Agent Default Change Audit: 14 Dated Vendor Switches Hitting Your Stack by February 2027 · Enterprise Agentic AI Insights

Salesforce, Microsoft, Google, ServiceNow, AWS and Snowflake each changed a tenant default in 72 hours. The dated register, the owners, and the deployer evidence each one needs.

What the CIO is staring at this week

Open your change calendar for Q4. Count the agent-related entries your team put there. Now count the ones your vendors put there.

Between October 8 and October 14, six platforms changed what happens inside a customer tenant by default. Salesforce enabled the Agentforce platform in every org that has Agentforce access through a SKU, a license or an edition, and is removing the setting that used to control it. Google published that the Gemini 4 Argon toggle defaults to on beginning October 27. ServiceNow set Guardian moderation to logging-only mode for agents in Now Assist for ITSM. Microsoft confirmed usage-based billing goes on by default for new Copilot Business licenses through CSP on December 1, with a 4,000 credit per user monthly ceiling you inherit unless you set your own. AWS repriced AgentCore short-term memory to consumption with a 12 KB minimum billable event. Snowflake shipped named workload identities, up to ten per service user.

Not one of these is a capability launch. Every one is a change to the state your estate wakes up in, with a date attached, originating on a roadmap you do not control.

The register below has fourteen dated entries between October 9, 2026 and February 20, 2027. It is not a prediction. Every row is a vendor primary document.

The mechanic that is failing

Change control was built on a premise: a change to production is something somebody requests. Request, assess, approve, schedule, implement, verify. The artifact at the end is a record of a decision.

Vendor-set defaults invert it. The change is already scheduled. Your options are to notice it, or to be told about it by an auditor. There is no requester, so there is no assessment, so there is no approval record, so there is nothing to verify against.

Three details from this week show how sharp the edge is.

The off switch is being removed. Salesforce's release note says the Agentforce setting is being removed from the Agentforce Agents page "later in Winter '27," with no date published. The only documented way to refuse the platform is to turn off the Einstein setting on the Einstein Setup page, which disables all Einstein generative AI. Your choice is the whole capability or none of it. Agent-level control moves to activation state inside Agentforce Builder, which means your real inventory is now a list of active agents, not a platform flag.

The moderation layer watches and does not stop. ServiceNow's wording is exact: "Guardian is on in logging-only mode for agents and conversations. Guardian is on in blocking mode for skills." Skills get blocked. Agents get logged. If your mental model of that control was "it prevents things," the default says otherwise, and the default is scoped to Now Assist for ITSM rather than the platform.

The spend ceiling arrives pre-set. Microsoft's default spending limit is 4,000 Copilot Credits per user per month, adjustable by admins. At a hundred users that is up to 400,000 credits a month that nobody chose. The date already moved once, from November 2 to December 1, which is its own lesson about planning against a vendor calendar.

Meanwhile the same week produced two controls worth having. AWS Agent Registry now validates required fields and values on every record creation or update, which is the first vendor-native way to keep an agent register with owner and data classification that cannot rot quietly. Snowflake's named workload identities give each agent its own revocable credential instead of one shared service account. Both are opt-in. Neither turns itself on.

That is the shape of the quarter. The things that change your exposure are default-on. The things that reduce it are default-off.

Why this reaches the board

A default that switched itself on does not generate the evidence that a regulator asks for.

If an agent sits in a high-risk use and you are operating in the EU, switching it on makes you the deployer, and EU AI Act Article 26 attaches to you rather than to the vendor. Article 26 requires appropriate technical and organisational measures to use the system in accordance with its instructions for use (paragraph 1). It requires human oversight assigned to natural persons who have the necessary competence, training and authority (paragraph 2). It requires monitoring of operation, notification to the provider and suspension of use where a risk under Article 79(1) appears, and immediate notification of the provider and then market surveillance authorities on a serious incident (paragraph 5). It requires retention of the automatically generated logs for at least six months, or inside financial-services documentation if you are a financial institution (paragraph 6). It requires telling workers' representatives and affected workers before a high-risk system goes into workplace use (paragraph 7).

Read that list against a default-on change. The oversight assignment does not exist, because nobody was asked to make one. The worker notice did not happen, because there was no project to trigger it. The log retention policy was never set for a system that arrived on a Tuesday.

There is a second dated obligation with a harder edge. Anthropic's 2026 Usage Policy takes effect on November 12, 2026. Where Claude connects to hardware that can act physically and cause injury, a qualified operator must be able to observe the equipment and stop it, and the equipment must hold a safe state if Claude is disconnected. If you have an agent anywhere near industrial control, that is twenty-eight days to produce documented operator oversight, a tested stop and evidence of fail-safe behavior on disconnect.

The pattern a Chief Risk Officer should name out loud: vendors are shipping agent capability faster than agent control, and the gap lands on the deployer. AWS has shipped AgentCore features continuously while Bedrock Guardrails has had nothing since June. Google shipped a frontier model with a named prompt-injection number and nothing on Model Armor. Microsoft is holding agent governance for Ignite on November 17 to 20. The Vertex AI generative-AI documentation now carries a notice that it is no longer being updated, which means any governance runbook that cites "Vertex AI" by name is pointing at a frozen surface.

The move

You do not need a new framework. You need a register, four columns wide, kept current release after release.

One. Build the dated default-change register. One row per vendor-set change, with its effective date and the primary-source link. Fourteen rows is the honest count for an estate running Salesforce, Microsoft, Google, ServiceNow, AWS and Snowflake. Sort by date, not by vendor. The interactive register below builds your version in the browser; nothing is transmitted.

Two. Assign an owner before the date, not after. Each row gets one named person with the authority to decide. Article 26 paragraph 2 asks for competence, training and authority, and authority is the one most organizations cannot evidence. A distribution list is not an owner.

Three. Close the evidence gap per row, not per program. Three questions: is there a change ticket, is there a named owner, is the log retained and readable. Three answers per row. Fourteen rows is forty-two answers, and the count of missing ones is your actual exposure number. It is a number you can take to a board, which is more than "we are monitoring the landscape" has ever been.

Four. Turn on the controls that are default-off. Define the required Agent Registry metadata fields before teams fill them in freely. Map each agent to its own named workload identity so revocation is per agent rather than per service account. Decide deliberately whether logging-only is the Guardian posture you want in a regulated queue. These take days, not quarters, and they are the rows where you move from exposed to defensible.

Five. Re-forecast the two prices that change. Gemini 4 Argon introductory pricing of $2 input and $10 output per million tokens runs through November 30 and then reverts to $4 and $20. AgentCore short-term memory now bills per event against a 12 KB minimum, so a chatty agent with small turns pays the floor, and cost per task becomes a function of turn design. Any Q4 business case built on this month's numbers is wrong by Q1.

The quarter ahead is not short of agent capability. It is short of people who can say, on a given date, which agent is running, who said it could, and where the log is. That is the whole job.

---

Build your register

The Agent Default Exposure Register is interactive. Select the platforms you run, mark whether you operate in the EU and whether you are in a regulated sector, and it returns your dated rows, the evidence each one requires, and a live count of open gaps. Nothing is sent anywhere.

<div data-ariana-embed="agent-default-exposure-register"> <p><a href="/assets/tools/agent-default-exposure-register.html" target="_blank" rel="noopener">Open the Agent Default Exposure Register →</a></p> </div>

Next step

AI Readiness Brief. One week, principal led. You get your dated default-change calendar, an owner against every row, and the evidence gaps named in language your audit committee already uses. Book the brief

AEGIS Diagnostic. AEGIS, the Agentic Enterprise Governance and Intelligence Standard, measured against your current posture. Read the framework

---

Sources

  1. Salesforce, "Agentforce Platform Enabled by Default," Winter '27 release note (264). https://help.salesforce.com/s/articleView?id=release-notes.rnagentforceauto_enable.htm&release=264&type=5 (VERIFIED, C01)
  2. Salesforce, "Developer's Guide to the Winter '27 Release," October 5, 2026, final rollout October 9, 2026. https://developer.salesforce.com/blogs/2026/10/developers-guide-to-the-winter-27-release (VERIFIED, C01)
  3. Google Cloud, Gemini Enterprise release notes, October 13, 2026. https://docs.cloud.google.com/gemini/enterprise/docs/release-notes (VERIFIED, C02)
  4. Google Cloud, "Gemini 4 Argon available on Google Cloud," October 13, 2026. https://cloud.google.com/blog/products/ai-machine-learning/gemini-4-argon-available-on-google-cloud (VERIFIED, C11)
  5. Microsoft, Partner Center announcements, October 2026. https://learn.microsoft.com/en-us/partner-center/announcements/2026-october (VERIFIED, C03)
  6. Microsoft Entra, "What's new in Microsoft Entra, October 2026," October 12, 2026. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/what%e2%80%99s-new-in-microsoft-entra-october-2026/4556460 (VERIFIED, C18)
  7. ServiceNow, Now Assist Suite release notes, October 8, 2026. https://www.servicenow.com/docs/r/store-release-notes/na-suite-rn-2026-10-08.html (VERIFIED, C04)
  8. AWS, "Amazon Bedrock AgentCore memory consumption-based pricing," October 12, 2026. https://aws.amazon.com/about-aws/whats-new/2026/10/agentcore-memory-consumption-based-pricing/ (VERIFIED, C05)
  9. AWS, "AWS Agent Registry supports custom metadata on registry records," October 13, 2026. https://aws.amazon.com/about-aws/whats-new/2026/10/aws-agent-registry-custom-metadata-registry-records/ (VERIFIED, C07)
  10. Snowflake, "Named workload identity management for users," October 12, 2026. https://docs.snowflake.com/release-notes/2026/other/2026-10-12-named-workload-identity-management (VERIFIED, C06)
  11. Salesforce, "Winter '27 Release Architect Highlights," October 5, 2026. https://www.salesforce.com/blog/winter-27-release-architect-highlights/ (VERIFIED, C08)
  12. Salesforce, Knowledge Article 005132110, published October 9, 2026. https://help.salesforce.com/s/articleView?id=005132110&language=en_US&type=1 (VERIFIED, C08)
  13. Anthropic, "2026 Usage Policy update," October 8, 2026, effective November 12, 2026. https://www.anthropic.com/news/2026-usage-policy-update (VERIFIED, C09)
  14. EU AI Act Article 26, deployer obligations, consolidated text. https://artificialintelligenceact.eu/article/26/ (CITED, C10)
  15. Google Cloud, Vertex AI generative AI release notes, documentation no longer updated. https://docs.cloud.google.com/vertex-ai/generative-ai/docs/release-notes (VERIFIED, C-vertex)

Corrections applied before publication: Salesforce publishes no single Winter '27 GA date, and its developer blog gives a final rollout of October 9, 2026. The Gemini Argon custom-model-list exception applies to AI developer tools only and does not spare the web or mobile app from the October 27 default-on. ServiceNow's Guardian logging-only default is scoped to Now Assist for ITSM, not the platform. AWS has published nothing about migrating existing AgentCore customers to the new memory pricing, so no migration claim is made here. Snowflake does not state whether the ten-identity limit is adjustable, so no claim is made either way. Microsoft's November 2, 2026 date on the Partner Center page refers to Partner Center sandbox availability, not billing.

Open the formatted article on Ariana.Digital →