Agentic Systems — Research Brief (2026-09-19)
Key Developments
Microsoft's MCP Firewall preview turns protocol governance into enforceable policy
- What changed: Microsoft moved its MCP Firewall for Entra Agent ID into public preview, adding network-level controls.
- Why it matters: Enterprises now get a concrete enforcement point for agent-to-resource access policies on MCP.
- Sources: [8] [Tier 2 sources only]
OpenAI turns its internal Codex agent harness into a public API
Salesforce validates cross-vendor agent interoperability at production scale
Academic research offers a faster, auditable alternative to OAuth for agent delegation
Execution-time authority checks eliminate unsafe agent actions in controlled tests
- What changed: University of Hong Kong-affiliated researchers found planners without execution-time authority checks acted unsafely in all 32 trials.
- Why it matters: Authorization visibility, not reasoning capability, appears to be a key safety lever for agent planners.
- Sources: [17]
Notable Papers / Models / Tools
| Item | Date | Source | Summary |
|---|---|---|---|
| CAPMAS: Capability-Based Delegation of Privileges in Multi-Agent Systems | Sep 6, 2026 | [15], [16] | See KD4 and Technical Deep-Dive. EPFL / Swisscom (Veski, Guerraoui, Froelicher) — Tier 1. Macaroon-based capability tokens plus contrastive-learning semantic scoping replace continuous IAM synchronization for multi-agent delegation. |
| Beyond Agent Harnesses: Cross-Substrate Authority for Multi-Agent Systems | Sep 8, 2026 | [17] | See KD5. University of Hong Kong-affiliated (Li, Volkov, Liu et al.) — Tier 1. Identifies the "cross-substrate authority gap" where authorization state lives outside planner-visible memory; a controlled ablation shows planners take unsafe actions 32/32 times without an execution-time authority check versus 0/32 with one. |
| Mo' Models, Mo' Problems: How to Best Select Model Pools When Designing Multi-Agent Systems | Sep 17, 2026 | [18] | NVIDIA / University of Copenhagen-affiliated (Marjanović, Xu et al.) — Tier 1. Systematically tests 8 model-selection strategies across routing and voting MAS architectures; finds expanding a heterogeneous model pool frequently underperforms the single best base model. |
| Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems | Sep 14, 2026 | [19] | Unaffiliated preprint, unverified. Audits 32,000 worker descriptions across three public agent marketplaces and shows a single crafted third-party worker description can drop GAIA task success from 84.31% to 37.25% before the worker is ever invoked. |
| Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems | Sep 15, 2026 | [20], [21] | Industry-affiliated (Emergence AI), single-vendor source with limited independent pickup. Eight parallel 10-agent worlds ran 16 days and ~50 billion tokens; no world resisted all three adversarial stress events (injection, misinformation, memory exposure), and threat detection did not prevent agents from acting on it. |
Technical Deep-Dive
CAPMAS targets a specific architectural gap that most agent-identity discussions gloss over: today's multi-agent systems either propagate the end user's own credentials down an agent chain, which collapses accountability and creates over-privilege that compounds with every hop, or force every delegation step to synchronously check back with a central IAM provider, which adds latency and communication overhead that scales badly with agent-tree depth [15].
The architecture's novelty is combining two previously separate mechanisms. First, a contrastive-learning semantic scoping pipeline built on a BGE-large text encoder maps a natural-language agent query to a bounded, top-k set of privileges before any code executes, rather than relying on statically declared scopes. Second, each of those privileges is embedded into a Macaroon, a cryptographically chained capability token originally a Google 2014 construction, that lets every downstream agent in a delegation chain only narrow the token's authority by appending caveats, never widen it [15]. Because attenuation happens locally rather than via a round-trip to the identity provider, the reported gains are substantial: CAPMAS claims roughly 30x faster delegation operations, 2x lower delegation latency, and up to 3x lower bandwidth than OAuth 2.0 Token Exchange [15].
For a regulated-finance reader, the significance is less the specific speedup and more the pattern: this is a working demonstration that least-privilege, tamper-evident, offline-verifiable delegation is achievable for LLM agent chains without inventing a new identity standard from scratch, reusing a well-understood capability-token primitive layered with semantic scoping. That is directly relevant to model-risk and access-control reviews of multi-agent deployments, where "which agent had authority to do what, and can it be proven after the fact" is currently answered ad hoc. The limitations are real: results come from simulated-network benchmarks at a single institution, the semantic scoping pipeline retrieves the exact privilege bundle in only just over 90% of cases, and Macaroon-based capability infrastructure is unfamiliar to most enterprise IAM stacks built around OAuth/OIDC. This is a promising architecture pattern, not yet a deployable product [15], [16].
Landscape Trends
- [Agentic Systems × LLM Production Infrastructure] MCP is shifting from a connectivity spec into a contested governance control plane. Independent trade coverage now describes four distinct, competing governance layers bolted onto the same open protocol within a single week: build-time policy (Cisco-adjacent tooling), runtime management (WSO2/NVIDIA), data-security (Rubrik), and credential brokering (Google/Microsoft) [5], [6], [7], [8]. Enterprises adopting MCP for interoperability should not assume governance interoperability follows automatically.
- [Agentic Systems × Safety, Assurance & Governance] Agent identity and delegation authority, not reasoning capability, is now the convergent research and product frontier. CAPMAS and Beyond Agent Harnesses independently produced quantified evidence that authorization state living outside an agent's visible context is the actionable failure mode, sharpening the identity/authorization concern flagged in the 2026-08-26 and 2026-09-13 Agentic Systems briefs with before/after ablation numbers rather than architectural proposals alone [15], [17].
- Emergence World's finding that detection did not prevent containment failures across all eight tested long-horizon multi-agent worlds reinforces rather than resolves the failure-attribution gap that dominated the 2026-09-07 and 2026-09-13 briefs (DCFA, Adaptive Influence Graphs, Testing Interchangeability); attribution tooling is improving faster than actual containment behavior [20], [21].
- [Agentic Systems × Enterprise GenAI Adoption] Production-scale agent deployment is outrunning the standards it depends on. Adecco's 27,000-employee Agentforce Coworker rollout and OpenAI's newly public Agents API are both being marketed the same week the underlying interoperability and identity layers, including MCP governance and Agentic AI Foundation working groups, are still actively being negotiated among vendors [9], [14], [1], [22].
- A2A's move under the Agentic AI Foundation continues to mature institutionally rather than technically this cycle. Independent reporting now details eight formally constituted AAIF working groups spanning Governance/Risk/Regulatory Alignment, Identity & Trust, and Observability & Traceability, institutional plumbing catching up to the vendor-led governance land-grab described above [22].
Vendor Landscape
Dreamforce 2026 (Sep 15–17) was a major vendor event for this topic: Salesforce launched AIforce, a cross-harness interface layer, expanded its Anthropic partnership via a Claudeforce open beta with 37 prebuilt skills, and deepened Salesforce–Google Cloud interoperability via MCP, alongside a MuleSoft Agent Fabric keynote positioning orchestration and observability as a dedicated control plane with IBM watsonx Orchestrate integration [4], [9]–[13]. In the same week, Rubrik shipped MCP support co-engineered with Anthropic for its Security Cloud [7], Microsoft moved an MCP Firewall for Entra Agent ID into public preview [8], and NVIDIA added named-provider credentials to its OpenShell sandboxing layer [6], a concentrated, multi-vendor push to attach governance and credential controls to MCP. Separately, OpenAI opened its Agents API to all developers in public beta, exposing its Codex-derived orchestration harness (sessions, sandboxes, subagents) as a standalone product with sandbox partners including Cloudflare, Modal, and Vercel [1], [2].
Sources
- OpenAI (Sep 2026) — https://openai.com/index/introducing-the-agents-api/ [Tier 2 — vendor primary]
- OpenAI Developers (Sep 2026) — https://developers.openai.com/api/docs/guides/agents-api/overview [Tier 2 — vendor primary]
- CellCog (Sep 2026) — https://cellcog.ai/blog/openai-agents-api/ [Tier 3 — independent commentary]
- Salesforce / Google Cloud (Sep 15, 2026) — https://www.salesforce.com/news/stories/salesforce-google-cloud-unify-infrastructure-and-agents/ [Tier 2 — vendor primary]
- Forkast (Sep 2026) — https://forkast.news/mcp-is-becoming-the-governance-surface-three-enterprise-vendors-shipped-policy-enforcement-through-the-protocol-this-week-2/ [Tier 2 — independent trade press]
- Forkast (Sep 2026) — https://forkast.news/google-ships-a-managed-agent-harness-with-credentials-that-never-touch-the-sandbox/ [Tier 2 — independent trade press]
- StorageNewsletter (Sep 16, 2026) — https://www.storagenewsletter.com/2026/09/16/rubrik-adds-new-mcp-support-to-expand-access-to-agentic-cyber-resilience/ [Tier 2 — trade press]
- Forkast (Sep 17, 2026) — https://forkast.news/microsoft-entra-agent-id-expands-with-mcp-firewall-adding-network-level-control-to-agent-governance/ [Tier 2 — independent trade press]
- CIO Dive (Sep 2026) — https://www.ciodive.com/news/salesforce-launches-aiforce-interface-layer-agentic-architecture/830479/ [Tier 2 — enterprise tech news]
- Salesforce Ben (Sep 2026) — https://www.salesforceben.com/salesforce-launches-aiforce-at-dreamforce-26-ai-replaces-the-ui/ [Tier 2 — trade press]
- Unite.AI (Sep 2026) — https://www.unite.ai/salesforce-unveils-aiforce-live-interface-layer-at-dreamforce/ [Tier 2 — enterprise tech news]
- Moor Insights & Strategy (Sep 2026) — https://moorinsightsstrategy.com/field-notes/at-dreamforce-2026-salesforce-goes-all-in-on-agentic-ai/ [Tier 1 — analyst research]
- Unite.AI (Sep 2026) — https://www.unite.ai/anthropic-releases-salesforce-in-claude-plugin-with-37-sales-skills/ [Tier 2 — enterprise tech news]
- AI News (Sep 15, 2026) — https://www.artificialintelligence-news.com/news/agentforce-coworker-adecco-group-rollout/ [Tier 2 — enterprise tech news]
- arXiv:2609.06500 (Sep 6, 2026) — https://arxiv.org/abs/2609.06500 [Tier 1 — EPFL / Swisscom]
- DEV Community (Sep 2026) — https://dev.to/reidmarlow/dont-hand-the-child-agent-the-user-jwt-277k [Tier 3 — independent commentary]
- arXiv:2609.08472 (Sep 8, 2026) — https://arxiv.org/abs/2609.08472 [Tier 1 — University of Hong Kong-affiliated]
- arXiv:2609.17306 (Sep 17, 2026) — https://arxiv.org/abs/2609.17306 [Tier 1 — NVIDIA / University of Copenhagen-affiliated]
- arXiv:2609.15516 (Sep 14, 2026) — https://arxiv.org/abs/2609.15516 [Unaffiliated preprint, unverified]
- arXiv:2609.17320 (Sep 15, 2026) — https://arxiv.org/abs/2609.17320 [Tier 2 — industry-affiliated, Emergence AI]
- Digital Applied (Sep 2026) — https://www.digitalapplied.com/blog/emergence-world-multi-agent-safety-eight-worlds-results [Tier 3 — independent commentary]
- diginomica (Sep 2026) — https://diginomica.com/what-googles-a2a-joining-agentic-ai-foundation-means-enterprise-agent-architecture [Tier 2 — independent journalism]