|
Hey there 👋
Half my inbox this week is vendors selling an “agent governance platform.” The pitch is always the same: agents are risky, buy our control layer, sleep at night.
Here is the thing they would rather you did not notice. Over the last couple of weeks, three of those control layers quietly shipped as toggles — inside stacks you already run. Not a product to evaluate. A setting to switch on.
Monday’s issue was about the last mile: who wires the agent in, and what it is allowed to touch. Today is the second half of that sentence. The controls for “what it is allowed to touch” just became switches. Let us get into it.
The Big Thing
🔑 MCP just got single-sign-on for agent tools — and it is stable
If you have tried to roll MCP out past a demo, you have hit the wall: every server wants its own OAuth consent prompt. Ten tools, ten logins, and a security team that will not sign off. That wall is the most-cited reason enterprise MCP pilots stall — and this week it came down at the protocol level.
The Model Context Protocol team promoted Enterprise-Managed Authorization (EMA) to stable. Instead of a per-server login dance, an admin sets policy once in the company identity provider — Okta is first, via its Cross App Access feature — and users inherit access to every approved MCP server automatically. Under the hood, the user’s identity is passed as an ID-JAG (an Identity Assertion JWT Authorization Grant) that gets exchanged for a scoped access token. No consent prompt per tool. One enterprise login, and the approved tools light up.
The ecosystem is already real, which is the part that makes this deployable rather than aspirational. Anthropic ships EMA support across Claude, Claude Code, and Cowork. VS Code supports it in the IDE. And on the server side, Asana, Atlassian, Canva, Figma, Granola, Linear, and Supabase already speak it, with Slack in progress. Backed by Anthropic, Okta, and Microsoft, this is the protocol-native answer — not another third-party gateway bolted on top.
Now the caveat, because it matters and the MCP team says it plainly: EMA governs connection-level access — who is allowed to connect to which server. It does not govern what an agent is allowed to do once it is inside. Per-action runtime authorization is still on you. EMA gets the right people to the right tools with one login; it does not decide whether the agent should have sent that refund.
Ship it? Deploy this week — if you run Claude or VS Code plus any of those MCP servers on Okta. Flipping on centralized MCP auth deletes the single ugliest part of agent-tool onboarding, and it is a config change, not a migration. Just do not mistake it for a full governance stack: pair it with your own runtime controls for what the agent does after it connects.
Sources: MCP blog · InfoQ · The New Stack
Tour de Headlines
🖥️ AWS WorkSpaces for AI agents hit GA — give an agent its own desktop. As of July 1, you can hand an agent a secure, managed cloud desktop and let it operate legacy or GUI apps the way a human would — no API, no modernization. It is the cleanest path to point an agent at that ancient Windows app nobody will let you rebuild. GA added the parts that make it enterprise-safe: MCP tool forwarding (the agent drives the OS and apps through direct MCP calls, lower latency and cost), real-time session control (watch a session and revoke access mid-run — an actual kill switch), and domain-joined fleets (agents run under existing Active Directory identities with CloudTrail and CloudWatch audit trails). Framework-agnostic, and the agent features add no premium over standard WorkSpaces session-time pricing. The “managed desktop” leg of the week’s control-plane story. AWS.
📦 Microsoft Execution Containers put agents on rails at runtime. In early preview (covered July 7), MXC is a cross-platform, policy-driven layer that contains agents on Windows and WSL. You declare the constraints; Windows enforces them at runtime through one SDK and policy model, with Agent 365 wiring in Entra and Intune for per-agent rules. The first release ships process isolation — already used by GitHub Copilot CLI to sandbox AI-generated code — and session isolation, which walls the agent off from your desktop, clipboard, and input, each session running under its own identity for least privilege and clean audit. Micro-VMs and WSL Linux containers are on the roadmap. It is on GitHub as microsoft/mxc. One note to avoid confusion: this is a runtime-containment primitive, a different thing from Microsoft’s $2.5B Frontier services unit we covered Monday. Help Net Security.
🎨 Google’s A2UI lets agents render real UI in your design system. Back in the spotlight this week (InfoQ, July 3) and now at v0.9.1 with a v1.0 release candidate posted, A2UI is a framework-agnostic standard that lets an agent declare UI intent which renders natively on web, mobile, and desktop — without shipping arbitrary code. The shift that matters: agents speak your existing design system’s components instead of inventing their own janky interface. It is bidirectional and runs over MCP, WebSockets, REST, AG-UI, and A2A; there is a new Python Agent SDK (pip install a2ui-agent-sdk) and an official React renderer alongside Flutter, Lit, and Angular. Fair warnings: the schema is still moving (that v1.0 RC), and critics flag UI-impersonation risk. Deployable in Python today — pilot it, do not rewrite your front-end around it yet. Google.
|
Sponsor
You are putting agents on rails. Your revenue calls still run with no gauge.
Today’s whole issue is about switching on controls for the systems that matter. Here is the system with none: the live sales and CS conversation. The discovery call that got misread. The deal where two people “aligned” on different things. The rapport that never formed — and closed-lost with no warning light. RapportScore scores how your team actually connects, on every call and email, so the misfires surface while you can still fix them. You would not run an agent with no audit trail. Stop running revenue conversations blind.
See your team’s score →
|
Tool of the Day
🎙️ xAI Voice Agent Builder
Stand up a production phone-answering voice agent — wired to your own APIs and MCP tools — in about two minutes, no code.
xAI shipped Voice Agent Builder in beta on July 1: one no-code interface to configure a production voice agent on Grok Voice, with telephony, knowledge retrieval, tools, guardrails, MCP servers, and observability all in the same place. It runs a true speech-to-speech path — not the usual stitched-together speech-to-text, then LLM, then text-to-speech — so it feels less robotic.
The deployable details are the good part. Bring your existing number over SIP. Wire tools to your APIs and MCP servers. Pick from 80-plus voices or clone a brand voice in about two minutes. You get a free provisioned number, browser testing, and full call recording and transcription. Pricing is refreshingly legible: $0.05/min for the API (voices included, no platform fee) plus $0.01/min telephony — numbers you can actually build a per-call ROI on.
xAI claims Grok Voice tops its own tau-voice benchmark (67.3%, versus 43.8% for Gemini 3.1 Flash Live and 35.3% for GPT Realtime 1.5). Treat that as vendor-reported — it is their bench, their numbers. But the shape is what counts: a RevOps or support team can stand up a phone agent tied to real tools by end of day, and price it per call.
Read the launch →
Worth a Click
- Bespoke Labs raised $40M to build the environments that make agents reliable. Wing VC led, with angels from Anthropic, OpenAI, and Meta. The company builds simulated real-world environments — codebases, microservices, comms logs — to train and evaluate long-horizon agents. Not something you deploy, but the clearest signal of where agent-infra money is flowing: the bet is that reliability comes from better environments, not bigger base models. The other half of the last-mile story. BusinessWire.
- Scale’s VeRO: tune the scaffold, not the brain. Scale Labs built an “optimizer” agent that edits any part of a target agent to improve it — up to 19 points on the GAIA benchmark across 105 runs. The useful nuance for anyone tuning agent workflows: the gains came from tool use and workflow logic, not the base model’s raw reasoning. It is research, not a release (paper July 6, presented at ICML July 7) — but it is a clean mental model: when your agent underperforms, fix the scaffolding before you swap the model. Scale.
The bottom line. You do not need to buy an “agent governance platform” this quarter. In the last couple of weeks the three things that actually keep an agent governable all shipped as switches inside stacks you already run: centralized auth (MCP EMA), a runtime sandbox (Microsoft MXC), and a revocable managed desktop (AWS WorkSpaces). The instinct is to go shopping. The move is to go flip one switch. So here is the Wednesday move: pick the one agent you would most want on rails — the one touching money, or customer data, or production — then turn on exactly one control it is missing right now. One agent, one toggle, this week.
See you tomorrow.
— The Agent Stack
|
