KDCube
← AI Industry News

Agent Control Moves Into the App and Identity Layers

Oracle's Fusion Claw embeds a governed agent runtime inside the ERP where the model only proposes actions a deterministic layer validates and logs to an "Outcome Receipt," while SailPoint moves identity into the execution path with just-in-time access for people, service accounts, and agents. DigitalOcean shipped an agent learn-and-imp...

Highlights

  • Oracle's new Fusion Claw embeds a governed agent runtime directly inside the ERP, and it never lets the model write to records — the LLM only proposes actions that a deterministic layer validates against a customer-defined envelope, logging each run to an auditable "Outcome Receipt" (Oracle). (ERP Today)
  • SailPoint used Navigate 2026 to move identity into the execution path of agentic work: just-in-time provisioning replaces always-on access keys for people, service accounts, and agents alike, with "Autonomous Agents" that use identity context to tell legitimate automation from a threat instead of just killing the process (SailPoint).
  • DigitalOcean shipped Agent Learning Services (Insights, Signals, Evaluations & Simulations) in public preview on Oct 12 — a managed loop to record what an agent does, flag where it falls short, and test a fix before users see it (DigitalOcean).
  • OpenAI tightened workspace-agent admin controls for ChatGPT Business/Enterprise: per-role plugin access, and write actions defaulting to "Always ask" during an agent run (OpenAI).

Key Signals

  1. Oracle Fusion Claw lands the application layer's answer to agent middleware - technical brief + Oct 9 coverage
    Fusion Claw separates frontier reasoning (currently Gemini and OpenAI on OCI) from deterministic enterprise computation, governs each run through an "Enterprise Operating Envelope" of policies, risk thresholds, decision rights, and escalation boundaries, and arrives via 25 Claw-powered agentic apps — 21 of them shipping during October (Oracle). For operators, this is the first time native agent orchestration is embedded at a major ERP platform level rather than bolted on as standalone middleware (ERP Today).
  2. SailPoint reframes agent governance as an authority problem - Navigate 2026, week of Oct 6
    Rather than a static access check, SailPoint pitches runtime, identity-aware control: effective-privilege visibility, lineage, and JIT authorization applied to the moment an agent acts (SailPoint). The bet is that containment (last week's theme after Anthropic's unintended-action report) is only half the story — you also need to know who an agent is and what authority it carries when it executes.
  3. DigitalOcean productizes the agent improve-loop - Oct 12, ahead of its Open Intelligence Summit
    Agent Data Services (private preview) gives agents one managed place to read context and write back what they learn; Agent Learning Services turn those traces into evaluated improvements (DigitalOcean). It's a smaller cloud staking a claim that run-learn-improve should live on one platform, not three stitched-together tools.

Why It Matters / What To Watch

  1. Governance is moving from pre-launch review to the runtime — and now into the app itself.
    • Watch whether Oracle's "model never writes directly" pattern (propose → deterministic validation → receipt) becomes the default enterprise architecture, and who copies the Outcome Receipt as an audit primitive (Oracle).
    • If your agents touch ERP or finance data, map which actions must pass a deterministic policy gate versus which can execute on model judgment (ERP Today).
  2. Identity is becoming the enforcement point for agent actions, not just a login.
    • Inventory your service accounts and agent credentials for standing privilege; JIT-with-conditions is the direction vendors are converging on (SailPoint).
    • On OpenAI's side, audit whether workspace-agent write actions are left on "Always ask" or loosened per role before you scale usage (OpenAI).
  3. Build an observe-evaluate-improve loop before agents reach production.
    • Treat agent traces as first-class data: record actions, flag failures, and gate changes behind simulation — the capability DigitalOcean is now selling as managed services (DigitalOcean).

Quick Links