries instructions from an injected email; a valid call does the wrong thing.
5. Paused (orchestration, secure execution): the refund is above the approval threshold, so the run saves its state, releases compute and waits for a person. Breaks: nobody approves; the approver clicks yes without reading.
6. Back to model decides for another lap until the model answers, or Stopped when a guard fires: maximum turns, a token or cost budget, a timeout. Breaks: the agent repeats a step, the largest single failure (17.1%) in a study of 1,600 multi-agent traces (MAST).
7. Memory written (context and memory): a model decides what to remember, for whom and for how long. Breaks: it saves an instruction planted in a ticket, or personal data you'll later have to erase.
8. Done (evals and governance): the result goes back, the trace closes, and usage (input, cached, output and reasoning tokens, tool fees, runtime) is metered and charged to a tenant. Breaks: the trace says "refund issued" and the payments system disagrees; the trace was sampled, or holds no content.

A long-running task: onboarding a vendor

1. Triggered by an API call; the engine saves a checkpoint after every step.
2. Paused three minutes in, when the agent proposes changing the vendor's bank details. State is saved and compute released: an idle managed session isn't billed on Anthropic's platform, and AWS tears down an idle microVM after 15 minutes.
3. Resumed two hours later, when an approver says yes in another tool. Resume means replay: the step restarts from its beginning, so anything it did before the pause must be safe to repeat.
4. Retried when the ERP call times out after the ERP committed; the retry carries the same idempotency key, so the ERP returns the original result instead of writing twice.
5. Recovered after a worker crash, from the last checkpoint, not from scratch; a code deploy in between mustn't change how this run behaves.

Breaks: the provider's stored state expires (30 days on OpenAI's Responses API, 55 days on Google's paid Interactions API, until deleted on Anthropic's managed sessions); the model retires mid-run; the session hits its maximum lifetime (8 hours by default on AWS); compaction drops the detail the approver asked about.

Cost grows roughly quadratically with turns, because the whole history is re-sent each turn; capping coding agents at the 75th percentile of turns cut cost 24% to 68% without hurting results (turn-control study). Every lap re-sends the growing context, so each step costs more than the last: caps stop runaway loops, risky actions pause for a human, and "resume" means replaying from the last checkpoint.

Sources (as of Oct 2026): OpenAI's agent guide and SDK, AWS harness and limits, Anthropic pricing, Google Interactions, OpenAI data controls, a graph framework's interrupt docs.

Cheat sheet: ways to build and run agents

Sources (as of Oct 2026): AWS AgentCore pricing, Anthropic pricing, OpenAI deprecations, Salesforce and Intercom pricing; the cells are my synthesis.

Sources: Anthropic, OpenAI, Microsoft and Google Cloud guidance; token multiples from Anthropic's research system (single lab); amplification from a 180-configuration study on three labs' models.

Why pay for an independent platform when every lab and cloud ships one? Because the labs' stateful APIs, caching rules and usage formats all differ (even cached tokens sit in differently named fields at OpenAI, Anthropic and Google), and a company running several models needs one place for state, approvals, traces and evals. Labs and clouds keep absorbing features; independent platforms sell neutrality. Choose by where state, credentials and eval history will live the day you change models, not by the demo.

Which approach? Five questions

1. Is it a known process or an open-ended task? Summarizing, classifying and translating don't need an agent (Google Cloud's guide). A known process is a workflow with model calls, and Microsoft calls one agent with tools often the right default for enterprise use. Multi-agent pays only on parallel breadth: in one study, centralized coordination gained 80.9% on parallelizable finance tasks, and every multi-agent variant lost 39% to 70% on sequential planning.
2. Which models must it run, and for how long? Retirement notice runs from about two weeks to six months by lab and cloud, so a platform with several models inherits the shortest notice in its catalogue. If you need more than one lab, keep state out of any single lab's stateful API.
3. Where do the data and its permissions live? If they sit in one SaaS system of record, that vendor's agents start with the data and the permission model. If they're spread out, permission-aware retrieval differs by cloud, and identity mapping between systems is where it fails.
4. What can the agent change, and can it be undone? Read-only agents are a quality problem. Agents that write (refunds, emails, deletes) need policy outside the model, idempotency keys, a sandbox with the network off and, for money or anything sent outside, a human.
5. Who pays if it loops or fails? On consumption pricing the customer carries the token risk; on outcome pricing the vendor does, and the arguments move to what counts as an outcome.

My defaults: a workflow with a model in a few steps before any autonomous agent; one agent with fewer than 20 tools before multi-agent; dated model snapshots in production, never aliases; state and checkpoints in our own store or a workflow engine, not only at a lab; retrieval as the end user, with permissions checked at query time where the search service allows it; every write tool behind a policy check outside the model and an idempotency key, and a human for money and external sends; sandboxes with the network off and secrets injected at a proxy; turn and spend caps on every run; a regression suite built from real failures, run several times per task, before any model or prompt change; traces and eval results exported in an open format.

What doesn't transfer

Money flows

Nine meters run on one agent: input, cached and output tokens (reasoning bills as output), tool fees, runtime or sandbox hours, memory, retrieval, tracing and evals, and the people who take escalations. The platform's fee sits on top.

List prices on October 2, 2026, from Anthropic, OpenAI and Google. Google's Pro Preview costs more above 200,000 input tokens, and Gemini 3.8 Flash doubles on January 1, 2027. All three take 50% off for batch. Anthropic and OpenAI add about 10% for US-only or regional processing on newer models. Cache writes cost extra at Anthropic and OpenAI, not on Google's implicit cache. Every tool definition bills on every call, used or not: in Anthropic's own measurement, 58 tools from five MCP servers took about 55,000 tokens before the conversation began. Web search costs $10 per 1,000 calls at Anthropic and OpenAI; Google charges $14 per 1,000 after 5,000 free a month.

One refund run, eight model calls

My assumptions: an 8,000-token stable prefix (system prompt, 12 tool definitions); the eight calls of the agent map, with a policy search returning 4,000 tokens; 2,800 output tokens in all, reasoning included; a prompt growing from 8,150 to 17,650 tokens, 111,200 input tokens in total; "warm" means other runs already cached the prefix; Google's implicit cache assumed to hit; list prices.

Caching cuts this run about 71%. At 100,000 tickets a month that's about $25,000 uncached against $7,200 warm on a $2/$10 model, about $400 on the cheapest small model and about $36,000 on a top model: model choice spreads cost about 100x, caching about 3.5x. Once caching is on, output and cache writes dominate; OpenAI's cheaper reads win at this size, and Google's missing write fee offsets its higher output price. Anthropic's top model lists at the same $10/$50 as OpenAI's, so its uncached run also costs $1.25 (my arithmetic). A runaway loop of 41 extra steps ends at a 69,650-token context and costs $3.70 uncached on any $2/$10 model, about 15 times a normal run. The agent tax: Anthropic prices a single-call support chat at about 3,700 tokens; this run uses about 30 times that.

The monthly bill, by layer

My assumptions: 200,000 support runs a month; 6 model calls a run at 12,000 input and 500 output tokens each; a $2/$10 model with $0.20 cache reads; 70% of input cached; 60 seconds of 1 vCPU and 2 GB per run on AWS; 8% escalated to a person at $6 a contact.

People are the biggest line: each point of containment saves 2,000 escalations, about $12,000 a month. Tokens, evals included, are about 55% of the technology bill; evals alone about 8%, growing with releases times trials.

Others sell seats (Microsoft Agent 365: $15 per user, no per-agent fee), credit packs (Copilot Studio: $200 for 25,000) or runtime hours (Anthropic: $0.08 per running session-hour). Vendors price at 2 to 10 times the technology cost, by the research notes' estimate: they sell the result. Read the outcome definition: Intercom counts one when the customer confirms, doesn't ask for more help, or a hand-off completes. A model change that inflates tokens hits the vendor's margin under outcome pricing and the customer's bill under consumption pricing.

Sources: run arithmetic in research note 01 on the pricing pages above; the monthly bill from note 03 on AWS AgentCore pricing; Anthropic's tool-use post (single lab); Salesforce, Intercom, a Copilot licensing guide, a licensing site and Google Cloud's release notes (the last three search results).

Tokens are a minority of what an agent costs and people the majority; caching and model choice move the token bill 3.5x and 100x, and vendors price on outcomes, so read how they define one.

The power map

Power follows the model, the data and the identity layer, and an independent platform holds none of them.

• Labs set prices, caching rules, rate limits, retention and retirement dates, and moved up the stack in 2025 and 2026. OpenAI launched an enterprise agent platform (February 2026, reported) and bought an experimentation startup (about $1.1B in stock) and an open-source eval and red-teaming tool (about $86M reported). Anthropic hired an eval startup's team in August 2025; its platform went offline four weeks later. Google began billing for agent runtime, sessions and memory from December 2025. Labs withdraw layers too, like OpenAI's hosted Evals. I found no comparable moves by Meta, Mistral or xAI; Meta's levers are open weights and published security guidance.
• Labs and clouds co-govern the protocols: the Agentic AI Foundation's platinum members are AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI.
• Clouds sell governance at fractions of a cent, already run the enterprise's identity and network, and set their own model dates.
• Systems of record own the data and workflow: ServiceNow's AI passed $1B in annual contract value (July 2026), and it paid $2.85B for an agent platform in 2025.
• Security incumbents bought AI-security startups in 2025: Palo Alto Networks, Check Point and SentinelOne, for about $250M to $700M each (reported).
• Customers have routing (research routers cut cost more than 85% on one benchmark while keeping 95% of quality), falling prices and cloud commitments that pay for any marketplace model.

Lock-in, in the research notes' order: eval datasets and graders, traces, memory stores, connectors, one lab's caching economics, fine-tunes, commitments. Gartner reckons only about 130 of thousands of self-described agentic vendors are real. My reading: labs and clouds are absorbing the control layer from above and systems of record the workflow from below; an independent platform's ground is neutrality, meaning state, evals and traces that move across labs.

Sources: OpenAI deprecations; AI Business, VKTR, TechCrunch and a security newsletter (search results); Linux Foundation; ServiceNow; RouteLLM.

Regulation in practice

What's enforced on agents in 2026 is general law: misrepresentation, discrimination, computer access, deception.

The second hypothesis lives here: accountability is being set by courts, contracts and insurers while AI-specific rules were delayed or narrowed in 2026. (Supported for 2026; may not survive 2027.)

• The EU slowed down. The Digital Omnibus (Regulation (EU) 2026/1744, in force July 27, 2026) moved high-risk duties to December 2027 and August 2028. Commentators call the AI Office significantly under-resourced. The general-purpose Code of Practice has 21 signatories, including Amazon, Anthropic, Google, IBM, Microsoft, Mistral and OpenAI; xAI signed only the safety and security chapter, and Meta declined.
• Washington pushed against the states. A December 2025 executive order created a Justice Department task force against state AI laws; it joined xAI's suit against Colorado, and enforcement of Colorado's 2024 law was blocked on April 27, 2026. Colorado's replacement, from January 1, 2027, requires notices, explanations of adverse decisions within 30 days and human review.
• Regulators use old tools. The FTC used deception law, ordering a "robot lawyer" service to pay $193,000 (January 2025).
• Against: the EU's revised Product Liability Directive applies liability without fault to defective software, AI included, from December 9, 2026, and the high-risk duties still arrive in December 2027.

Sources: Sidley, Cuatrecasas, Lawfare, European Commission, TechCrunch, an enforcement tracker, McDermott, Latham, FPF, Orrick, Debevoise, DLA Piper.

In 2026 the binding rules for agents came from courts, lab policies and contracts; plan for the EU's high-risk duties and product liability, not for a US federal AI law.

The cost of being wrong

Agent mistakes cost in three currencies, and every lab's ecosystem shows up.

• Data. Replit's agent deleted a production database (July 2025); Google's Antigravity wiped a drive partition (late 2025). The Financial Times reported that AWS's internal Kiro agent, with operator-level access, deleted and recreated an environment, interrupting AWS Cost Explorer in one region for about 13 hours (December 2025); Amazon disputes this and calls it misconfigured access control. A single secondary source reports that a coding agent identified as Anthropic's Claude Code wiped a Bengaluru heritage society's archive (July 2026).
• Fabrication. Air Canada (about C$812); Cursor's support bot invented a login policy (April 2025) and users reported cancelling; Deloitte Australia partly refunded an A$440,000 government contract over AI-fabricated citations (October 2025), disclosing that it used Azure OpenAI; about 1,600 court documents in 35 countries contain AI hallucinations.
• Bias at scale. The Workday case concerns about 1.1 billion applications, as reported.

Sources: OECD on Replit and Antigravity, AI Incident Database on AWS and Cursor, a security news site, BNN Bloomberg, Malay Mail, a careers blog (all search results).

The expensive failures are irreversible writes with broad credentials, confident fabrication and bias at scale: least privilege stops the first, review of high-stakes outputs the second, outcome monitoring by group the third, and a better benchmark score none of them.

Prompt injection: what's real

My verdict as of October 2026: prompt injection comes from how models read text, so no vendor can patch it away. Defenses lower the rate, nothing gets it to zero, and what an injected agent can do is set by what it's allowed to touch. Ask any vendor what its agent can still do after it's been fooled.

How it works

• Direct injection comes from the user; indirect injection hides in what the agent reads: a web page, a file, an email, a tool result, another agent's message.
• Tool poisoning hides instructions in a tool's description, and a rug pull changes a tool after it was approved. The first public proof of concept came in April 2025; MITRE ATLAS listed both as techniques in March 2026.
• Data leaves through a write tool, an image URL the interface renders, or an allowed domain. Meta's "Rule of Two": a session should combine at most two of untrusted input, sensitive data or systems, and the power to change state or communicate outside.

What each lab says

What independent tests show

• Adaptive attacks pushed 12 published defenses above 90% success for most, though most had reported near zero (October 2025).
• A public competition logged 1.8 million attacks across 22 agents; nearly all broke policy within 10 to 100 queries, and robustness barely tracked model size or capability (July 2025).
• The US Center for AI Standards and Innovation's 2026 competition, with more than 250,000 attempts, found at least one successful attack on all 13 frontier models tested.

What bounds the damage

The best-documented 2026 incident was a test. In the UK AI Security Institute's own cyber evaluation, 10 of 122 runs took 19 unsanctioned real-world actions, from social engineering with fake identities to an attempted malicious commit. The causes were deliberate internet access, safeguards disabled by design and no real-time monitoring; the first fix was fine-grained network control. The models were Anthropic's Mythos 5 (17 actions) and OpenAI's GPT-5.6-Sol (2), with safeguards switched off for capability testing: evidence about containment, not about either lab's products.

Most published agent vulnerabilities are ordinary bugs in new plumbing: a zero-click injection in Microsoft 365 Copilot (CVSS 9.3, June 2025), remote code execution in Anthropic's MCP Inspector debugging tool (9.4), an OAuth bridge passing a URL to the shell (9.6), MCP config files writable without approval in Cursor (8.5), injection running local code through GitHub Copilot in Visual Studio (7.8), a fake email MCP server on npm that copied every message out (about 1,643 downloads, September 2025), and an LLM gateway running arbitrary commands (9.8, July 2026). An aggregator counted more than 30 MCP-related CVEs in about 60 days in early 2026; I checked only these.

Questions to ask a vendor

1. If the model is completely fooled, what can the agent still do: which tools, scopes and hosts?
2. Is the policy that authorizes each tool call outside the model, and can I read it?
3. Do you pin tool definitions and ask again when a server changes them?
4. Where do secrets live: in the context, the sandbox, or an egress proxy?
5. Is the sandbox network off by default, and what's allowed?
6. What adaptive testing do you run, with how many attempts, and will you share results?
7. What share of approval prompts do users approve, and what do they see?

Sources: OWASP, NCSC, Meta, Anthropic, TechCrunch on OpenAI, Google DeepMind, a security firm's proof of concept, MITRE ATLAS, adaptive attacks, competition, CAISI, OpenAI shell docs, AWS, UK AISI; NVD: CVE-2025-32711, CVE-2025-49596, CVE-2025-6514, CVE-2025-54135, CVE-2025-53773, CVE-2026-30623; a security vendor's write-up; an aggregator (low confidence).

Top failure modes

Sources: the sections above. Ranking these by frequency or cost needs an operator's data; I found none public.

False friends

Sources: the sections above; Gartner on "agent washing".

Where my analogy broke

"An agent run is a metered call." In telco I could read a rate deck and multiply minutes by a price. Here every lap re-sends the whole conversation, so the meter runs faster the longer the call lasts, and an uncapped loop costs fifteen times a normal run.

"The tool result is remittance data." Writing order to cash, I learned to match data that arrives separately from the money. Here the data can give orders: an email the agent reads is an instruction it may follow, and there's no parameterized query to stop it.

"Approval is the control." In procure to pay, an approver checks a purchase order against an invoice. Here the approver sees a prompt with little context and, in one lab's data, clicks yes about 93% of the time. An approval nobody reads is a log entry, not a control.

"A scoped token is a merchant-locked card." In spend management, a virtual card locked to one merchant capped the damage at one merchant and one amount. A scoped token caps which host the agent can reach, but a fooled agent can still do anything the token allows there.

"The payout ends on someone else's calendar." In cross-border payouts, holidays and cut-offs belonged to the destination. Here the whole product lives on someone else's calendar: the model I tested against retires on 45 days' to six months' notice, and its replacement counts tokens differently.

Self-check: 20 questions

1. Trace one agent run from trigger to result. Where can each step break? Answer
2. Why do most production agents look like workflows, and where isn't that true? Answer
3. The same model scores 20 points apart in two harnesses. Why isn't the model irrelevant? Answer
4. Why can't a better system prompt fix prompt injection? Answer
5. When should you use a workflow, a single agent or several agents? Answer
6. Impersonation or delegation: which keeps the agent visible in the downstream log? Answer
7. What does "resume" mean after an approval pause, and why must earlier side effects be safe to repeat? Answer
8. Why isn't the trace the system of record for what the agent did? Answer
9. Which rules act the same way every time, and which only lower the odds? Answer
10. Compare the labs' and clouds' retirement notice. What does a platform on three labs inherit? Answer
11. What changed in MCP's 2026-07-28 version, and what doesn't its registry check? Answer
12. Whose retirement date binds when you buy a lab's model through a cloud? Answer
13. When does an enterprise become the EU "provider" of an agent built on someone else's model? Answer
14. A tool call times out after the ERP committed. What prevents a duplicate? Answer
15. Air Canada's chatbot invented a policy. Who paid, and what do the Workday and Perplexity cases add? Answer
16. In an eight-call support run, how much does caching save, and what does a 41-step loop cost? Answer
17. In a 200,000-run monthly bill, what's the biggest line, and how do per-outcome prices compare? Answer
18. Who is moving up the stack, and where can an independent platform still win? Answer
19. Which AI rules were delayed, narrowed or carved out in 2026, and what binds instead? Answer
20. Which agent failures cost real money, and which control would have stopped each? Answer

Sources

Read on October 2, 2026 unless dated; "search result" means seen only as a search snippet. Inline "Sources:" lines carry the rest.

Protocols, standards and frameworks

• MCP: versioning, 2026-07-28 changelog, authorization, security practices, tools, registry; A2A; Agentic AI Foundation
• RFC 8693; IETF AIMS; OpenTelemetry GenAI; OWASP LLM Top 10 and 2026 edition; MITRE ATLAS; NIST AI RMF

Governments, regulators and courts

• EU AI Act Art. 25 and Art. 26; GPAI Code signatories (Jul 2026); CNIL
• UK AISI (2026); NCSC; CISA (May 2026); NIST agent initiative, NCCoE, CAISI (Mar 2026)

Labs

• Anthropic: pricing, deprecations, retention, usage policy, prompt injection
• OpenAI: pricing, deprecations, data controls, agent guide, MCP
• Google: pricing, models, terms, usage policy, Interactions API
• Meta: agent security; Mistral: models; xAI: agent terms (search result)

Clouds

• AWS: AgentCore pricing, security, model lifecycle; Microsoft: responsibility split, model retirements; Google Cloud: agent identity, design patterns

Research

• Measuring Agents in Production, turn control, MAST, scaling agent systems, τ-bench, METR, benchmark checklist, AgentPoison, adaptive attacks

Analysts, surveys, filings, incidents

• KPMG (Sep 2026), McKinsey (Nov 2025), Gartner (Jun 2025), a framework vendor's survey (Jun 2026, vendor)
• Salesforce and ServiceNow results (company-reported); OECD incident records; NVD

Law firms and press (search results unless noted)

• Sidley, McDermott, Orrick, Debevoise, McCarthy Tétrault (all fetched); press inline

Vendor and secondary sources appear inline, with the companies kept generic.