AI agents got rules before regulators wrote them

The rules for your agents are on sale before they are law.

Three things landed in four days and not one of them came from a regulator. A security company put half a billion dollars on what an AI agent may touch, a developer platform shipped the same thing as a setting, and a platform vendor published the scorecard. So I went looking for who is actually writing this down, and it is nobody with a mandate.

Advertisement

1. Palo Alto is in talks to pay $500 million for agent credentials

TechCrunch has Palo Alto Networks in talks to buy Clutch Security, an AI agent security startup, for $500 million in cash plus milestone payouts. What Clutch sells sits around the keys, tokens and service accounts an agent uses when it acts with nobody watching.

$500 million in cash, and the rest tied to milestones.

The same report puts two closed deals next to it: Cyera paid $1 billion for Oasis Security, and Cisco paid roughly $400 million for Astrix.

Clutch turned up on Fortune's 2027 Cyber 60 list in a 30 October write-up counting Israeli-founded security startups, so it was already on the shortlist somebody was reading. On 3 November CrowdStrike said it would buy Dreadnode to automate AI security testing. Palo Alto also shipped Prisma AIRS and a continuous AI defence service onto the OpenAI marketplace on 23 October, so the buying and the selling are running in the same quarter.

I keep asking vendors the question nobody enjoys: when an agent does something it should not have done, who holds the record of what it was allowed to do? Folding Clutch into Palo Alto moves that record inside one supplier's stack, which is tidy for the supplier and a dependency for everyone else. I would want the permission list exportable in a format my own auditor can read before I let that layer carry weight, because a control I cannot read out is a control I cannot defend.

Read the source →

2. GitLab caps your agents at 600 tool calls a minute

Version 19.5 turns the controls on inside the platform instead of selling them beside it:

• the GitLab MCP server is generally available, with controls for external AI agents
• toolset selection: an admin picks which tools an agent may call, which is least privilege applied to a machine
• Secrets Manager is generally available, with expanded security configuration profiles
• rate limits on MCP calls, 60 a minute on free and 600 a minute on premium and ultimate
• a /goal command and a Duo CLI auto-mode, so an agent runs multi-step work on its own

They shipped more autonomy and a meter on it in the same release.

Sophos published its own intent-based access control for AI agents on 27 October, so this is a lane, not a feature. And the malicious Claude Code extension from our 3 November edition left a persistent SSH backdoor behind, in StepSecurity's write-up of it on 30 October, which is exactly the event a toolset list exists to survive.

Rate limits read like plumbing and I think they are the most honest line in the release. Per minute is really how much a runaway agent gets to break before someone notices, and 600 a minute is a lot of breaking. The thing missing is not a higher ceiling, it is an alert well under it, because telling you after the fact is a receipt rather than a warning.

Read the source →

Advertisement

3. Microsoft is grading your agent governance against its own model

Microsoft updated its Agentic AI Maturity Model with a governance and security pillar, covering six areas: platform controls, policy documentation, an agent inventory, access permissions, monitoring, and progressive assurance.

The argument is what lifts this above a blog post. Enforcement guidance under the EU AI Act for high-risk systems can point at commercially published maturity models as proof you did reasonable due diligence. So a supplier's document ends up part of a customer's defence.

On the same day BSA filed further recommendations on the European Commission's draft guidelines for classifying high-risk AI systems, which is the industry arguing over who gets graded in the first place. The ACM's blog also asked who audits the AI auditors and pointed out that the auditors are running AI tools themselves.

A maturity model written by the company selling the platform is not a neutral yardstick, and that does not make it worthless. It makes it a procurement document. Six headings is six headings, and if your board has nothing else written down, this is what the room will reach for. I would take those six, put my own evidence under each, and keep the version with my name on it, because on the day somebody asks for proof of reasonable care, a supplier's PDF is not the paper with my signature at the bottom.

Read the source →

Names to watch

Seen this week by Ins7ghts, our research platform: a knowledge graph of the data and AI news we read every day.

• Lucite · an AI platform for Canadian group benefits brokers
  Ownership. Sterling Brokers announced on 6 November that it had acquired Lucite and would open its own administration platform to independent brokers, in two write-ups the same day (the release).
• Potential Sciences · uses AI to design chemistry for drug discovery
  Grounding. The UK's Sovereign AI unit put cash and compute behind it on 5 November, including time on the Isambard-AI machine, alongside Nauta Capital and Blue Wire Capital.

Companies that later raised money had been in the news about twice as often in the quarter before. Worth a second look in three months.

Advertisement

Also today

• Democrats are planning a flood of AI bills once they take control of Congress. (3 min read)
• Thinking Machines released Inkling 2 and moved ahead of Mistral on open weights. (4 min read)
• A white paper from Inteq puts 68% of medium-sized organisations at partial or no visibility into which AI tools their staff use. (9 min read)

The Long ReadWho writes down what your agent may do

Years ago, on a programme I was working, the salesman from the implementation side told the room he had just landed a unique sales channel agreement with the technology vendor. I had known that vendor far longer than he had, and at that moment I held the same agreement, with my own access to their partner portal. I laughed. Not at him, at the word unique, which he had no way to check and I did.

This week three companies each told the room they hold the layer that decides what an AI agent may do, and the question has not changed: can the buyer check it?

Where does your agents' permission list live, and who can read it out without asking a supplier?

My call: by 30 June 2027, at least one listed US company's cybersecurity incident filing with the SEC will name an AI agent or its credentials as part of how the attacker got in.

Read the deep dive →