Verified agent workflow assurance

Agent safety is moving outside the model and into an independent execution boundary. NVIDIA introduced an open platform that combines sandboxing, runtime policy and in-silicon monitoring; Scale is integrating it, Perplexity reports adversarially testing its own sandbox across nine models, and independent builders connect weak isolation to recent agent incidents. The market is no longer treating containment as a prompt feature: it is becoming a separate control plane that can observe and stop an agent even when the agent itself is compromised.

The agent security problem is moving below the prompt and into execution traces, policy enforcement and isolated tool access. MCP hijacking research, access-control frameworks, a dedicated MCP bastion and sandbox work all point to a control plane for what agents may call, carry forward and prove.

The control problem is moving beyond whether one model response is safe. Research is adding regression replay, claim-safe evaluation and tests for overclaiming, while industry work focuses on authorization boundaries for MCP tools and on incidents where agents hide or pass unsafe state between steps. This supports a growing control-plane market for trace analysis, policy composition, replay and independent evaluation.

A new class of failures is becoming visible: every individual action can pass a local check while the complete agent workflow violates authority, threshold or review rules. Research formalizes compositional policy violations, OpenAI discloses unexpected model behavior, and labs are considering embedded safety evaluators. The control point is moving from isolated outputs to the full execution trace and the independence of its review.

NVIDIA OpenShell uses formal proofs to establish that agent-proposed permission changes remain inside approved boundaries. Independent work adds a social harness for agents acting across principals, persistent adversarial worlds and runtime resilience checks for physical systems. AIUC's funding adds a capital signal around assurance and underwriting, not proof that these controls are already universal. Agent autonomy is creating a control market built around enforceable boundaries and evidence of safe execution.

SpendVeto enforces caps, nested budgets, human approval and a kill switch before x402 or MCP payments settle. It supplies a concrete implementation to a line already tracking independent agent-payment infrastructure across several days and sources. The aggregate line clears the publication threshold; the launch itself still has no disclosed transaction volume. Payment authorization is becoming a runtime policy rather than a checkout-only decision.

Agent control is moving inside the runtime rather than remaining an external monitoring layer. Bedrock AgentCore now handles ephemeral code sandboxes and end-user OAuth consent; ToolReplay seals and deterministically replays tool transcripts; OpenBot gives each AI coworker an isolated computer with an action log; and HazardAuditor tests computer-use agents against executable threats. The market-forming layer is a control plane for identity, policy, replay, isolation and auditability across long-running agent work.

Agent products are taking responsibility for verification, not only generation. Perplexity reports using GPT-6 Astra to change software and monitor production systems, Cognition describes Devin testing its own work, and Graphify C# supplies compiler-accurate semantic evidence for coding agents. The emerging product boundary is a runtime that can inspect, test and justify its actions before a human reviews the result.

Control is moving closer to the action. Agent-browser work emphasizes recorded, reviewable execution; production automation is adding safe target reconfiguration; and verifier-grounded training makes feedback part of the loop. Reliability is increasingly implemented in the runtime instead of left to user instructions.

Agent policy is becoming an executable runtime layer. New research tests whether non-technical users can author reusable permissions across email, files, payments and personal data; SPA enforces plan-first information-flow rules for persistent agents; and open implementations are adding provider-independent controls around tool calls and headless execution authority. Combined with the line's earlier policy-graph evidence, this is now a multi-day, multi-source movement and crosses the threshold from watch to published.

Two independent implementations treat policy as an executable, stateful workflow graph rather than a one-off safety check. If this pattern spreads beyond enterprise platforms and research prototypes, agent governance could become a dedicated authoring and runtime category.

Agent systems are entering workflows where a plausible answer is not enough. A tax-preparation pilot processed 7,000 returns and reduced preparation time by roughly one third, AWS documents end-to-end mortgage intake and state-aware betting support, an insurance builder pairs an LLM with deterministic legal rules, and a new PLC harness gates generated industrial code through compilation and live execution. The common product requirement is verified execution inside the workflow, not a generic copilot beside it.

AWS has made an agent payment layer generally available with spending guardrails, payment orchestration and observability. This strengthens the existing hypothesis that autonomous action is beginning to include controlled transactions, but it is still primarily a single-platform rollout. It needs independent payment-provider integrations or documented production buyer workflows before it becomes a published market signal.

A new framework recasts long-running agent actions in database terms: semantic atomicity, consistency, isolation and durability. The idea is notable because it treats an agent workflow as a transaction that must either preserve a valid state or recover safely, rather than as a sequence of best-effort tool calls. It is still a single research proposal; production runtimes, incident data or independent implementations are required before publication.