What the platforms ship around agents, what they leave open, and where the checkpoint belongs.

Anthropic describes what it saw across several enterprise deployments: every team shipped its own subagent, the architecture became a copy of the org chart, and everyone added a sentence to the system prompt. A single agent with skills frequently did better on quality there, often at lower cost and latency; for one customer it ran roughly twice as fast. Subagents stay for three cases: measurable context bloat, parallel work, trouble choosing tools. The line that matters most to me is organisational: one small central team owns the system prompt and end-to-end quality, and domain teams contribute skills and tools. That is a question of decision rights before it is one of architecture. Anthropic sells the platform for this, which is worth keeping in mind.

With the Code API, agents in Slack open their own code channels: the agent brings in the right people and files, posts its progress and archives the channel when it’s done. Everyone can see what the agent is doing and who approved it, and the agent inherits the permissions of the channel it works in. The sentence that matters is quieter: a person “can” approve each high-stakes change. Whether they must, and who decides what counts as high-stakes, the tool leaves open. That remains a decision inside the company.

On the same day Microsoft introduced the harness its Copilot products run on: Microsoft runs the agent loop and the sandbox, and customers bring the instructions, tools and choice of model. GitHub Copilot Fusion decides per request which models do the work; administrators set which models Fusion may use and whether it is the default. GitHub reports that Fusion Max scores 60 on Artificial Analysis’s Coding Agent Index at about half the cost per task. What matters more than the number is where model choice now sits: in an IT policy. Neither text says anything about approval or an audit trail.

David Cramer describes how he steers Junior, the agent he built at Sentry. His experience: take away an agent’s freedom and it becomes much less capable, and instructions in the system prompt or AGENTS.md rarely hold. So he enforces the rules outside the agent, in a proxy between the sandbox and the network. The proxy checks each request against a policy and only then adds the credentials. When the agent opens a pull request from the command line, it gets a refusal that points it to the right tool. That is how Junior can’t approve a pull request, even though its GitHub token could. There are no numbers; Cramer reports from his own operation. Which permissions the agent has is set here by a policy inside the company. The token’s scopes are only the ceiling.

Hanjing Shi and Dominic DiFranzo went through 63 public documents on agent systems and recorded which controls they describe clearly. Tool mediation and traces showed up often, in 40 and 37 of them. A checkpoint before a consequential action showed up in 6, a way to roll back in 2. Their line: an agentic system is not accountable merely because its actions are logged, and a checkpoint after the payment or the sent message records consent too late. The sample was chosen on purpose and says nothing about how common controls are in deployed systems. Next to this week’s announcements the study still reads like a checklist: the platform supplies the log. Where the checkpoint sits is for the company to decide.