Open roadmap

Security teams investigate incidents in Splunk, Datadog or the SIEM they already run. Each allowed or denied call, each token exchange and each harness login reaches it as an OpenTelemetry log record or a signed webhook, with the agent, the person, the tool, the result and the Reference code.

Today each rule evaluates a single call. A finance agent needs a running cap, such as $1,000 in refunds per day for each customer. We will add up the agent's calls per subject and per time window, and deny the one that goes over the limit. With trusted attributes, the same rule weighs history alongside context.

A large refund or a production deploy deserves a second look before it happens. Besides ALLOWED and DENIED, a rule will get a third result: the call waits until the person in charge signs off. The request uses open standards, CIBA for approvers away from the agent and the MCP elicitation URL mode for people in the harness.

In large companies, the identity provider admin approves apps for the whole organization. The MCP Enterprise-Managed Authorization extension, stable since June 2026, brings this to agents with ID-JAG (Cross App Access): one central grant, and each person connects a harness with no consent screen. It comes later because few identity providers support ID-JAG so far.