The Control Surface Problem
Six announcements this week, and almost all of them are about bounding agents rather than building them.
The Read
There is a tell in how a technology matures: the interesting work stops being about capability and starts being about constraint. This week produced an unusually clean example. Microsoft Research published a framework for training and evaluating agents, a memory representation for agents, and a method for treating agent skills as trainable parameters. AWS shipped authorization policies that evaluate against an agent's session history and rate limits scoped by identity. None of these make an agent more capable. All of them make an agent's behaviour something you can reason about in advance.
That shift matters more than another benchmark. The failure mode that actually blocks enterprise deployment is not that the agent cannot do the task — it is that nobody can bound what it does on the way. A per-call permission check tells you the agent is allowed to issue a refund. It tells you nothing about the agent issuing four hundred refunds in one session because a retry loop went wrong. AWS's temporal policies are the first mainstream attempt I have seen to make the sequence itself the unit of authorization, with cost ceilings that hold regardless of what the model decides to do. That is a genuinely different security posture, and it is one that maps onto how audit and risk functions already think.
Meanwhile Meta released Muse Glimmer with open weights — local, agentic, multimodal. Read alongside the governance work, it sharpens a split that has been forming all year. Capability is diffusing outward and downward, onto hardware you own, under licences you control. Control tooling is consolidating inward, into managed platforms that charge for exactly the guarantees that open weights cannot give you. If you are making a build-versus-buy call in the next two quarters, that is the axis it will actually turn on, and it is not the axis most vendor decks are drawn along.
The uncomfortable note came from OpenAI, which published preliminary cybersecurity evaluations for Astra alongside the safeguards it is putting around them. Publishing evaluations before the containment story is fully settled is the honest thing to do, and it is also a signal worth reading plainly: capability is still arriving faster than the controls built to hold it. Every piece of governance tooling released this week is a response to a gap that already exists in production, not a precaution against one that might.
Signals
Meta is back with Muse Glimmer: local, agentic, multimodal, and open source
Meta released Muse Glimmer as an open-weight model built for local, agentic, multimodal use. It is positioned around Zuckerberg's 'personal superintelligence' framing — capability that runs on hardware the user owns rather than behind a metered API.
Open weights that are genuinely agentic change the build-versus-buy calculation for anyone with data-residency or per-token cost constraints. The catch is that you inherit the entire safety and governance burden that a managed platform would otherwise carry for you.
Control agent behaviors and cost beyond a single action: new capabilities in Amazon Bedrock AgentCore
AWS introduced temporal policies backed by Dogwood, a new open-source policy language for AI agents, plus gateway rate limiting. Policies evaluate authorization against an agent's session history rather than a single call, and cost ceilings hold regardless of agent behaviour.
This moves authorization from per-action to per-trajectory, which is the level at which agents actually cause damage. If Dogwood gains traction as an open standard, agent policy becomes portable across platforms instead of a per-vendor rewrite.
Orchard: An open framework for scalable agentic AI
Microsoft Research open-sourced Orchard, a framework for training and evaluating AI agents across task types. It is built to reduce infrastructure duplication and reports strong performance from smaller models by letting researchers reuse the same evaluation substrate.
Shared evaluation infrastructure is what turns agent comparisons from anecdote into evidence. The claim that smaller models hold up under a common harness is worth testing yourself before you commit to a frontier-model bill.
Memora: A harmonic memory representation balancing abstraction and specificity
Microsoft Research proposed Memora, a memory system for agents that separates what is stored from how it is retrieved. It targets the degradation that occurs when agents reload or re-retrieve context across long, multi-step tasks.
Separating storage from retrieval policy means you can change how an agent remembers without re-indexing everything it knows. Anyone running long-horizon agents is currently paying for this problem in context tokens and silent quality loss.
Gemini Robotics ER 2: video understanding, task orchestration, and multi-robot collaboration
Google DeepMind released Gemini Robotics ER 2, adding video understanding, tool orchestration, and coordination across multiple robots. DeepMind frames it as a step change in how robots reason about and divide real-world tasks.
Multi-robot orchestration is the same distributed-coordination problem as multi-agent software, with physical consequences for getting it wrong. The orchestration patterns proven here will migrate back into pure-software agent systems.
Responding to the next frontier of critical cyber capabilities
OpenAI published preliminary cybersecurity evaluations for Astra together with the safeguards and security controls it is putting in place around those capabilities.
Publishing evaluations ahead of a settled containment story is a straight signal that capability is outpacing control. If you run a security function, the assumption that offensive capability stays scarce is no longer a safe planning premise.
Technical Spotlight
Temporal authorization policies
Conventional authorization is stateless: each tool call is checked in isolation against a permission set, and if the agent is allowed to call refund(), every call passes. Temporal policies make the session history part of the decision, so a rule can express 'at most three refunds per session', 'no external send after reading customer PII', or 'require human approval once cumulative spend crosses a threshold'. Mechanically this means the policy engine keeps a running state per agent session and evaluates each proposed action against that trace rather than against a static role. The value is that the guarantee holds no matter what the model decides to do, which is the only kind of guarantee that survives a prompt injection. The cost is real: you now have stateful policy to version, test, and debug, and a session-scoped store that must stay consistent under retries and parallel tool calls. Get the state model wrong and you have added an outage mode to your safety layer.
Every agent framework eventually grows a permission system. The teams that ship are the ones that designed it before they needed it, not after the first incident review.
Never miss an issue
Delivered every Tuesday morning. Free.
One email a week, every Tuesday. No spam, unsubscribe in one click.