Four vendors shipped four different pieces of the agent control plane this week. Nobody shipped all of it.

1. The week in one screen

This is the Saturday architecture read for the business week of Monday, September 7 through Friday, September 11, 2026. Friday's edition covered where the capital went. Today covers what the week actually changed inside a regulated operator's reference architecture.

The single most useful way to read the week is this. The agent harness, the loop that manages context, calls tools, recovers from failure and coordinates subagents, stopped being a differentiator and became a purchasable service. OpenAI put its Codex harness behind one API call and charges nothing extra for it beyond tokens and tools consumed. Source C01. At the same time, the control plane around that harness, the part your regulator, your CISO and your model risk committee actually care about, stayed fragmented across four vendors who each solved a different quarter of the problem.

Read those four together and a pattern falls out. The cost of running an agent is collapsing. The cost of evidencing an agent is not. That gap is where every regulated deployment now stalls, and it is the gap this edition is about.

2. The agent control plane, and who shipped what

An agent in production needs six things that a chatbot never did: a harness, an identity, a bounded network, a custody model for its logs, a replayable record of its actions, and a human checkpoint before consequential action. This week's announcements land on four of those six. The remaining two are still, in every case we have reviewed, the buyer's problem.

What OpenAI shipped

The Agents API entered public beta on September 10, 2026. It exposes the managed harness behind Codex: session orchestration, automatic context compaction as a session approaches its limit, tool search that loads tool definitions on demand, programmatic tool calling, and multi-agent delegation to parallel subagents that hold their own context. Developers choose the compute environment, an OpenAI-hosted sandbox, their own infrastructure, or one of nine named partner sandboxes. The harness itself is the open-source Codex harness, so the coordination logic is inspectable. VERIFIED C01.

What is worth your attention is the pricing statement, not the feature list. OpenAI says there are no additional fees for the Agents API beyond the tokens and tools an agent consumes. VERIFIED C01. When the orchestration layer is free, the differentiated engineering moves up into your tools, your data contracts and your evidence pipeline. Teams that spent 2025 and early 2026 building bespoke harnesses should read that as a signal to retire that code and redeploy the people onto controls.

Customer results published alongside the launch are company-reported and should be treated as such. SafetyKit reports a 60 percent reduction in cost per case after migrating a case review workflow, and Hypha, working in financial services, reports an 86 percent reduction in failed agent responses after separating the harness from the sandbox. Both figures come from the vendor's own launch page and have not been independently reproduced. CITED C01.

What Anthropic shipped

Enterprise Frontier Safeguards, announced September 1, 2026, addresses a problem that has blocked frontier model adoption in regulated firms for a year: the conflict between zero data retention and the retention you need to detect misuse that unfolds across many sessions and accounts. Anthropic's answer is to keep the detection but move the custody. Activity data used for monitoring can live in the customer's own cloud account, Amazon S3, Azure Blob Storage or Google Cloud Storage, under the customer's own encryption keys and audit logging. Detection flags route to the customer's security team. No Anthropic human review is required. Customer-owned storage, customer-managed keys and fully automated review are each opt-in. VERIFIED C03.

Anthropic states it developed the design with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail and the public sector, and with the Analysis and Resilience Center for Systemic Risk, whose membership includes chief information security officers of the largest United States banks. VERIFIED C03. Rollout is phased and Anthropic says it is targeting broad availability later this fall, which means this is an announced capability on a stated timeline, not a shipped general-availability product as of today. Plan accordingly.

The same week, Anthropic published threat intelligence describing disruption of attempts to misuse Claude, including five cases involving research that could support biological weapons development. In one case an operator in an unsupported region used virtual private server infrastructure to access Claude and spent weeks planning avian influenza mammalian-adaptation experiments. The report also describes a suspected Russia-linked group using the model across phishing, Wi-Fi hijacking and messaging-account takeover operations targeting Ukraine. CITED C04.

What xAI and Google Cloud shipped

xAI opened Grok Bot to enterprises on September 3, 2026 with access, network and audit controls. The audit surface is the notable part: audit logs covering admin, security and authentication events, action recording of what bots actually did, and OpenTelemetry export so the record streams into the monitoring stack an enterprise already runs. Grok and Cursor Enterprise customers were offered two weeks of organization-wide access. CITED C07.

Google Cloud extended VPC Service Controls to Agent Gateway deployments created after September 8, 2026 that use the agent connectivity template, alongside general availability of Agent Runtime and Agent Identity in the Gemini Enterprise Agent Platform. CITED C09. That is the network-boundary piece, and it is the one most often missing when a proof of concept fails its first architecture review.

Put the four together and the practical conclusion is unglamorous. The OpenTelemetry export from one vendor, the customer-held object storage from another, and the VPC boundary from a third do not compose themselves. Somebody has to define the event schema that makes an agent action reconstructable months later, and no vendor is going to define it for you across a multi-model estate.

3. The frontier ledger, global

Equal treatment, factual only. Announcements below are what the named party said or what named outlets reported, with the distinction marked.

Policy, and the argument the labs are having in public

Massachusetts remains the live state-level test. The Senate passed an economic development bill in late July 2026 carrying AI guardrails aimed at frontier developers above 500 million dollars in AI-derived revenue or above 1 billion dollars in research and development spend, requiring publication of safety frameworks focused on catastrophic risk, giving enforcement to the state attorney general, and opening a study into independent evaluations. Anthropic supports the language. OpenAI and Google oppose it, with OpenAI arguing for alignment to an Illinois-style annual third-party audit instead of a state-by-state patchwork. The bill was in bicameral negotiation as of late August 2026 and the final text may differ materially. CITED C17.

In the European Union the picture is settled rather than pending, and that distinction matters for planning. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026. It defers standalone Annex III high-risk obligations to December 2, 2027 and Annex I embedded-product obligations to August 2, 2028. The August 2, 2026 milestone that did take effect covered Article 50 transparency obligations only. VERIFIED C10.

4. Regulated-industry read

Financial services

The win. OpenAI introduced ChatGPT for Financial Services on September 10, 2026, shaped by design partnerships with Morgan Stanley and Evercore, starting in investment banking and equity research. The product ships with indexed premium data from providers including Daloopa, PitchBook, LSEG News, Crunchbase and Fiscal.ai, granular citations that let an analyst trace a figure back to the table and footnote it came from, entitlement integrations in progress with S&P Capital IQ, LSEG, MSCI, Dow Jones Factiva and Moody's, and more than 50 connectors. On the governance side it carries SAML single sign-on, SCIM provisioning, role-based access control, configurable workspace retention, compliance log export, and multiple workspaces to enforce information barriers. VERIFIED C02.

The constraint. The supervisory guidance your model risk team runs on does not cover this. The Federal Reserve, OCC and FDIC issued revised interagency model risk management guidance on April 17, 2026, designated SR 26-2 and OCC Bulletin 2026-13, superseding SR 11-7. The revised guidance states that generative and agentic AI are novel and rapidly evolving and are not within its scope, with the agencies signaling a forthcoming request for information. CITED C11. The clearest available direction on autonomous agents comes from FINRA: narrow scope, defined permissions, complete audit trails of every action taken, and explicit human checkpoints before consequential actions execute. In Singapore, MAS has published Safeguards for Agentic Finance at Runtime. CITED C11.

The control. Write your own agent standard now and make it look like the FINRA shape, because the examiner conversation is coming and an absent federal rule is not a defense. The specific control we would put in first: a hard distinction in your architecture between agents that retrieve and draft and agents that commit, with separate identities, separate network egress policy, and a mandatory human approval event recorded in the same audit stream as the action itself. Granular citation features of the kind now shipping in the research tooling make the retrieve-and-draft tier defensible. They do nothing for the commit tier.

Healthcare

The win. The evidence base for ambient clinical documentation has moved from vendor testimonial to randomized trial. NEJM AI published a 24-week stepped-wedge, individually randomized pragmatic trial across ambulatory clinics in two states, with 66 health care practitioners randomly assigned to three six-week sequences of ambient AI, using coprimary outcomes of professional fulfillment and work exhaustion from the Stanford Professional Fulfillment Index, with secondary measures covering note time, work outside work, documentation quality and billing diagnostic codes. CITED C16. That is the design a clinical governance committee can actually evaluate.

The constraint. Regulatory scope tightened in definition even as it loosened in rhetoric. FDA issued updated final guidance on Clinical Decision Support Software on January 6, 2026, replacing the September 28, 2022 version. Software that supports a clinician's decision using well-understood clinical data, and generates recommendations the clinician reviews and finalizes, can sit outside device regulation. Software that analyzes medical images, signals or patterns, relies on continuous or near-continuous measurement, makes real-time or near-term predictions, addresses emergent clinical scenarios, or effectively drives diagnosis or immediate clinical action, generally remains under device oversight. CITED C15.

The control. Most agentic healthcare programs we see are built as one system with one risk rating. That is the error. The FDA line runs straight through the middle of a typical build: the scheduling, intake, prior authorization and documentation-draft paths are one regulatory object, and anything that touches an image, a waveform or a time-critical alert is a different one. Split the architecture at that line on day one, with different logging, different validation evidence and different change control, or you will end up applying device-grade change control to your appointment reminders and clinician-review-grade governance to your imaging triage.

Manufacturing

The win. Humanoid robotics crossed from pilot into contracted commercial work at one documented site. Following a ten-month pilot in which Figure 02 units supported production of more than 30,000 BMW X3 vehicles at Plant Spartanburg, BMW and Figure moved to a commercial contract covering an initial fleet of forty Figure 03 units across body shop and assembly workstations, with the robots picking components from large unsorted containers into sequencing trolleys for just-in-sequence delivery to assembly workers. CITED C14. On the model side, NVIDIA has Isaac GR00T N1.7 in early access with commercial licensing and has previewed GR00T N2. CITED C18.

The constraint. The task envelope is narrow and honest observers say so. Current deployments cover material handling, bin picking and simple assembly, not the high-speed, high-precision welding and stamping that defines most automotive and electronics line work, and cycle times and reliability remain below what conventional industrial robots cleared a decade ago. CITED C14. Reported commercial pricing around 25 dollars per robot-operating hour comes from trade coverage rather than either party and should not be used in a business case without confirmation. FLAG C14.

The control. Model the economics on the workstation, not the robot. The honest unit of analysis is cost per sequenced kit delivered at a target defect rate, compared against the fully loaded cost of the human or fixed automation doing it today, including the integration and safety engineering you will spend once and the recurring cost of keeping a general-purpose platform validated as its model updates. A humanoid that is cheaper per hour and slower per cycle is not cheaper.

Energy

The win. Capital is now underwriting long-dated clean firm power rather than just buying certificates. Google's Finland commitment is paired with a 22-year power agreement with the utility Fortum and a stated intent to explore business models that could support new nuclear reactors at Fortum's Loviisa site. VERIFIED C05. That structure, a 22-year offtake used as the financing anchor for new generation, is the template other hyperscale buyers are likely to copy, and it is the one utilities can actually build against.

The constraint. Large computational loads are now a documented reliability problem, not a forecasting one. NERC issued a rare Level 3 "Essential Actions" alert on May 4, 2026 after repeated events in which more than 1,000 megawatts of computational load dropped off the bulk power system within seconds, and had earlier launched Project 2026-02 on Computational Loads on March 18, 2026. Its 2026 State of Reliability report documents 2025 incidents in which more than 1 GW of data center demand disconnected within moments of transmission disturbances. CITED C13. On the interconnection side, FERC directed six major grid operators at its June 18, 2026 open meeting to show how large loads connect in a timely and orderly manner, how queues are managed, how new substation and transmission costs stay off residential bills, and how data centers cover the grid work tied to their own connection. The 30-day report and 60-day tariff windows had both elapsed by September 3, 2026. CITED C12.

The control. If you are an industrial or utility operator with AI ambitions, put the ride-through behavior of your own compute load on the risk register alongside the model risk. The NERC alert is about load behaving badly during a disturbance, and that is an electrical engineering control, not a data science one. Ask your colocation provider, in writing, what its load does during a voltage excursion, and get the answer before you sign.

5. Physical AI and the robotics reality check

The useful discipline here is to stop arguing about whether agentic AI or robotics "works" and start asking what rung of that ladder a specific claim sits on. A randomized trial in ambulatory clinics and a vendor launch-page percentage are both real information. They are not the same kind of information, and a committee that treats them identically will either over-buy or under-buy, usually both in the same quarter.

6. Implementation architecture: the assembled control plane

Here is the reference shape we would put in front of a regulated client on Monday, built from what actually shipped this week rather than from a roadmap. It has five layers and it deliberately assumes a multi-model estate, because every client we work with runs at least two frontier providers and none of them intends to consolidate.

Scenario planning, three futures for the next two quarters

7. What we would do Monday

1. Inventory the harness code you can now delete. Any in-house context compaction, retry or subagent orchestration is now available as a managed service at no incremental fee beyond tokens and tools. VERIFIED C01. Redeploy that team onto Layer 4.
2. Open the storage and key work for agent activity logs. If you want customer-held monitoring custody when it becomes broadly available, the bucket, the key management policy, the retention schedule and the access review are yours to build and they take longer than the integration. VERIFIED C03.
3. Write the consequential-action list. One page, named owner per line, for each business domain. Every entry gets a recorded human approval requirement. CITED C11.
4. Split the healthcare architecture at the FDA line. Separate the review-and-finalize paths from anything analyzing images, signals, continuous measurement or driving immediate clinical action, with different logging and change control on each side. CITED C15.
5. Ask your colocation or cloud provider what your load does during a voltage excursion. Get it in writing. NERC has documented gigawatt-scale computational load dropping off in seconds. CITED C13.
6. Re-run your robotics business case per workstation. Cost per sequenced kit at a target defect rate, not cost per robot hour, and treat trade-reported hourly pricing as unconfirmed. FLAG C14.

8. FAQ and did-you-know

If the harness is free, where does the cost go?

Into tokens, tools and the evidence layer. OpenAI states there are no additional fees for the Agents API beyond tokens and tools consumed, and that sandbox storage and egress are billed by whichever cloud provider hosts the environment. VERIFIED C01. In the deployments we have reviewed, the log pipeline and its retention are the line item that surprises finance, not inference.

Does the EU deferral mean high-risk classification work can wait?

No, and the sequencing argues against it. Annex III obligations moved to December 2, 2027 and Annex I to August 2, 2028. VERIFIED C10. But the classification exercise itself is the input to your United States supervisory conversation, your customer due diligence questionnaires and your insurance renewal, all of which arrive sooner.

Did you know: the guidance your model risk team runs on says it does not cover your agents.

SR 26-2 and OCC Bulletin 2026-13, issued April 17, 2026 to supersede SR 11-7, explicitly place generative and agentic AI outside their scope, with the agencies signaling a request for information to follow. CITED C11. That is not permission. It is an unfilled space that your own standard has to occupy.

What is the single most common architecture mistake you see right now?

Treating retrieval agents and action agents as one system with one identity. The moment an agent that drafts a memo shares an identity, a network policy and a log stream with an agent that can move money or change a production schedule, every control you have collapses to the weaker of the two. Separate them before anything else.

9. Sources and research base

Every figure in this edition maps to an identifier below. Chips mark confidence: VERIFIED means named, dated and publicly checkable; CITED means named source, not independently re-verified; FLAG means contested or imprecise and pending re-verification.

• C01 OpenAI, “Introducing the Agents API,” September 10, 2026. Primary, page read directly. Customer percentage results on that page are company and customer reported. https://openai.com/index/introducing-the-agents-api/
• C02 OpenAI, “Introducing ChatGPT for Financial Services,” September 10, 2026. Primary, page read directly. Design partners, data providers, benchmark scores and governance controls as stated by the vendor. https://openai.com/index/introducing-chatgpt-financial-services/
• C03 Anthropic, “Developing Enterprise Frontier Safeguards with our customers,” September 1, 2026. Primary, page read directly. Rollout is phased with broad availability stated as a fall target, so this is an announced capability on a stated timeline. https://www.anthropic.com/news/enterprise-frontier-safeguards
• C04 Anthropic threat intelligence reporting on disrupted misuse, September 10 and 11, 2026. Bloomberg, “Anthropic Says Iran, Russia Used Claude for Weapons Research,” and independent coverage. https://www.bloomberg.com/news/articles/2026-09-11/anthropic-says-us-adversaries-aimed-claude-at-weapons-research and https://www.algemeiner.com/2026/09/11/anthropic-disrupts-bioweapons-research-efforts-russian-hacking-chinese-claude-misuse/
• C05 Google Finland AI infrastructure commitment, announced September 9, 2026. CNBC and Bloomberg, two independent outlets. Euro and dollar figures reported as at least 13 billion euros and about 15.1 billion dollars. https://www.cnbc.com/2026/09/09/google-finland-ai-infrastructure-investment.html and https://www.bloomberg.com/news/articles/2026-09-09/google-plans-13-billion-ai-infrastructure-investment-in-finland
• C06 Microsoft data center capacity plan, reported by Bloomberg on September 10, 2026 citing people familiar with the plans. Not a company announcement; treated as a report. Data Center Dynamics summary. https://www.datacenterdynamics.com/en/news/microsoft-targets-38gw-of-data-center-capacity-in-2032-report/
• C07 xAI Grok Bot enterprise rollout with access, network and audit controls, announced September 3, 2026. Trade coverage; not independently re-verified against a first-party release. https://alphasignal.ai/news/xai-pushes-grok-bot-into-enterprise-with-audit-controls-and-free-trials and https://www.technobezz.com/news/xai-adds-enterprise-controls-grok-bot
• C08 SpaceX acquisition of Anysphere, maker of Cursor, agreed June 16, 2026 and reported closed August 14, 2026. Transaction value and revenue figures are as reported and company-reported respectively. https://techfundingnews.com/spacex-buys-anysphere-cursor-60b-all-stock-xai-enterprise-ai/ and https://valueaddvc.com/company/cursor
• C09 Google Cloud, Gemini Enterprise Agent Platform release notes; VPC Service Controls support for Agent Gateway deployments created after September 8, 2026 using the agent connectivity template. https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes
• C10 EU AI Act Digital Omnibus. Parliament endorsement June 16, 2026; Council final approval June 29, 2026; Regulation (EU) 2026/1744 published in the Official Journal July 24, 2026 and in force July 27, 2026; Annex III deferred to December 2, 2027 and Annex I to August 2, 2028. https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai and https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/
• C11 United States and international financial supervision of AI. SR 26-2 and OCC Bulletin 2026-13, April 17, 2026, superseding SR 11-7, with generative and agentic AI stated as out of scope; FINRA positioning on autonomous agents; MAS Safeguards for Agentic Finance at Runtime. https://www.globalpolicywatch.com/2026/04/uk-financial-services-regulators-approach-to-artificial-intelligence-in-2026/ and https://www.lightico.com/blog/finra-agent-governance-banks/
• C12 FERC action on large load interconnection, June 18, 2026 open meeting; six major grid operators directed to report and to justify or revise tariffs; 30-day and 60-day windows elapsed by September 3, 2026. https://techcrunch.com/2026/06/18/ai-data-centers-just-got-a-government-mandated-fast-lane-to-the-grid/ and https://www.americanactionforum.org/insight/ferc-data-center-orders-accelerate-grid-connection/
• C13 NERC reliability actions on computational loads. Level 3 Essential Actions alert issued May 4, 2026; Project 2026-02 Computational Loads opened March 18, 2026; 2026 State of Reliability documents 2025 incidents of gigawatt-scale data center load disconnecting during transmission disturbances. https://www.datacenterknowledge.com/energy-power-supply/nerc-flags-ai-data-center-grid-risks-in-report and https://www.climatesolutionslaw.com/2026/04/nerc-launches-project-2026-02-to-address-reliability-risks-from-computational-loads/
• C14 BMW Group and Figure at Plant Spartanburg. Ten-month Figure 02 pilot supporting production of more than 30,000 X3 vehicles; commercial contract for an initial fleet of forty Figure 03 units; component picking into sequencing trolleys for just-in-sequence delivery. Reported hourly pricing is trade-sourced and unconfirmed by either party. https://www.automotiveworld.com/news/bmw-group-brings-figure-03-humanoid-to-spartanburg/ and https://www.bmwgroup.com/en/news/general/2024/humanoid-robots.html
• C15 FDA, Clinical Decision Support Software final guidance issued January 6, 2026, replacing the September 28, 2022 version; criteria distinguishing non-device CDS from device-regulated functions. https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-software-medical-device and https://www.faegredrinker.com/en/insights/publications/2026/1/key-updates-in-fdas-2026-general-wellness-and-clinical-decision-support-software-guidance
• C16 NEJM AI, pragmatic randomized controlled trial of ambient artificial intelligence and practitioner well-being; 24-week stepped-wedge individually randomized design, 66 practitioners, ambulatory clinics in two states, Stanford Professional Fulfillment Index coprimary outcomes. https://ai.nejm.org/doi/abs/10.1056/AIoa2500945
• C17 Massachusetts frontier AI provisions in the Senate economic development bill, passed late July 2026, in bicameral negotiation as of late August 2026. Boston Globe and Insurance Journal coverage of the Anthropic, OpenAI and Google positions. https://www.bostonglobe.com/2026/06/26/business/anthropic-massachusetts-ai-regulations-bill/ and https://www.insurancejournal.com/news/east/2026/08/20/882315.htm
• C18 NVIDIA Newsroom, physical AI model releases including Isaac GR00T N1.7 early access with commercial licensing and the GR00T N2 preview. Performance comparisons are company-reported. https://nvidianews.nvidia.com/news/nvidia-releases-new-physical-ai-models-as-global-partners-unveil-next-generation-robots