Between September 2 and 3, several vendors shipped variations on one idea: the place to enforce what an agent may read and do is inside the loop, per action, not in a log you read afterward.
JetStream's Clearance is the clearest statement of it — reported as a reasoning engine that evaluates and authorizes every agent action before it executes, blocking dangerous sequences such as exfiltration patterns rather than only logging them after the fact. AccuKnox's AgentZ bundles sandboxes, role-based access, runtime credential injection and audit traces, deployable SaaS, on-prem or air-gapped. Genesys added an AI Control Plane to Genesys Cloud for observability and governance, alongside Navigator and Orchestrator, which stitch intent, context and policies into a plan. And ChainIT published a white paper arguing for separating authentication, delegated authority, proposal and final execution — CTO Matt Koepp's framing is that the agent proposes while deterministic controls decide whether the action falls inside scope.
Why this lands on retrieval teams
If you build knowledge systems you already enforce ACLs at index and query time: mirror source permissions into metadata, filter at search, re-check at render. That model assumes the unit of risk is a document. In agent loops it isn't. An agent can be entitled to every document it touches and still cause harm by composing them — read the account records, summarize into an attachment, send to an address supplied earlier in the conversation. Every hop passes its document-level check. The sequence is the violation.
The consequence for pipelines is concrete: retrieval has to emit more than chunks. Provenance and sensitivity labels need to survive summarization and hand-off, so a downstream gate can reason about what is actually in the context window rather than only about the tool call in front of it. Most RAG stacks discard exactly that at the synthesis step, which is why bolting on a gate later tends to produce either paranoia or blindness.
Two tradeoffs, pulling opposite directions
A reasoning engine in the inner loop is nondeterministic and taxes every tool call. AI Agent Store's own guidance on Clearance is to watch how often legitimate long-running jobs get paused — false-positive rate is the product. ChainIT's decomposition is the opposite bet: deterministic policy decides, the model only proposes. Deterministic controls are cheap, reproducible in an audit, and cannot see intent. A reasoning gate sees intent and cannot be replayed for a compliance reviewer. Nobody has shipped both halves convincingly.
The second problem is freshness. Sequence-level gating inherits the quality of the entitlement data beneath it, and connector-synced ACLs are usually hours behind the source system. A perfect gate over stale permissions is still wrong, just more expensively.
Who this matters to today: teams running retrieval across mixed-sensitivity corpora with any outbound tool attached — mail, ticketing, code push. Read-only, single-tenant assistants can wait. McKinsey's State of AI in 2026 found large enterprises scaling agents in at least one function rose from 27% to 40% while smaller firms stayed flat at 22%; this tooling is being built for the top of that curve, and priced accordingly.