Weekly AI Tools That Matter to Me: Part 3, Week 32

The Week Nothing Was Launched and Everything Was Answered

I went into this week’s scan expecting to write about a model. That is what the last two editions did, and it is what the rhythm of this industry has trained everyone to expect. Instead I read three changelogs and found that between them, Google, Anthropic and OpenAI had shipped no new model, no new agent type, and no new autonomous behaviour at all.

My first reaction was that it had been a slow week. My second, after reading what they had shipped instead, was that this was the most informative week I have logged since starting this series.

Here is the whole list of consequential items. Antigravity added enterprise sign-in for Gemini Enterprise accounts and Workforce Identity Federation through Advanced SSO. Claude Desktop added the ability to route identity-provider sign-in through the operating system’s Microsoft Entra account broker, covering gateway credentials, Vertex workforce identity, and managed connectors. Gemini Enterprise made consumption billing generally available and shipped end-to-end tracing across its data-connector workflow.

Identity. Billing. Observability.

That is not a roadmap. I have sat through enough enterprise reviews to recognise what it actually is, which is a list of the objections that killed last quarter’s pilots, answered one at a time.

TL;DR

Google, Anthropic and OpenAI shipped no new model, no new agent type and no new autonomous behaviour. What they shipped instead was enterprise identity, tool-call tracing and consumption billing, which is not a roadmap but a list of the objections that killed last quarter’s pilots, answered one at a time.
Capability was never the blocker, and identity is where accountability attaches. Antigravity added Workforce Identity Federation, Claude Desktop added a sign-in path through the operating system’s account broker so it can satisfy Conditional Access policies requiring a managed device. An action taken under a shared service account is an action nobody performed.
Once a tool call is a trace span, the agent becomes auditable rather than merely trusted. Gemini Enterprise’s execute_tool and invoke_connector spans let someone who was not in the room reconstruct which system was touched, in what order and because of which prompt. Ask vendors whether tool invocations emit spans into your backend, not whether they log.
Two permission models are being built in parallel for the same blast radius, by teams that never meet. The agent side controls session-scoped approvals and sign-in policy, the platform side controls MCP session lifetimes and write boundaries, and nobody has published a joined-up answer. That junction is where I expect the first serious incident.

Capability was never the blocker

I want to state this plainly because a great deal of writing about agentic AI proceeds as if the constraint were intelligence.

Nobody I have worked with has ever blocked an agent rollout because the agent was not clever enough. The demos are fine. The demos have been fine for a year. What stops the rollout is a meeting in which three people ask three questions and nobody in the room can answer any of them.

Security asks who this thing is acting as. Platform asks what it actually called. Finance asks what happens if it runs all weekend.

Those are not unreasonable questions and they are not obstructionism. They are the ordinary due diligence that any system touching production data has always had to survive, and agentic tools have until now been unusually bad at surviving it. I made a version of this argument when I wrote about judging agentic marketing claims, and about the agentic MarTech architecture you cannot see. The gap between what these systems can do and what an enterprise can permit them to do has been the whole story, and capability was never the narrow end of it.

This week, each of those three questions got an answer. From three different vendors, in seven days, with no evidence of coordination. That is what a category looks like when it stops selling to enthusiasts and starts selling to procurement.

Take them in order.

Who is the agent acting as?

Antigravity 2.5.0 landed on the thirty-first of July with enterprise sign-in for Gemini Enterprise user accounts, complete with administrator controls, and Workforce Identity Federation via Advanced SSO. Four days later, Claude Desktop v1.25927.0 added a pair of configuration options, inferenceGatewayOidcAuthFlow and inferenceVertexWorkforceAuthFlow, which choose whether identity-provider sign-in runs in the system browser, which remains the default, or through the operating system’s Microsoft account broker on Windows and macOS. A third setting, managedMcpServers[].oauth.authFlow, extends the same choice to managed connectors.

Anthropic states the purpose directly: so that sign-in can satisfy Conditional Access policies that require a managed device.

If you have never had to implement Conditional Access, that sentence reads like a footnote. If you have, it reads like a door opening. Conditional Access is how a great many large organisations express the rule that a credential is only valid from a machine the company controls and can attest to. A sign-in flow that bounces through a system browser cannot make that attestation. A sign-in flow that goes through the operating system’s own account broker can. The difference between those two is the difference between an agent that can be deployed in a regulated environment and one that cannot, and no amount of model capability closes it.

The Antigravity item is the same thought expressed differently. Workforce Identity Federation means the agent can act under an identity issued by the enterprise’s own provider rather than one issued by the vendor. Two agentic development environments, in the same seven days, both building a path for the customer’s existing identity infrastructure to be the thing that authorises the agent rather than a parallel system standing beside it.

The reason this matters more than it sounds is that identity is where accountability attaches. An action taken by an agent under a shared service account is an action nobody performed. An action taken under a federated identity, with an attested device behind it, is an action with a name on it. Everything downstream, the audit trail, the incident review, the question of who authorised what, depends on that being true at the moment of sign-in rather than reconstructed afterwards.

What did it actually call?

The item I would underline from this week is four words long in the release note, and I suspect almost nobody outside a platform team will read it.

On the fourth of August, Gemini Enterprise added end-to-end tracing support for its data connectors, introducing two new trace spans. execute_tool represents the execution of a tool on the agent orchestration layer. invoke_connector represents the request logic and execution on the connector execution layer. Together they let you follow the parent-child relationship from the prompt a person typed all the way out to the third-party API it eventually caused, and search and filter that in Trace Explorer by service or span name like any other span in your system.

That reads like plumbing. I think it is closer to a change of status.

Right now, in most agentic deployments, tool calls are unobservable in the way that actually matters. You can see that the agent answered. You can usually see a log line somewhere. What you cannot reliably do, three months later, is reconstruct which system it touched, in what order, on whose behalf, because of which instruction. When something goes wrong the investigation becomes archaeology, and archaeology does not survive contact with a regulator or an incident review.

Once the tool call is a span, several things become true at once. It carries a trace identifier, so it joins the observability stack you already run rather than living in a vendor console. It has a parent, so causation is recoverable rather than inferred. It has a service name, so somebody can ask what this agent did to Salesforce last Tuesday and get an answer rather than an opinion. And crucially, all of that is available to someone who was not in the room, which is the only definition of auditability that means anything.

The distinction I keep coming back to is between an agent you trust and an agent you audit. Only one of those survives a compliance review, and until this week almost every product in this category was asking for the first.

If you are evaluating agent platforms this quarter, add a question to the list. Not “does it log”, because everything logs. Ask whether tool invocations emit spans into your tracing backend with the originating prompt as the root of the trace. The vendors who shrug at that question are telling you, quite precisely, which stage of the product they are at.

What will it cost?

On the first of August, Gemini Enterprise made its Pay-as-you-go edition generally available. No pooled user-licence quotas. An invoiced Cloud Billing account with a one-seat minimum, usage monitoring in the console, and monthly spend limits.

Seat licensing was always a poor fit here, and I think everyone involved knew it.

Agent-platform usage is not shaped like software usage. It is shaped like infrastructure usage. Three automations running nightly across a large document corpus can consume more than two hundred people using the assistant occasionally, and a per-seat contract prices precisely the wrong variable. You end up buying licences for people who barely sign in, while the workload that actually costs money runs under a single service account that the licence model does not really have a concept for.

Consumption pricing with a hard cap fixes both ends of that. Finance gets a ceiling instead of a surprise, which is the objection that kills more pilots than any technical concern. The team gets to start without a business case, because a one-seat minimum is not a procurement event. And the vendor’s incentive quietly realigns from signing seats to producing usage worth paying for, which is a healthier place for everyone to stand.

I am flagging this because pricing model is about to become a real line in agent-platform evaluations and most comparison grids have not caught up. If you are running a selection this half, put seat-versus-consumption next to the security questions rather than in the commercial appendix, because it is not a commercial detail. It determines which architectures you can afford to build. A design that fans out across a hundred documents per request is viable under one model and financially absurd under the other, and you want to know that before you design it, not after.

Whether Anthropic and OpenAI follow is one of the more interesting things to watch over the next two quarters.

Seventeen to one

There was a fourth item this week that nobody framed as governance, and I think it is the most revealing number in the whole scan.

In the same release cycle, Gemini Enterprise added seventeen new data stores in public preview: Attio, Cohesity, Descript, Fiscal.ai, Gamma, iManage, Moody’s, NetDocuments, Nexla, Oracle NetSuite, Pylon, S&P Global, Sanity, Supabase, Supermetrics, SurveyMonkey and Wix. Alongside them it added exactly one new write action, which is the ability to create ticket notes in Freshservice.

Seventeen ways to read. One way to write.

I doubt that ratio is an accident, and whether or not it is deliberate it is the correct instinct. Reading is recoverable in a way that writing is not. A bad retrieval produces a bad answer, and a human usually catches it because the answer looks wrong. A bad write produces a record, and other systems then treat that record as true, and the blast radius compounds quietly through every downstream process that trusted it. The asymmetry is real and most of the discourse about agent safety skips straight past it to talk about model behaviour.

That said, look at the list again, because read-only is not the same as consequence-free. Supermetrics and SurveyMonkey are marketing data. Attio is a CRM. Sanity and Wix are content systems. Moody’s and S&P Global are licensed financial data with contractual redistribution terms that somebody signed and probably nobody has re-read since. An agent with read access across that set has a fairly complete picture of a business, and the moment its output leaves the building in an email, “read-only” has stopped describing the actual exposure.

So the question I would take into an agent-platform review is not how many connectors there are. It is three narrower things. What is the read-to-write ratio today, and where is it heading. When write actions arrive at volume, what ships alongside them. And who approves a new connector inside my tenant, against what criteria, and can that person be me rather than a vendor.

Because the interesting release is not this one. It is the one where the ratio changes.

The two permission models that have not met

Which brings me to the thing this series has been circling for three editions now, and which got sharper rather than clearer this week.

There are two permission models being built in parallel, by two different sets of vendors, for the same blast radius.

On the agent side, the controls are about the agent’s own behaviour. Administrator keys that make tool approvals expire with the session, which Anthropic shipped last week. Review gates before an org-built agent can be published, which Microsoft shipped in July. Conditional Access on the sign-in, which arrived this week. These are configured by whoever owns the AI tooling, which in most organisations is IT or a platform team.

On the platform side, the controls are about what the connected system will expose. In the same seven days, MoEngage published explicit session lifetimes for its MCP surface, thirty days or seven days idle, managed independently of dashboard and mobile sessions. As far as I can tell from either of my watchlists, those are the first hard session-boundary numbers anyone has published for a vendor MCP server, and they sit inside the same release I wrote up on the MarTech beat this week, and they should become the benchmark question you put to every other vendor. Braze confines write access to content objects. Delight.ai launched an MCP server this week that includes write operations. These are configured by whoever owns the MarTech stack, which is a completely different team.

Two models. Two owning teams. One blast radius. And in every organisation I have looked at, no forum where those two teams meet to compare their assumptions.

That is where I expect the first serious incident in this category to come from. Not from a model doing something unexpected, but from an agent whose session-scoped approval expired in one system while its connector session remained valid in another, or from a write boundary that one team believed was enforced by the platform and the other believed was enforced by the agent. I wrote about the uncomfortably human shape of agentic loops partly because these systems fail in organisational ways rather than technical ones, and this is the most organisational failure mode I can see coming.

Nobody has published a joined-up answer. I would be genuinely glad to be told I am wrong about that.

What to ask

If you take one practical thing from a week in which nothing was launched, make it a set of questions rather than a shortlist.

Ask whether the agent can act under an identity your provider issued, and whether the sign-in can satisfy your device policy. Ask whether tool invocations emit spans into your tracing backend with the prompt as the trace root, and ask to see one. Ask what the pricing model does to a workload that fans out. Ask for the read-to-write ratio and the roadmap for changing it. And ask, of both your agent vendor and your platform vendor, what the session lifetime is on the connection between them, then check whether the two answers are the same number.

That last one is not a trick question. It is just a question that nobody is currently being asked, which is usually a reliable sign that it is the one worth asking.

A week with no new capability is not a slow week. It is the week you find out whether a category is being built for demonstrations or for deployment.

Sources

Vendor changelogs and release notes

Scanned and quiet this week

Cross-referenced from the MarTech series

MoEngage July 2026 product release notes, for the published MCP session lifetimes
Braze release notes, for the remote MCP server write boundary

The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the interpretation.

This article draws from the AI Tools Weekly Digest scans run on August 6, 2026, covering release notes and product updates across the major agentic work platforms. The dated record behind it is in AI Watch, Week 32.

If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.