Now agents need a yes

Hey there 👋

I went looking for the JetStream demo the way I look for the catch in any security pitch, and the example that stopped me was small. An agent, mid-task, adds a blind BCC to the last email in a sequence and hits send. Read any single step and it looks fine. Read the sequence and it is a leak walking out the front door.

That is the whole idea behind this week's lead, and it is a genuine shift. For five weeks the agent news was about who the agent is: give it a real identity, short-lived keys, a certification it can wear. Useful, all of it. None of it answers the next question, which is whether the specific thing an agent is about to do, right now, should be allowed at all.

Here is my bias, for what it is worth. An authorizer that only sees the calls routed through its own gateway is a real control and a partial one. It can stop what it watches and nothing else. That can be a fine trade if you know where the blind spots are. So today is about authorization at the action, not the actor. Let's get into it.

The Big Thing

Now agents need a yes for every move

On Tuesday, JetStream announced Clearance, which it calls an AI Zero Trust Reasoning Engine. JetStream is the security startup that raised a 34 million dollar seed and shipped an agent kill-switch in July, so this is the same team going from “shut a rogue agent off” to “check every move before it happens.” Clearance sits at the JetStream AI Gateway and evaluates each agent action at the point where agents do things, the tool calls they make through the Model Context Protocol.

For every request it asks four questions: which agent or user is asking, which approved design authorizes the request, which tool is being invoked, and what this specific call is about to do. If the answer lines up with what the agent is allowed to do, it clears. If it does not, the call never runs.

The piece that makes it more than a fancy allow-list is that it judges sequences, not lone calls. JetStream's own example is the BCC one: adding an external blind copy to the final send in a chain has a high correlation with data exfiltration, so Clearance denies that send even though the isolated call, “send an email,” looks completely ordinary. The unit of risk is the pattern across steps, and that is the thing a per-call permission check misses by design.

Line this up against the last month and the arc is clean. NIST said give agents strong identity and scoped credentials. CrowdStrike said it will certify partner agents so you can trust them. Both answer who the agent is. Clearance answers whether this agent should do this next thing, in this order, at this moment. Authorization at the action is the layer that sits under identity, and it is the one most teams have not built.

Now grade it. Clearance only sees what routes through the JetStream gateway and MCP, so an agent that reaches a system by some other path is invisible to it, and coverage is the whole ballgame for a control like this. There is also a number nobody outside the company has measured: how often it blocks legitimate work. A reasoning engine that stops “dangerous sequences” is only as good as its definition of dangerous, and a false positive that kills a real workflow is its own kind of outage. Believe the mechanism. Watch the block list.

Ship it? Watch. This is a new category of control, not a Wednesday install. If you run MCP-based agents, the useful move this week is boring and yours to do: inventory which of your agent's tool calls pass through a gateway you control, because a per-action authorizer protects exactly that set and nothing outside it. Keep the identity and credential work you already did. This sits on top of it.

Sources: JetStream announcement (Sep 2, 2026); SecurityWeek (34M seed); Help Net Security (July agent kill-switch).

Tour de Headlines

💳 An agent that touches money just went GA. India's Cashfree moved Relay, its Super Agent for small-business payment operations, from merchant beta to general availability. It reads a merchant's transaction records directly and then does things: retries failed payments, chases abandoned carts, confirms cash-on-delivery orders before dispatch, and files disputes before the deadline passes. Cashfree says it takes payment ops from around 60 hours a week down to under 45 minutes, which is Cashfree's number on Cashfree's data, so weigh it as a claim rather than a measurement. Free at launch, outcome-based pricing later. Put it next to the lead story on purpose: this is precisely the kind of agent whose every action moves cash, which is precisely where a per-action check earns its keep.

🔐 Control the data before the agent quotes it. Skyflow launched Skyflow for Glean, a runtime, field-level data-control layer for enterprise AI search. As Glean turns your CRM, internal wikis, and data lakes into generated answers, the sensitive values in those sources ride along into summaries and into an agent's reasoning steps. Skyflow masks them at the field level at query time instead of trusting the model to be discreet. Same governance reflex as the rest of the week, one floor down: the question here is not who the agent is, it is which values it is allowed to carry into an answer. (Aug 25.)

🏦 A regulated bank pushes service agents past answering. KT won the job to rebuild Woori Bank's chatbot and consultation bot, and the interesting part is the plumbing: a new Agent Connector that links the chatbot, the consultation bot, Woori's AI Banker consultation service, and task-running agents so customer context follows the conversation across channels. The goal is agents that complete a banking task, not just describe how to do one, while keeping the thread intact from chat to call to branch. Korea's big banks moving this from pilot to procurement is the signal worth filing. (Aug 31.)

Tool of the Day

🧭 Sonar Vortex

Give your coding agent a map of the codebase so it stops paying the grep-and-read tax.

A coding agent with no map explores your repo the expensive way: grep, read a whole file, grep again, read another, burning tokens and round-trips on navigation before it writes a line. Sonar Vortex sits under the agent with a code graph (Sonar calls the engine SemSitter) built from abstract syntax trees and control-flow analysis, so instead of scanning files the agent asks targeted questions, “who calls this, what does this depend on, where does this path go,” and gets a precise answer back. Sonar's own tests put the token-cost saving at up to about 36 percent, which is the vendor's benchmark, so treat the exact figure as a starting point rather than a promise. The mechanism is the honest part: a semantic query beats a blind file read on both cost and the odds the agent misreads the code and breaks your build.

Read the Sonar writeup

Worth a Click

• The research under today's lead: a paper on deterministic pre-action authorization for autonomous agents: check every tool call against an explicit policy before it runs, rather than logging the damage after. It is the academic version of the JetStream idea, and a good read if you would rather understand the pattern than buy a product built on it.
• Agent wallets cap the payment, not the sequence: Cloudflare's agent wallets (early August) let you set an allowance, an allow-list, and a maximum size on any single payment over the x402 rails. The controls stop at the single payment and leave the sequence to whatever sits above them. Same lesson as the lead: a limit on one action is not a check on the pattern of actions.
• Reviewers wave AI code through: a study of AI-generated pull requests found they carry more redundant, duplicated code than human ones, and that reviewers show less negative sentiment when approving them. The clean surface buys goodwill the code has not earned, and the debt lands quietly. One study, so grade it, but the failure mode rings true if you have merged an agent's PR lately.

The control keeps moving to a finer grain. Identity told you who the agent is. A certification told you someone else vouched for it. This week the question got specific: should this exact action, in this exact sequence, run right now. Every tool that shipped is a different answer to that one question, and the honest part is that most stacks can still only see the single click, not the sequence it belongs to.

— Ron