Every item today is a constraint somebody chose to add. OpenAI stopped internal work on its unreleased Astra model after it crossed a threshold the company had named in advance. Cloudflare shipped a browser for agents whose defining feature is what it refuses to render. The Pentagon cleared Salesforce agents for controlled unclassified data and limited them to summarising and answering. Octopus published staged rollout for agent automation at ten, fifty, then a hundred percent. And ViveReply deleted the global fallback that let a query slip out of its own tenant. Five items, dates marked on each.
OpenAI paused its next model after it crossed a cybersecurity threshold
OpenAI suspended internal development on parts of Astra, its unreleased next model, after a review found it had reached what the company calls a critical cybersecurity threshold — able to independently identify and carry out cyberattacks against traditionally well-protected real-world systems. The response was not a patch. It was stricter security controls, a halt on internal activity that does not meet the enhanced guardrails, and testing with government agencies and outside safety organisations before the work resumes. Read as a graph, this is a human approval gate placed at the highest level a company has: the node is capable, the edge downstream is closed, and a person decides when it opens. It is also the first time a frontier lab has publicly stopped its own capability work at a named threshold rather than shipping and mitigating afterwards. Whether the threshold sits in the right place is a separate question from whether having one written down in advance is right.
Cloudflare shipped a browser that omits everything an agent does not need
Kitesurf is an agent-first browser running entirely on Cloudflare Workers — Blitz’s modular rendering engine, Firefox’s Stylo CSS parser, and Boa, a Rust ECMAScript engine — reachable through Browser Run. What it leaves out is the point: no themes, no tabs, no extensions, none of the surface a browser grows for human eyes. Cloudflare reports it is significantly cheaper in CPU and memory than Chromium for the things agents actually do, which is taking screenshots and extracting HTML. This is Module 0’s minimum-necessary-architecture rule applied to a dependency rather than to a graph: an agent driving a full browser is paying for a rendering stack built for a species that is not looking at it. Strip the node down to its contract and the cost follows.
The Pentagon cleared agents for sensitive data, and drew the line at routine
The Defense Department authorised Salesforce’s Missionforce platform for Impact Level 5 data, letting autonomous agents work in Army HR operations — answering routine inquiries and summarising case histories. The authorisation is notable less for the clearance than for its shape. IL5 is controlled unclassified information, and the permitted actions are bounded, reversible and reviewable: summarise, answer, retrieve. Nothing described authorises an agent to decide anything. That is a permission boundary written by a customer with real consequences for getting it wrong, and it is a better template than most vendor governance material: name the data class, name the verbs, and let the agent have exactly those and nothing adjacent.
Staged rollout arrives for agent automation, at ten then fifty then a hundred
Octopus published a working tutorial for progressive rollout of agent-driven automation — ten percent, then fifty, then everything, with a model step categorising commits and containment controls at each stage. There is nothing novel in the technique; it is how software has shipped for two decades. What is new is applying it to a node whose output is non-deterministic. A canary exists to bound blast radius when you cannot predict failure by inspecting the thing beforehand, which describes a model considerably better than it describes a deploy. If you run an agent that writes to production, a percentage gate is probably the cheapest correctness mechanism available to you, and unlike an evaluation harness it requires nothing to be built first.
The multi-tenant bug that agents make worse
ViveReply described a refactor to session-bound workspace resolution, deleting global fallback lookups so that every query is scoped to a membership the caller actually holds. The failure it removes is old and boring: a lookup that, finding nothing in the current scope, quietly widens to the global one and returns another tenant’s row. What changes when the caller is an agent is the blast radius. A person hitting that path sees one wrong screen and files a bug; an agent hitting it enumerates, summarises, and carries the result into a context window that then shapes its next tool call. Scope the query at the boundary rather than inside each handler, and the whole class stops being reachable — which is the same reason a node’s contract belongs in the edge, not in its body.