Identity is a runtime control, not a login event
NIST IR 8587, finalized 15 September, consolidates implementation guidance for protecting identity tokens, access tokens and assertions from forgery, theft and misuse. For agent systems this reinforces token lifecycle, verification, key management, revocation and continuous monitoring as part of delegated-authority assurance.
Microsoft's security fundamentals for the AI era reaches the same boundary from operations: govern agent identities and tools, isolate execution, restrict outbound paths, retain visibility and continuously reduce exposure. This supports existing MAIN controls rather than introducing a new primitive.
Monitoring has to exist before and after the effect
Anthropic's measurements of internal agent use describe roughly 30,000 concurrently active research and engineering agents on its most-used internal platform, constrained by online monitors that can block or steer actions and offline monitors that inspect activity after execution. The reusable design pattern is a two-speed monitoring plane with measurable coverage, review latency and escalation.
OpenAI's model misalignment reporting framework adds a complementary evidence discipline: record observed behavior, severity, setting, discovery path, uncertainty, investigation state, external impact and mitigation. For Harness, incident evidence should preserve what the agent did and what remains unknown—not only the final label.
New execution surfaces need their own qualification
NVIDIA's NeMo Labs Voice Agent now exposes a clearer ASR → LLM → TTS pipeline, streaming behavior, tool use and voice-agent evaluation milestones. It remains a Candidate/Watch reference implementation, but it exposes a missing discovery and control surface: multimodal agents need qualification across audio input, turn-taking, model/tool behavior, output speech and end-to-end latency—not only text prompts.
FINSKILLOPS converts recurring failures into candidate skill patches and promotes only a small subset after targeted validation, regression checks and negative controls. That is strong evidence for governed experiential adaptation: learned fixes remain candidates until they pass promotion gates.
ActGuard audits a candidate tool action before execution, comparing it with a locally reasonable tool prior and localizing suspicious parameters. The architectural delta is pre-effect validation of the proposed action itself, which complements content filtering and permission checks.
OpenAI Agents Python 0.22.3, vLLM Agentic API 0.8.0 and LocalAI 4.10.0 added maturity around approval binding, fail-closed resume, correlated telemetry, state/cost accounting, bounded concurrency and credential isolation. These are reference-implementation signals; presence in a library is not proof that a deployed system is qualified.