Your agent gets an allowance

Hey there 👋

I read the Cloudflare announcement twice, and the headline is the wrong part. Everybody grabbed the wallet: agents can hold money now, agents can buy things now. Fine. The line that stuck with me was three paragraphs down, where the agent gets a name. A permanent, verifiable identity that says which human this thing is acting for.

Here is my bias, for what it is worth. A spending cap you cannot attach to a name is a suggestion. A kill switch you cannot point at a specific actor is a wish. For a year the whole agent-safety conversation has been about limits, and we kept skipping the boring prerequisite, which is knowing who you are limiting. That is the thing that quietly shipped this week. Read the rest of today with that in mind: the budget got the headline, the identity is the load-bearing wall.

The Big Thing

Cloudflare gave every AI agent an identity and a hard-capped wallet.

During its second Agents Week, Cloudflare announced two pieces that fit together. cloudflare.pay is a permanent, human-readable identity for an agent, built on Web Bot Auth, that proves which person or company the agent is acting for. Cloudflare Wallets is the money layer, and it splits in two on purpose. An Account Wallet belongs to a person or org, holds the real funds, and sets the rules. A Virtual Wallet belongs to an agent, works through an API key, and can only spend inside the ceiling the Account Wallet drew: a total spending cap, a list of approved merchants, and a maximum size per transaction. Payment itself clears through x402, the open standard that attaches a stablecoin payment straight to the HTTP request.

Put those together and you get the thing builders have been faking with prepaid cards and prayer: an agent that can pay for a service, a dataset, or an API call on its own, with a name attached and a limit it physically cannot exceed. The autonomous-procurement demo stops being a demo. So does the support agent that needs to buy a one-off lookup mid-conversation. You define the box once at the Account level, hand the agent a key, and the box holds for every purchase without you approving each one.

Now the part the launch-day coverage mostly skipped. This is an announcement, not a live product. As of this week you can reserve a cloudflare.pay handle, and that is about it. Account Wallet funding, the Virtual Wallets themselves, and the programmable spending rules are described as coming over the next few months. So the demo works on stage; you cannot wire it into production this afternoon. Treat the specifics as Cloudflare's own description of what it intends to ship, not a spec you can benchmark yet.

Ship it? Reserve the handle today, design the policy now, deploy when the wallets open. Grab your cloudflare.pay name before the good ones go, and while you wait, write the spending policy you would trust: low cap, short merchant list, small per-transaction ceiling for anything non-critical. The identity is the interesting half, so claim it early. The money can wait for the rest to ship.

Cloudflare · Help Net Security

Tour de Headlines

🧾 Drata opened Limited Availability of a governance layer for the agents you already run.

Drata's new AI Agent Governance module discovers, monitors, and logs the AI agents running inside your org, and keeps a traceable record of what each one did. The pitch is aimed at the very common mess where three teams each spun up their own agents and nobody owns the list. It ships Anthropic-first, with early-access customers already running it in production, and coverage for OpenAI, Google Vertex AI, and AWS Bedrock is in development. This is Drata's framing, so read the completeness claims as theirs. It landed the same week the EU AI Act's transparency rules went enforceable, which is not a coincidence. If you are piloting agents on Anthropic, the inventory it produces is worth more than the compliance checkbox: it tells you what you are running.

Drata · Security Boulevard

🏢 Oracle put agent teams inside the ERP, not next to it.

Oracle's updated AI Agent Studio adds a unified builder for what it calls Fusion Agentic Applications: teams of specialized agents that reason, coordinate, decide, and then execute through Fusion business objects, workflows, approvals, and logged actions. The distinction that matters for builders is execution inside the system of record, so the automation inherits the approvals and audit trail you already enforce instead of bolting new ones on the side. On July 30, Oracle and Google Cloud widened their deal so Gemini 3.1 Flash-Lite and 3.5 Flash run inside AI Agent Studio and embed in Fusion Cloud Apps and NetSuite, alongside other model providers. If your close process or your ticket queue lives in Fusion, this is the shape of the pilot: one end-to-end flow, agents do the gathering and drafting, humans keep the sign-off.

Oracle · AI Agent Store

🛡️ Airlock Digital started policing agents one command at a time, on the device.

Endpoint vendor Airlock Digital extended its allow-listing product with Agentic AI Control and Governance, which auto-discovers AI apps on a machine, logs each agent session and command, and checks every command against central policy before it runs. The logic is simple once agents can execute code and touch files: a static allow-list of approved programs says nothing about an agent that was approved and then told to do something stupid. So Airlock treats the agent as a first-class actor and gates the action, not just the app. Think of it as the endpoint counterpart to the out-of-band MCP controls we covered this week: same instinct, different boundary. The cloud policy engine watches the tool call; this one watches the laptop.

Airlock Digital · AI Agent Store

Tool of the Day

🔎 Nimble expert web-search agents

What it is for: a web-research agent you reach through MCP that learns your domain and spends fewer tokens getting the answer.

If your stack keeps reinventing "search the web, crawl the page, pull out the fields," Nimble is worth a look before you build another scraper. Its expert web-search agents learn a specific use case over time through a proprietary index and memory, so they stop repeating the same lookups, and they expose the whole thing through API, SDK, and MCP. That last one is the point for this audience: you can hand an existing agent live web intelligence with a connector instead of a homegrown pipeline. Nimble's own benchmarks claim a 21-point jump in answer quality and 51 percent fewer tokens per query against leading alternatives, and it says it is running more than 90 million searches a day in production. Those are vendor numbers on a vendor test, so believe the mechanism and check the percentages against your own workload. The launch was late July, so this is a tool pick, not breaking news. It earns the slot because "offload domain research through MCP" is a job a lot of you are hand-rolling right now.

Point one agent at Nimble's MCP

Worth a Click

• Hush Security's $30M Series A. Total funding to $41M, with Akamai in as a strategic investor, to secure the "non-human workforce" of agents and bots. The capital is following the same identity-and-control thread as today's lead. AI Agent Store
• Natural's $30M Series A. Total to $40M, building transaction rails and calling itself "Stripe for AI agents." Another bet that agents paying for things needs its own infrastructure. AI Agent Store
• Cloudflare's own writeup of the agent ID and x402 mechanics. If you want the plumbing behind today's Big Thing, including how Web Bot Auth and the payment standard fit together. Cloudflare

Delight

🤖 Cloudflare ran its launch by asking everyone to interview their own agent.

Instead of opening Agents Week with the usual keynote and a product list, Cloudflare told people to go ask their own AI agents what infrastructure they need, then report back. It is the most 2026 way imaginable to write a roadmap: crowd-source it from the agents. There is a real idea hiding in the bit, though. Try it on your own stack this week. Ask the agent you run every day what it keeps failing to do, where it loses context, what it wishes it could reach. You will get a surprisingly honest list of the gaps you have been papering over with scripts, which is exactly the audit most of us keep meaning to do and never schedule.

For a few weeks the through-line here was about drawing boundaries: rent the cheap brain, own the rails, provision the agent like a tenant, control the tool call you own. This week names the thing all of that was quietly missing. Identity. A cap you cannot attach to a name is a suggestion. An audit log with no actor is a diary. A kill switch that cannot find the agent it is supposed to stop is a light switch in an empty room.

Look at what shipped and it is the same move three times. Cloudflare gives the agent a permanent ID and then hangs a wallet and a spending limit off it. Drata's whole product is the inventory, the list of which agents exist before you govern any of them. Airlock names the agent on the endpoint so it can judge the next command. None of these leads with the limit. They lead with the identity, because the limit is worthless until you know who you are limiting. So here is where I land this week. Before you write another guardrail, make sure every agent you run has a name you can point at. Name it first. The budget, the audit trail, and the kill switch all need something to hang on, and the name is the hook. An agent you cannot name is one you cannot govern, no matter how many policies you write around it.

Ron

You’re receiving this because you subscribed to The Agent Stack.