The Long Read · Ins7ghts Daily, Saturday 7 November 2026
Years ago, on a programme I was working, the salesman from the implementation side told the room he had just landed a unique sales channel agreement with the technology vendor. I had known that vendor far longer than he had, and at that moment I held the same agreement, with my own access to their partner portal. I laughed. Not at him, at the word unique, which he had no way to check and I did.
That is the whole shape of this week. Three companies each said, in their own vocabulary, that they hold the layer deciding what an AI agent is allowed to do. One bought it, one shipped it, one published the scorecard for it. None of them is lying. All three claims are unverifiable from where the buyer sits, which is the part worth sitting with.
Start with the money. Palo Alto Networks is in talks to pay $500 million in cash plus milestone payouts for Clutch Security, whose product sits around the keys, tokens and service accounts an agent uses when it acts on its own. The same report has Cyera paying $1 billion for Oasis Security and Cisco paying roughly $400 million for Astrix. Clutch had already shown up on Fortune's 2027 Cyber 60 list in a 30 October write-up of Israeli-founded security startups, so the shortlist existed before the bid did.
What is being priced here is not detection. It is the register: the list of which non-human identity may reach which system, and the record of what it did. That is an asset in the accounting sense. Whoever holds it is the party a court, an auditor or an insurer will ask.
Then the plumbing. GitLab 19.5 made its MCP server generally available, added controls for external AI agents, brought Secrets Manager to general availability, and gave administrators toolset selection, where you pick which tools an agent may call at all. It also set rate limits on MCP calls, 60 a minute on the free tier and 600 a minute on premium and ultimate, and it shipped a /goal command plus a Duo CLI auto-mode that lets an agent run multi-step work unattended.
Read those two halves together and the release is a confession. The same version that lets an agent work unsupervised is the version that needed a meter, a secrets vault and a per-agent tool list. Nobody builds a governor for a machine they believe behaves. Sophos was making the same bet from a different angle on 27 October with intent-based access control for AI agents. And the trojanised Claude Code extension that ran in our 3 November edition turned out, in StepSecurity's write-up of 30 October, to have dropped a persistent SSH backdoor. A toolset list is not paperwork. It is the difference between an agent that can reach your build server and one that cannot.
The rest of this piece is for subscribers.
Ins7ghts Daily is free. One letter a morning from Yves Mulkers on what moved in data and AI, and why it matters to your side of the table.
Already subscribed? Sign in at the top of the page.