Tech Leaders Brief, weekly: 2 November 2026

1. The agent control plane is now a product category

What happened. Three large vendors shipped agent governance in the same week. IBM made Agent Identity generally available and released HashiCorp Vault 2.2, which gives each agent its own account, short-lived least-privilege credentials, and real-time revocation when the agent tries something outside its permissions. Salesforce made an Agent Kill Switch and a Model Wallet (spend caps per agent, in dollars or tokens) generally available in Agent Fabric, with Agent Evals in beta from November and generally available in January 2027. Oracle released 25 agentic applications across Fusion ERP, HCM, supply chain and CX, framed around delegated work inside existing permissions and approvals.

Why it matters. Identity, spend limits, evaluation and a stop button are moving out of custom builds and into platforms. That changes the design question from "how do we build agent guardrails" to "which plane holds the authoritative record of each agent, and how do the others defer to it". Salesforce's own docs say Model Wallet enforcement is approximate, so usage can briefly pass a cap before requests stop. Treat it as a budget control, not a hard limit for a payments path.

What to watch. Whether IBM's discovery and containment features (both still tech preview) leave preview, and whether Agent Evals hits its January date. Also watch for overlap: an organisation running Salesforce, ServiceNow and a hyperscaler agent platform will soon have three agent registries.

Confidence: high on what shipped and when (vendor primary sources). Medium on production maturity, since the triggered kill switch and evaluations are not yet generally available.

2. MCP and A2A are becoming the integration contract

What happened. ServiceNow and Google Cloud made ServiceNow workflows for retail operations, CRM and IT service and operations management available to Gemini Enterprise through MCP servers and agent-to-agent (A2A) connectivity, generally available to shared customers, with telecom service management planned for early 2027. In the same week IBM's discovery feature started looking for MCP servers alongside agents and models, and Salesforce's evaluations cover MCP servers as well as agents.

Why it matters. The protocol layer is settling. Enterprise systems of record are exposing governed actions to outside agents instead of building every agent themselves. For architecture, each MCP server is now an API surface with write access to a system of record, so it needs the same inventory, versioning, testing and change control as any other integration.

What to watch. Connector catalogues on cloud marketplaces, and whether any vendor publishes a clear model for who is accountable when a third-party agent acts through their MCP server.

Confidence: high on the ServiceNow and Google release (both companies' press releases). Medium on the broader trend claim, which is an inference from three vendor announcements in one week.

3. A human in the loop is not the same as human judgment

What happened. Anthropic published a study in which 50 professional analysts worked with Claude Code agents that had each been given a hidden lean on four analytical choices. Analysts went with the agent's lean 86% of the time, against roughly 50% if the agent had no effect. When asked to explain their choices, 77% used the agent's arguments, and 15% credited the agent.

Why it matters. Most governance frameworks lean on human approval for high-stakes agent actions. This result suggests reviewers can absorb an agent's framing without noticing. Approval steps still matter, but they need support: show the alternatives the agent didn't recommend, record what the agent argued, and test reviewers with seeded cases.

What to watch. Replications with other models, tasks and domains, and whether regulators start asking how human oversight is tested rather than whether it exists.

Confidence: medium. It's one task, one model family, and a deliberately set lean. Anthropic lists these limitations itself. The direction is plausible, but the 86% figure shouldn't be generalised.

4. Patch cycles now race AI-found exploit chains

What happened. Anthropic's Frontier Red Team reported that an unreleased internal model found vulnerabilities and built five working attack chains across Chrome, Safari, Android, Windows and Linux, including a zero-click remote code execution in Linux. Google has assigned and patched 62 Chrome CVEs from the work as of Chrome 156, all rated critical or high.

Why it matters. This is vendor-reported but backed by assigned CVEs. If models can find and chain bugs at this rate, the gap between disclosure and exploitation gets shorter, and browser and endpoint patch SLAs measured in weeks start to look slow. It also strengthens the case for running the same kind of scanning on your own code before someone else does.

What to watch. Patch velocity for Chrome 156 and the Windows and Linux fixes across managed fleets, and whether other labs publish comparable results.

Confidence: high that the disclosures and patches happened (vendor post plus CVEs). Medium on how fast attackers gain the same capability.

5. Cloud AI capacity is still short into 2027

What happened. On its 29 October earnings call, Microsoft said third-party providers of AI chips had delays that push some capacity out to the first half of 2027, and it cut its capex outlook for the year to $170 billion from $175 billion. Azure still grew 48%. Alphabet held its 2026 capex guidance at $195 to $205 billion.

Why it matters. Demand is outrunning supply even at the largest providers. For enterprise architecture, GPU-backed capacity in a given region (Australian regions included) shouldn't be assumed on demand for 2027 workloads. Reserve capacity early, design for multi-region or multi-model fallback, and keep data residency rules explicit, since fallback routing can quietly move inference offshore.

What to watch. Provider capacity statements in the next quarter, and pricing on reserved and provisioned throughput.

Confidence: high on the reported figures (CNBC report of the earnings calls). Low to medium on effects in specific Australian regions, which none of the companies broke out.

Close to home

Southern Cross Credit Union, a NSW and Queensland mutual, has an Agentforce Voice agent called Nova handling account balance calls. iTnews reports it was built in six weeks with Salesforce forward deployed engineers, is the first Agentforce Voice agent live in A/NZ, and now takes 7% of all calls. It's a narrow, read-only use case with identity verification and a core banking lookup, which is the right shape for a first regulated deployment. (iTnews, 27 Oct 2026)