{
  "_meta": {
    "publication": "Agent Techniques Weekly",
    "schemaVersion": "2026.05.02",
    "generatedAt": "2026-09-12T20:35:37.894Z",
    "canonicalUrl": "https://brianletort.ai/industry/agents/2026-W37",
    "markdownUrl": "https://brianletort.ai/industry/agents/2026-W37/llm.md",
    "sourceFile": "src/data/industry/agents/2026-W37.ts"
  },
  "issue": {
    "slug": "2026-W37",
    "isoYear": 2026,
    "isoWeek": 37,
    "issueNumber": 21,
    "publishedAt": "2026-09-12",
    "cadence": "weekly",
    "periodLabel": "Week 37 of 2026",
    "bigRead": {
      "headline": "Three vendors shifted agent work beyond the session, but only two disclose delegation architecture",
      "body": "Inside four days, Atlassian, Cursor and Salesforce independently shipped loops that hold a goal across sessions rather than inside one. The session is no longer the unit of agent work. The convergence is narrower than it looks: Atlassian and Cursor both describe a coordinator that decomposes work and delegates it to subagents, while what Salesforce documents is cross-session memory, durable execution and dynamic steering, which is persistent goal-holding without a published delegation architecture. Read the shared property as durable execution, not as three vendors shipping the same internal structure. That convergence is the week's headline, and it is the less useful half of the story.\n\nThe useful half is that the two most fully described loops differ in exactly one respect, and it is the respect that determines how much autonomy either can safely be given. Atlassian declares its acceptance criteria before the work starts, as organisational standards defined once and mapped to repositories, and enforces them through a separate review agent that checks every change before a human sees it. Cursor discovers its criteria after the fact: its coordinator adds a lint rule whenever it sees the same mistake twice, converting a repeated human correction into a deterministic machine check. Both are real techniques. Only one of them has a verifier that the implementing agent did not write.\n\nThat is the transferable lesson, and it is why the week's least glamorous release is its most durable. On September 9 GitHub made enterprise-managed agent permissions generally available with one property that no other agent control shipped this week has: a managed restriction cannot be weakened by user settings, workspace settings, auto-approval, or a previously saved approval. That closes the bypass every real deployment actually hits, where a developer clicks always-allow once and quietly degrades the control for good. An agent policy that survives the developer's own override is the difference between a control you can evidence in an audit and a control that depends on discipline.\n\nRead against the capability releases, the ordering is clear. OpenAI will now rent you its agent loop, and states in its own documentation that the managed service is US-residency-only and does not support zero data retention even on a self-hosted sandbox, which disqualifies it for regulated production regardless of how good the harness is. Atlassian published the most complete anatomy of a governed loop available anywhere and put almost all of it in private early access. Cursor published the strongest-sounding productivity numbers of the week and the weakest evidence behind them. The capability is ahead of the controls, the controls are ahead of the proof, and the proof is mostly a vendor measuring itself."
    },
    "technique": {
      "name": "The verifier the implementing agent did not write",
      "mode": "automate",
      "summary": "Run agent work as a continuous loop whose acceptance criteria are declared before the work begins and checked by a separate agent that did not produce the work, with a permission floor the operator cannot weaken and a human holding the final merge. The loop's autonomy is bounded by the independence of its verifier, not by the capability of its implementer.",
      "whyItMatters": "Every published agent loop this week could delegate, persist and parallelise. What separated them was whether anything independent checked the output before a human did. A loop whose criteria are discovered after the fact scales the volume of work a human must review; a loop whose criteria are declared in advance and enforced by a separate checker scales the work a human can safely not review. That is the difference between moving the bottleneck and removing it, and it is implementable on any stack today because the expensive part is the declared criteria, not the model.",
      "anatomy": [
        {
          "label": "Trigger",
          "detail": "Wake on a signal rather than a prompt, and admit only work that has already passed a human definition-of-ready gate. Atlassian's loop continuously scans for well-defined unassigned items, where the qualifier carries the weight: it bounds agent scope without a policy engine. Cursor wakes on a watched channel, a schedule, or all open changes. GitHub shipped the same trigger primitive the same week as hourly, daily or weekly scheduled agent tasks in public preview, which suggests convergence rather than one vendor's idea."
        },
        {
          "label": "Context",
          "detail": "Grant context and govern context through the same mechanism. Atlassian pairs multi-repository grounding with controls letting a platform team decide which agents operate in a space and precisely what each may see. Cursor syncs a shared file set across every cloud and local machine so learnings accumulate instead of each task re-onboarding an agent. The design property worth copying is that the thing which supplies context is also the thing which limits it."
        },
        {
          "label": "Tools",
          "detail": "Delegate execution to subagents in isolated environments, and keep the coordinator out of the work. Cursor's coordinator writes no code at all: it plans, delegates and returns finished work, which is why it is never blocked and stays steerable mid-flight. Implementation agents each get a clean copy of the project on their own machine, with a local agent spun up only when something must be tested on the developer's own hardware."
        },
        {
          "label": "Verifier",
          "detail": "This is the load-bearing component and the one most loops omit. Declare the criteria before the work starts as standards mapped to the repositories they govern, so they are not negotiable by the agent that will be measured against them. Then have a separate agent check every change against those standards before a human sees it. An escalating-trust review schedule is not a verifier, it is a human attention budget. Where you cannot declare criteria up front, adopt Cursor's ratchet: whenever the same mistake appears twice, convert the correction into a deterministic check so the next agent cannot repeat it."
        },
        {
          "label": "Permission floor",
          "detail": "Set a policy the operator cannot relax. GitHub's managed permissions define three states per operation, blocked, requires approval, or proceeds, across shell commands, file reads and edits, and network domains, and state that managed restrictions cannot be weakened by user settings, workspace settings, auto-approval, or previously saved approvals. Demand override-resistance explicitly from every other agent vendor, because a policy a developer can turn off is not a control you can evidence."
        },
        {
          "label": "Escalation",
          "detail": "The human keeps the merge button and nothing ships without approval, but the human stops being the bottleneck for everything leading up to it. Borrow PolyAI's refusal set as the contractual floor for any self-modifying agent: it will not guess a business answer, will not act when the fault lies in an integration it does not own, will not claim a test it did not run, and will not ship a change without attached proof."
        },
        {
          "label": "Instrumentation",
          "detail": "The loop must report on itself or you cannot price it. Atlassian pairs the loop with measurement of throughput, quality, adoption and cost including external tool-server tracking; GitHub made agent usage metrics generally available over one-day and 28-day windows; Anthropic's session reports surface cost and friction and flag repeated patterns worth packaging as shared skills, which turns reusability into an observability output rather than a governance programme."
        }
      ],
      "examples": [
        "Atlassian governed agent loops: standards declared once, a separate review agent checking every change before a human, loop core in private early access",
        "Cursor Projects: a non-executing coordinator delegating to subagents, with criteria discovered after the fact and encoded as lint rules",
        "GitHub enterprise managed permissions plus scheduled agent automations: an override-resistant permission floor under unattended recurring work",
        "PolyAI Wren: a self-modifying agent constrained by an explicit refusal set, including a refusal to claim a test it did not run"
      ],
      "source": "Atlassian, Cursor, GitHub, PolyAI",
      "sourceUrl": "https://www.atlassian.com/blog/jira/governed-agent-loops"
    },
    "agentCapabilities": [
      {
        "vendor": "Cursor",
        "product": "Projects",
        "mode": "build",
        "date": "2026-09-10",
        "capability": "A coordinator agent that is structurally forbidden from writing code, running on its own cloud machine so it survives a closed laptop, delegating to subagents on isolated machines and waking on a watched channel, a schedule, or all open changes rather than on a prompt.",
        "meaning": "This is the cleanest published separation of planning from execution in an agent loop, and it produces a real organisational question rather than a tooling one: whether a coordinator should own a migration or a maintenance backlog end to end. The honest answer depends on whether review capacity rather than agent capacity is your actual bottleneck, because a loop projected to touch twenty to a hundred changes a day does not reduce review load, it concentrates it. Beta, with pricing and compute-cost treatment undisclosed.",
        "source": "Cursor",
        "sourceUrl": "https://cursor.com/blog/projects"
      },
      {
        "vendor": "Atlassian",
        "product": "Governed agent loops",
        "mode": "automate",
        "date": "2026-09-10",
        "capability": "An always-on loop that scans for well-defined unassigned work, delegates execution and testing in parallel, and returns ready-to-review changes, with organisational standards declared once and mapped to repositories and a separate review agent checking every change against them before a human sees it.",
        "meaning": "This is the most complete anatomy of a governed agent loop any vendor has published, with the components named as separable parts rather than bundled into an opaque product, which makes it useful as a reference architecture even to teams that will never buy it. The availability is the catch and it is severe: the loop core, the standards and the review agent are all in private early access, with only multi-repository context in open beta, so treating any of it as available in a 2026 plan would be a mistake.",
        "source": "Atlassian",
        "sourceUrl": "https://www.atlassian.com/blog/jira/governed-agent-loops"
      },
      {
        "vendor": "OpenAI",
        "product": "Agents API",
        "mode": "build",
        "date": "2026-09-10",
        "capability": "The harness behind OpenAI's coding product offered as a managed service in public beta, with OpenAI running sessions, orchestration, context compaction and recovery while the developer supplies tools and chooses whether code executes in an OpenAI sandbox, their own virtual private cloud, or one of nine named partners.",
        "meaning": "An enterprise can now rent an agent loop instead of maintaining one, and the harness is open source so the loop logic is inspectable even though the managed instance is not modifiable. The disqualifying detail is in OpenAI's own documentation: US data residency only, no support for zero data retention, and choosing a self-hosted sandbox does not make it eligible. For a regulated workload that ends the evaluation regardless of harness quality, which makes this a developer-velocity decision today and not a production one.",
        "source": "OpenAI Developer Docs",
        "sourceUrl": "https://developers.openai.com/api/docs/guides/agents-api/overview"
      },
      {
        "vendor": "GitHub",
        "product": "Enterprise managed permissions for agent operations",
        "mode": "automate",
        "date": "2026-09-09",
        "capability": "Centrally administered permissions defining, per operation, whether it is blocked, requires human approval, or proceeds without a prompt, across shell commands, file reads and edits, and network domains, with managed restrictions that cannot be weakened by user settings, workspace settings, auto-approval, or previously saved approvals.",
        "meaning": "Override-resistance is the property that separates an agent policy you can evidence in an audit from one that depends on developer discipline, and this is the only control shipped this week that has it. It closes the bypass every real deployment hits, where one always-allow click permanently degrades a restriction. It is also independently verifiable by any administrator in their own tenant, which puts it on stronger evidential footing than any outcome percentage published in the window.",
        "source": "GitHub Changelog",
        "sourceUrl": "https://github.blog/changelog/2026-09-09-enterprise-managed-permissions-for-github-copilot-agent-operations/"
      },
      {
        "vendor": "PolyAI",
        "product": "Wren",
        "mode": "automate",
        "date": "2026-09-09",
        "capability": "An agent whose job is to improve other agents: it reads every conversation the customer's dialog agents have, drafts changes, tests them, and reports whether the chosen metric moved, running repair and improvement motions side by side with a single approve-or-dismiss card as the operator interface.",
        "meaning": "The durable contribution is the refusal set rather than the uplift percentages. It will not guess a business answer, will not modify the agent when the fault is an integration it does not own, will not claim a test it did not run, and will not ship without attached proof. Those four properties decide whether a self-modifying agent is auditable at all, and they are cheap to demand contractually from any vendor. One named customer's headline uplift rests on a 24-hour window with no control, which the vendor itself qualifies.",
        "source": "PolyAI",
        "sourceUrl": "https://poly.ai/blog/wren-agent-improves-dialog-agents"
      },
      {
        "vendor": "GitHub",
        "product": "Scheduled agent automations and usage metrics",
        "mode": "automate",
        "date": "2026-09-10",
        "capability": "Recurring agent tasks schedulable hourly, daily or weekly or run on demand in public preview, alongside agent usage metrics made generally available in enterprise and organisation reports over one-day and 28-day periods, plus adaptive model orchestration in the command-line tool.",
        "meaning": "Running unattended agent work and measuring it now live in the same tool, which is the precondition for treating agent spend as a managed cost rather than an experiment. The same release deprecated a model across chat, inline edits, ask and agent modes on the same day, with a replacement administrators may need to enable. Version the model your automations depend on and test scheduled agents against model changes you do not control, because behaviour can change without you shipping anything.",
        "source": "GitHub Changelog",
        "sourceUrl": "https://github.blog/changelog/label/copilot/"
      }
    ],
    "skillsAndConnectors": [
      {
        "ecosystem": "OpenAI",
        "name": "Agents API managed harness and sandbox partners",
        "type": "harness",
        "date": "2026-09-10",
        "signal": "The harness behind OpenAI's coding product is published as open source and offered as a managed service, with sandboxed command and code execution, skill and instruction application, external tool-server connectivity, mid-flight steering, context summarisation, subtask delegation and session resumption, across nine named third-party execution environments.",
        "why": "This turns the harness from something each team maintains into something a team can rent while still reading the loop logic, which materially lowers the cost of getting a competent agent loop running. Weigh it against two facts: the service supports US residency only and no zero data retention even on a self-hosted sandbox, and no published benchmark shows the managed harness outperforming a well-built custom one. Rent it for velocity, not for compliance.",
        "source": "OpenAI",
        "sourceUrl": "https://openai.com/index/introducing-the-agents-api/"
      },
      {
        "ecosystem": "Anthropic",
        "name": "Smart reports skill-candidate detection",
        "type": "skill",
        "date": "2026-09-10",
        "signal": "Session reporting that analyses how a team uses the assistant and surfaces the work completed, its cost, where sessions hit friction, and specifically which repeated patterns are worth packaging as shared skills, in beta on enterprise plans only.",
        "why": "Skill authorship stops being a platform team's guess and becomes an output of observed usage, which is the cheapest way to make reuse actually happen rather than mandating it. Session-level cost attribution is separately the missing input for anyone trying to justify agent spend to a finance function. Beta, enterprise-only, with no published measure of report accuracy or of the quality of the skills it recommends, so treat the recommendations as a queue to triage rather than a backlog to build.",
        "source": "Anthropic",
        "sourceUrl": "https://support.claude.com/en/articles/12138966-release-notes"
      },
      {
        "ecosystem": "Atlassian",
        "name": "Standards mapped to repositories",
        "type": "template",
        "date": "2026-09-10",
        "signal": "Organisational coding standards defined once and mapped to the repositories they govern, then enforced by a separate review agent that checks every change against them before a human reviewer sees the work, with the criteria fixed before the agent starts rather than negotiated during the task.",
        "why": "This is the single most transferable artifact published this week and it does not require the vendor's product. Declaring acceptance criteria up front and having a checker the implementer did not write is what lets a loop run without proportionally increasing human review, and any team can implement it with existing linters, policy engines and a second model. The gap to note honestly is that the vendor does not say what happens when an agent disagrees with a standard.",
        "source": "Atlassian",
        "sourceUrl": "https://www.atlassian.com/blog/jira/governed-agent-loops"
      },
      {
        "ecosystem": "OpenAI",
        "name": "Permission-inheriting warehouse connectors",
        "type": "connector",
        "date": "2026-09-10",
        "signal": "Enterprise data connectors where administrators choose which connections exist and which roles may use them, and where queries are stated to execute under the connected account's existing permissions including table, row and column level restrictions, delivered as an administrator-gated plugin.",
        "why": "Permission inheritance at row and column granularity is the only control that decides whether a conversational analytics agent is deployable in a regulated environment, which makes this the connector property to demand by name rather than one feature among many. It is currently asserted in documentation and not demonstrated, and it was not confirmable that enforcement holds across every listed connector, so run the cheap test: point it at a table where a named account is row-restricted and confirm the agent sees no more than that account.",
        "source": "OpenAI Help Center",
        "sourceUrl": "https://help.openai.com/en/articles/20001518"
      }
    ],
    "proofOfValue": [
      {
        "actor": "Cursor",
        "workflow": "Coordinator-led feature work, migrations and continuous maintenance",
        "evidence": "vendor_claim",
        "claim": "New users merge 30% more changes, and users who primarily work through Projects merge six times as many, based on several months of internal use including migrations spanning a few hundred changes.",
        "read": "These are the strongest-sounding numbers of the week and the weakest evidenced. They are self-reported internal metrics with no baseline population, no control group, no stated time window, and no definition of a new user or of primarily use. The six-times figure is subject to an obvious selection effect, because engineers who choose to work through a coordinator are plausibly those whose work is highest-volume and most parallelisable in the first place. Treat the direction as plausible and the multiple as unusable in a business case.",
        "source": "Cursor",
        "sourceUrl": "https://cursor.com/blog/projects"
      },
      {
        "actor": "Golden Nugget via PolyAI",
        "workflow": "Applying agent-recommended changes to a production dialog agent",
        "evidence": "customer_case_study",
        "claim": "A named director at a named customer reports a 33% increase in bookings, a 10% increase in resolution rate and a 12% increase in conversion over the previous 24 hours after applying the agent's recommendations.",
        "read": "Named individuals at named customers putting numbers on record is materially stronger than the anonymous vendor aggregates elsewhere in this issue, and it is the only item in the window that reaches that bar. It still falls short of independent measurement on three counts: the observation window is 24 hours, there is no control and no seasonality adjustment, and the measurement is performed by the vendor's own platform. The vendor's own caveat that not every recommendation's impact is this dramatic is the appropriate reading.",
        "source": "PolyAI",
        "sourceUrl": "https://poly.ai/blog/wren-agent-improves-dialog-agents"
      },
      {
        "actor": "Atlassian",
        "workflow": "Grounding agent tools in a shared organisational work graph",
        "evidence": "vendor_claim",
        "claim": "Teams whose AI tools drew the most context from the vendor's work graph shipped roughly 64% more per developer, attributed to an analysis by a measurement product named in the same announcement.",
        "read": "The analysing party is a product line named in the announcement itself, so this is not independent evidence, and no baseline, cohort definition, or method is published. The underlying hypothesis is worth testing because it is testable: if shared context grounding is what drives throughput, the effect should reproduce on any stack that accumulates a durable context store. Run it as an experiment on your own repositories rather than accepting the figure.",
        "source": "Atlassian",
        "sourceUrl": "https://www.atlassian.com/blog/jira/governed-agent-loops"
      },
      {
        "actor": "Anthropic",
        "workflow": "Agentic review of model-evaluation transcripts",
        "evidence": "confirmed",
        "claim": "A review covering approximately 141,000 transcripts missed a set of transcripts with internet access because the scan relied on agentic search, surfacing a fourth previously unreported incident only while material was being assembled for an external evaluator.",
        "read": "This is the most useful proof point of the week and it is a negative one, disclosed by the lab under review about its own tooling. It is direct evidence that agentic search over a large evidence corpus does not provide coverage guarantees, which matters to anyone planning to use an agent for discovery, audit sampling, or control testing. The remedy is cheap and specific: pair any agentic review with a deterministic enumeration of the corpus and reconcile the two counts.",
        "source": "Anthropic",
        "sourceUrl": "https://www.anthropic.com/news/alignment-assessment-cybersecurity-incidents"
      }
    ],
    "enterpriseReadiness": [
      {
        "dimension": "permissioning",
        "note": "Override-resistance is now a shipped, verifiable property and should be a named requirement in every agent evaluation. GitHub's managed permissions state that a restriction cannot be weakened by user settings, workspace settings, auto-approval, or a previously saved approval, which is the only control in the window that survives the one always-allow click that degrades most real deployments. No other agent vendor claimed the property this week; ask each of them directly."
      },
      {
        "dimension": "verification",
        "note": "Insist the checker is not the implementer. Declared standards enforced by a separate review agent before human review is a categorically different control from an escalating-trust review schedule, which is a human attention budget wearing a control's clothing. Where criteria cannot be declared in advance, require the ratchet instead: any correction made twice becomes a deterministic check so the next agent cannot repeat it."
      },
      {
        "dimension": "data_access",
        "note": "Residency and retention still disqualify otherwise-capable harnesses. OpenAI's managed Agents API documents US data residency only and no support for zero data retention, explicitly including the case where the customer self-hosts the execution sandbox. Read the residency and retention statement before the capability list, because for a regulated workload it ends the evaluation and no amount of harness quality compensates."
      },
      {
        "dimension": "auditability",
        "note": "Require an exportable trail and do not accept an agentic scan as coverage. One named customer is already using a self-modifying agent's record of what it reviewed and acted on as compliance evidence, which is the right pattern. In the same week a frontier lab disclosed that agentic search over roughly 141,000 transcripts missed records it should have found, so pair any agent-driven review with deterministic enumeration and reconcile the counts."
      },
      {
        "dimension": "human_approval",
        "note": "Ask which actions execute without a gate, because the highest-blast-radius agents shipped this week did not say. An agentic security platform went globally available able to isolate users, block command-and-control traffic and cut lateral movement, without disclosing which of those require human approval or what the rollback path is on a false positive. For any agent with production authority, the approval matrix and the rollback procedure are the contract terms, not the detection quality."
      },
      {
        "dimension": "reliability",
        "note": "Agent behaviour can change without you shipping anything. In one week a vendor deprecated a model across agent mode the same day it was announced, with a replacement administrators may need to enable, while another announced that its flagship endpoint would silently serve a different, smaller model within days. Pin model versions in automations, monitor for endpoint substitution, and treat vendor-side model changes as a change-management event with a test suite attached."
      },
      {
        "dimension": "cost",
        "note": "Session-level attribution finally exists and should be turned on before scale-up, not after. One vendor's enterprise reporting now surfaces work completed, cost, and where sessions hit friction; another made agent usage metrics generally available over one-day and 28-day windows. Without those, unattended recurring agent work is an unbounded line item, and scheduled loops are precisely the workload that accrues cost with nobody watching."
      }
    ],
    "scorecard": {
      "asOf": "2026-09-12",
      "rows": [
        {
          "mode": "chat",
          "leadingPattern": "Governed conversational access to enterprise systems, where the differentiator is permission inheritance down to row and column level rather than answer quality",
          "representativeTools": [
            "OpenAI ChatGPT Work data agent",
            "Adobe Acrobat Knowledge Base",
            "Anthropic Claude Enterprise"
          ],
          "controlGap": "Permission inheritance is asserted in vendor documentation and not demonstrated, and it was not confirmable that enforcement holds for every connector, so the deployability claim rests on the vendor's word until you test it against a restricted table yourself."
        },
        {
          "mode": "cowork",
          "leadingPattern": "Role-shaped agents that hold a goal across days and weeks through cross-session memory, durable execution and dynamic steering, bought as a job rather than assembled as a workflow",
          "representativeTools": [
            "Salesforce job agents and long-horizon runtime",
            "Salesforce Fin",
            "PolyAI Wren"
          ],
          "controlGap": "The operative verbs are undefined and vendor-measured. Resolved, handled and contained appear in outcome percentages with no denominator, window, or definition, which becomes a billing dispute the moment pricing attaches to them."
        },
        {
          "mode": "build",
          "leadingPattern": "A non-executing coordinator that plans and delegates to subagents on isolated machines, backed by a persistent shared context store so learnings accumulate instead of being re-onboarded per task",
          "representativeTools": [
            "Cursor Projects",
            "OpenAI Agents API",
            "GitHub Copilot agent harness"
          ],
          "controlGap": "Review capacity, not agent capacity, is the binding constraint, and no coordinator published a guardrail preventing it from opening more unreviewed work than a team can absorb. One vendor projects twenty to a hundred changes a day from a single project."
        },
        {
          "mode": "automate",
          "leadingPattern": "Signal-triggered or scheduled always-on loops with declared acceptance criteria, an independent review agent, an override-resistant permission floor, and self-reporting on throughput, quality and cost",
          "representativeTools": [
            "Atlassian governed agent loops",
            "GitHub managed permissions and scheduled automations",
            "PolyAI Wren"
          ],
          "controlGap": "The most complete governed loop is almost entirely in private early access, so the only generally available pieces today are the permission floor and the scheduling primitive. The verifier, the part that actually bounds autonomy, is the piece you still have to build."
        }
      ]
    },
    "tryThis": {
      "title": "Test whether your agent policy survives your own developers, then give the loop a verifier it did not write",
      "steps": [
        "Pick one agent surface already in use and enumerate, per operation class, which actions are blocked, which require human approval, and which proceed silently. Cover at minimum shell commands, file reads and edits, outbound network domains, and credential-store access.",
        "Attempt to weaken one of those restrictions from a developer account using every path available: user settings, workspace or project settings, an always-allow or auto-approve click, and any approval saved from a previous session. If any path succeeds, you have a preference, not a control, and it will not hold in an audit.",
        "Write down three acceptance criteria for one recurring class of agent work, before any agent runs, and express them as machine-checkable rules rather than prose. Map each rule explicitly to the repositories, queues, or datasets it governs.",
        "Put a second checker in front of the human that did not produce the work: a linter, a policy engine, or a separate model instance with no access to the implementer's reasoning. Require it to pass before a human is asked to look, and record its verdict alongside the change.",
        "Instrument the loop for throughput, cost per completed unit, and the rate at which the independent checker rejects work. Run it for two weeks, then ask the only question that matters: did human review hours per unit of shipped work go down, or did you just move the queue?",
        "Adopt the ratchet for everything you could not declare in advance. Any correction a human makes twice becomes a deterministic check, so the next agent cannot repeat it and the criteria set grows from evidence rather than from a workshop."
      ],
      "expectedOutcome": "You will finish with a written, tested answer to two questions most organisations cannot currently answer: whether your agent permissions survive a developer's own override, and whether anything independent checks agent output before a human does. Expect the first test to fail on at least one surface, because auto-approval and saved approvals are the common bypass. The measurable result is the rejection rate of the independent checker and the change in human review hours per shipped unit, which together tell you how much more autonomy the loop can safely be given and where the remaining ceiling actually sits."
    },
    "watchlist": [
      {
        "window": "Sep 14",
        "title": "Flagship endpoint substitution takes effect at DeepSeek",
        "why": "Every request to the prior flagship begins serving a different, smaller model at different rates with no caller change required, which is the clearest live test of whether your automations pin model identity or assume it."
      },
      {
        "window": "Oct 2026",
        "title": "Agent context controls and usage dashboards reaching general availability",
        "why": "Context governance and agent usage reporting were stated as generally available in the coming months while the loop core stays in private early access, so this is the first piece of the governed loop that becomes buyable."
      },
      {
        "window": "Q4 2026",
        "title": "Zero data retention and non-US residency on managed agent harnesses",
        "why": "OpenAI's Agents API documents US-only residency and no zero data retention with no roadmap stated, and that single line currently decides whether regulated enterprises can rent an agent loop at all."
      },
      {
        "window": "Later in 2026",
        "title": "General availability of declared standards and independent agent review",
        "why": "The verifier is the component that bounds how much autonomy a loop can be given, and it is the component still in private early access, so its general availability is the gate on governed loops becoming procurable rather than self-built."
      },
      {
        "window": "Ongoing",
        "title": "Disclosure practice for agent-caused damage to third-party infrastructure",
        "why": "Multiple incidents attributed to frontier-lab agents surfaced through third-party researchers rather than lab disclosure, which is an unsettled governance question with direct consequences for enterprise procurement and insurance."
      }
    ],
    "changelog": [
      "Built from the seven agent-layer events in the graded W37 event record plus the counterbrief's negative findings, with an evidence cutoff of September 12. One item used here was carried only in the raw research notes in an earlier draft and was consolidated into the graded record during review.",
      "The lead technique is chosen for transferability rather than availability. The loop it describes is implementable on any stack today; the vendor product that documents it most completely is in private early access, and the issue states that in the same breath as the recommendation.",
      "Availability status is now stated for every capability. Only the override-resistant managed permissions and the general-availability usage metrics were unambiguously generally available; the coordinator, the managed harness, the session reports, and the governed loop core were beta, public beta, enterprise beta, and private early access respectively.",
      "Evidence quality is graded per proof point rather than per issue. Named individuals at named customers are recorded as customer case studies; internal self-reported multiples are recorded as vendor claims with their selection effects named; a measurement attributed to a party named in the same announcement is recorded as not independent.",
      "A negative proof point is carried for the first time: a frontier lab's disclosure that its own agentic search missed records inside a roughly 141,000-transcript review is the week's strongest evidence about agentic discovery, and it argues against the tooling rather than for it.",
      "Review correction, convergence claim. The opening previously said three vendors shipped the same loop, a persistent coordinator that holds a goal and delegates to subagents. The research supports that architecture for two of them. What the third documents is cross-session memory, durable execution and dynamic steering, which is persistent goal-holding without a published delegation architecture. The headline and body now narrow the shared property to agent work beyond the session and state that only two vendors disclose delegation architecture.",
      "Reliability is added as a standing readiness dimension on the basis of two vendor-side model changes inside one week, one a same-day deprecation inside agent mode and one a flagship endpoint substitution."
    ]
  }
}