In partnership with
Your off switch just became an exam question.
Three things landed in a day and they all point at one small moment: a person clicking approve. One side is writing down how that moment gets inspected, the other just explained why it is the softest link in the chain. Here is how I read them.
Advertisement
How Jennifer Aniston’s LolaVie brand grew sales 40% with CTV ads
For its first CTV campaign, Jennifer Aniston’s DTC haircare brand LolaVie had a few non-negotiables. The campaign had to be simple. It had to demonstrate measurable impact. And it had to be full-funnel.
LolaVie used Roku Ads Manager to test and optimize creatives — reaching millions of potential customers at all stages of their purchase journeys. Roku Ads Manager helped the brand convey LolaVie’s playful voice while helping drive omnichannel sales across both ecommerce and retail touchpoints.
The campaign included an Action Ad overlay that let viewers shop directly from their TVs by clicking OK on their Roku remote. This guided them to the website to buy LolaVie products.
Discover how Roku Ads Manager helped LolaVie drive big sales and customer growth with self-serve TV ads.
The DTC beauty category is crowded. To break through, Jennifer Aniston’s brand LolaVie, worked with Roku Ads Manager to easily set up, test, and optimize CTV ad creatives. The campaign helped drive a big lift in sales and customer growth, helping LolaVie break through in the crowded beauty category.
1. Bank examiners got a list for looking inside your AI
The Conference of State Bank Supervisors released an AI Supervisory Framework on 16 September, and a law-firm read of it landed yesterday. It is an examiner guide, not a rule, and it says so: no new legal requirement. What it creates is a list. Examiners are to look for an enterprise-wide inventory of AI uses, a risk-based classification and approval process, board oversight, vendor management, and, for generative and agentic systems, human checkpoints and shutdown capability. A worksheet sorts each use case into low, moderate or high risk and attaches controls to the tier. Institutions without that governance, the note says, can expect enhanced scrutiny. In April the Fed, the OCC and the FDIC had already carved generative and agentic AI out as risk categories of their own. From your side of the table, the question stopped being whether you believe in AI governance. It is whether somebody can read your version of it in an afternoon.
So the control gets inspected well before any law arrives.
2. Somebody named the flaw in the human approval
A piece called The Trojan Sentence put a name on it: approval laundering. An unauthorised request picks up credibility because a trusted system selects the evidence, prepares the explanation, and presents the action for a human to approve. The software never held the permission. The person who held it was working from the software's reasoning. It walks back through EchoLeak, where in June 2025 an unopened email talked Microsoft 365 Copilot into giving up confidential information, patched as CVE-2025-32711, and through Britain's cyber security centre saying in December 2025 that prompt injection is not a normal bug with a fix. Simon Willison's lethal trifecta is the same point in three parts: private data, untrusted content, and a way to send things out.
The control on the checklist is the one with no fix behind it.
Advertisement
Leave Granola and get up to 12 months free of Wispr Flow Notetaker + Dictation
If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.
3. Cognizant and Google Cloud widened their agent deal
The two expanded their partnership to scale enterprise AI agents across client systems. No number came with it, which makes it a delivery agreement rather than a purchase, and the delivery is the part that matters here. Story one tells the examiner to look at vendor management. This is what a vendor chain looks like once it is real: a model from one company, a cloud from another, agents configured by a third, running inside a business that answers for all of it. If you buy agents through an integrator, your authorisation trail is a clause in somebody else's statement of work.
So the chain the examiner walks runs through contracts you did not write.
Your Turn
Which of today's three reads matters most to your work?
Three new names to watch
Ins7ghts picked them up for the first time this week. Each one fits today's story.
- Uvi · $7.5M to give AI agents the business context behind the data
An agent nobody can check against the business is an agent nobody can honestly approve. - FLÆ Robotics · €1M+ from Purple Ventures for Bea, an AI agent for hotels
The agent is in the building with the guests, which is where a stop button stops being a metaphor. - Oktana · bought by Argano to add Salesforce and AI build capacity
Somebody has to build the inventory and the approval trail, and that labour is being bought up.
Companies that later raised money had been in the news about twice as often in the quarter before. Worth a second look in three months.
Advertisement
Your Search Bar Is Haunted
Shoppers type exactly what they want and get “0 results found” back. They don’t complain. They just vanish to a competitor.
Gladly understands what shoppers mean, typos and all, and turns dead-end searches into product recommendations.
Also today
- Kapital agreed to buy AI coding startup Woz for $30 million, so a lender now owns the shop that writes its code. (3 min read)
- The American Hospital Association sent the FDA its view on how generative-AI medical devices should be regulated. (13 min read)
- A law-firm note reads the EU AI Act and UK rules as product law, which files an AI system next to a faulty kettle. (8 min read)
First MoveThe arm nobody is writing about
For years I bought my records in person. The record in my own hands, a listen before paying, and the choice was mine. Very few disappointments came out of that.
Anthropic has published a research preview of the Model Hardware Standard, a specification for AI agents to control physical equipment, and the write-up that noticed it is a machine-tool show recap that files the spec beside PTC, Universal Robots and Amazon Web Services. Everybody will read that as an Anthropic story. The arm is the part nobody is writing about.
When an agent moves a machine on your floor, whose name sits on the authorisation?
My call: by the end of March 2027, at least one industrial AI announcement names the robot or controller vendor in the same breath as the agent vendor, because a buyer's insurer asked who signs.
Your off switch is turning into an exam question, and the exam is about evidence rather than intent. If you have ever had to produce the approval trail for something an agent did, hit reply and tell me.
Yves
Tomorrow, Reality Check: a claim everyone repeats, held against what actually happened.
Reach data and AI leaders in this inbox: book a placement.
Ins7ghts Daily is published by 7wData.