There is a kind of progress that looks like an answer and is actually a narrowing of the question. The last six weeks of the agent market are exactly that. Nine vendors shipped a way to govern AI agents — observe them, secure them, attest them, deny them by default outside the model loop — and in doing so they answered, comprehensively, a question that was never the hard one. The hard one is still sitting where it has always sat: on your side of the contract. It is the capability decision, and the nine planes just proved, by their silence, that you cannot outsource it.

This is the Way Pointer view of why the most important enterprise-AI decision of the next decade is the one no vendor built a product for — and why the week that made governance a commodity made that decision more visible, not less.

Nine planes in six weeks

Start with what actually happened, because the pace is the point. In roughly a six-week window, the agent governance plane went from a credible differentiator to a checkbox. Microsoft named the open control specification and the estate-wide control plane at Build. Workday extended its system of record into attestation with Agent Passport — testing, verifying, and monitoring every agent against recognised security and risk frameworks. Salesforce shipped a cross-vendor governance control plane. ServiceNow opened its control tower's action layer to every agent in the enterprise. IBM previewed a next-generation multi-agent control plane and framed its sovereign offering as "operational independence." Google consolidated its agent tooling into a single build-govern-optimise surface. AWS made its agent policy engine generally available — deny-by-default, gateway-enforced, outside the model loop — and extended it into its government cloud. Below them, the model and deployment layers moved in lockstep: a new frontier model landed inside everyone else's plane, and the leading deployment venture booked its first named enterprise references.[^1]

Nine planes. One six-week window. The same structural move. When that many serious vendors converge on the same capability in the same quarter, the capability is no longer a moat. It is the floor. Governing agents is now table stakes — the price of being in the conversation, not a reason to win it.

And here is the rule that the convergence makes unavoidable: when a capability commoditises, differentiation moves up a layer. It always has. The layer it moves up to this time is the one no vendor plane can occupy — the customer-side decision about which capabilities should be agent-delivered at all, which should be owned, which should be rented, and which should never be externalised wholesale. The planes are racing to govern how agents run. The question of which work is even yours to govern is structurally above all of them.

What Build named — and what it could not

Microsoft Build, 2-3 June in San Francisco, is the cleanest illustration in the field, because Microsoft did two things at once that look contradictory and are not.[^2]

First, it named the governance plane as an open, portable specification — the Agent Control Specification, in Microsoft's own framing an open industry contract for placing deterministic safety and security controls at five checkpoints in an agent's lifecycle: input, model, state, tool execution, and output. A versionable, auditable, framework-agnostic YAML contract. This is the most elegant articulation of the governance plane anyone has shipped. It is also, read precisely, a tool that answers exactly one question: is this agent safe to run?

It cannot ask the other question. By construction, an open specification for controlling an agent's runtime behaviour has no place to express whether that capability should have been delegated to an agent in the first place, or who in your organisation owns the work the agent is now doing. The specification governs the how. The whether and the who are not in its schema. They are in yours.

That is the gap. And because the specification is open and genuinely well-made, the gap is more dangerous, not less — this is the Sovereignty Product Trap in its purest published form. An open, portable control contract feels like the customer is in control. The control is real. But it is control over the vendor's runtime, expressed as the vendor's spec, running on the vendor's substrate. Feeling sovereign is not the same as being sovereign. Substrate Sovereignty is what the vendor sells. Capability Sovereignty — the discipline that decides which capabilities to keep, which to rent, and which to refuse to externalise at all — is the question the open spec cannot ask.

The second thing Microsoft did at Build is the tell. It began practising capability sovereignty on itself. It shipped a seven-model in-house family — a reasoning model plus image, code, voice, and transcription models — built, in the coverage's characterisation, for "long-term self-sufficiency," while Foundry keeps hosting OpenAI, Anthropic, Mistral, Meta, and the rest.[^3] We treat the self-sufficiency framing as a characterisation of the reporting, not a verified vendor quote. What is not in dispute is the shape: the substrate vendor is open inward — it hosts every rival on its plane — and sovereign over its own — its core models, its control plane, its billing. It is asking itself the build-versus-rent question across its entire stack, and answering it deliberately.

The symmetrical question for the customer writes itself. Where am I building my own capability, and where am I renting someone else's — and is that split a decision I made, or a decision that happened to me? Microsoft is doing customer-side capability discipline on itself, in public, at its flagship event. Most of its customers are not doing it at all.

The decision the planes can't make for you

It is worth being exact about what the capability decision is, because the nine planes are loud and the decision is quiet, and quiet things get crowded out.

Every plane in that six-week wave is optimised for its own vendor's optionality. That is not a criticism; it is the design. Salesforce's fabric governs cross-vendor agents inside the Salesforce plane. Workday's attestation is a vendor's attestation of agents running through the vendor's system of record. AWS's policy engine is the most architecturally honest of the set — it enforces limits outside the model loop — and it still cannot see the capability decision the customer made before any agent existed. The planes answer "how do we run this safely?" None of them answers "should this be an agent at all, and if it is, whose capability is it?"

Attestation is the clearest tell of where this goes. Workday extending its system of record into attestation is a genuine advance — and it is still a vendor's attestation of a vendor's agents. The question it cannot answer is who owns the attestation standard, and which agents are mission-critical enough that the customer must attest them itself, against its own definition of acceptable, rather than inheriting the vendor's. When governance commoditises, the contest moves to attestation. When attestation commoditises, it will move again. The only layer that never commoditises is the one the customer owns — because it is the one defined by the customer's strategy, not the vendor's roadmap.

This is the work Transformation Capability Management exists to do. Owning a capability once — standing up a clever agent, buying the open-spec plane, even building an in-house model family — is not the same as owning the capability to keep deciding: a standing system, with named owners, that classifies which work is defensible and must sit above any single vendor's substrate, which work is standardised and can flow through whichever plane is currently cheapest and most reliable, and which work is precisely correct to delegate. The decision is not a one-time architecture choice. It is a discipline that has to survive every new plane, every model swap, and every vendor's next compelling reason to govern one more layer on your behalf.

Two registers reached the same gap this week

We are not the only voice arriving at this. This week, two independent registers reached the customer-side capability territory from opposite directions — and the convergence is the validation.

From the engineering side came the sharpest practitioner signal of the week, published against the launch of a new frontier model: the harness is the product. "Your durable advantage is not access to one model. It is the system around the models." "The best teams can swap models without losing their operating system." "Fund harness infrastructure, not just model access."[^4] Read those three lines against the nine planes and the convergence is exact. Where Microsoft asks "build or rent?" of itself, this argument tells the customer to ask the same — and hands over the inventory to do it with. The enumerated system around the models — source data, evals, workflow design, review gates, prompts, internal tools, the integration layer, governance, the cost ledger, and human judgment — is the closest populated customer-side checklist any independent practitioner has produced. The instrumentation that survives a model swap is the standing capability. Everything else is rented. The same source named the cost discipline in a line built for a board pack: if your strategy depends on one vendor staying ahead forever, it is not a strategy, it is a bet.

From the opposite altitude — the chief executive's, not the engineer's — came the exponential-organisation argument, which addresses the boardroom directly. A growing chorus of exponential-strategy voices now argues that organisations must stop adding AI to human-shaped workflows and instead rebuild themselves around intelligence — an "AI-native" operating model with a continuous sensing-to-learning loop wrapped in a real-time governance plane. They are right about the destination, and right that roughly four-in-five AI projects stall because they bolt intelligence onto a legacy org — the magnitude claims here are the proponents' own, attributed to them, not asserted by us.[^5] But naming the destination is not the same as reaching it. The decisive question is not whether to rewrite the organisation around intelligence — it is which capability you own when you do, and whether your organisation can absorb the change at a rate it can sustain. Own the intelligence stack, govern it, and absorb it deliberately — or rent it, and join The 77 Percent.

What that abundance argument leaves open is the value-add the discipline supplies: absorption rate as a managed constraint rather than a gesture; capability ownership as a standing system with named owners, not a one-time build; the decision discipline at the boundary that makes "within bounds" enforceable and auditable; and sovereignty that survives any single vendor — including the methodology vendor itself, lest the customer trade one lock-in for another. The thesis architects the engine. The discipline lets the organisation absorb it, own it, and govern it after the adviser leaves the room.

Two registers, opposite altitudes — the engineer's harness and the chief executive's operating-model rewrite — converging on the same customer-side capability gap in the same week, neither one occupying it. The territory is still open. It is open because it is the one layer none of these voices, and none of the nine planes, was built to own. It is yours.

What this asks of you

The pace will not slow. There will be a tenth plane, and an eleventh; attestation will commoditise and the contest will move; the open specification will get more elegant and the in-house models more capable. None of that changes the shape of your decision. It only raises the cost of not having made it deliberately — because every plane you adopt without first deciding what is yours quietly migrates one more capability from your hands to a vendor's roadmap, and migrations are far harder to reverse than they are to prevent.

The full cross-vendor reading of this week — the nine-vendor convergence, Build's open specification and in-house models, and the two external registers that reached the customer-side territory — sits inside The Capability Brief — Edition 11 and on the intelligence page.

Your Waypoint

One agent. One column. Thirty minutes.

Pick the single AI agent your organisation is closest to putting into live, consequential work — the one a vendor plane is about to govern for you. Draw two columns. In the left column, write what the governance plane decides: where it runs, what controls fire at which checkpoint, who is alerted when it misbehaves. That column will fill quickly; the vendor has done excellent work. In the right column, write the answers to three questions the plane never asks: Should this work be agent-delivered at all? Who in our organisation owns the capability this agent is performing — by name? If this vendor's plane disappeared tomorrow, what would we have to be able to do ourselves?

If the right column is thin, you have found the decision you have been outsourcing without deciding to. That column is Capability Sovereignty, and no plane — open, portable, elegant, or otherwise — will ever fill it in for you. Nine vendors just spent six weeks proving it. The fill is yours to write.

References

[^1]: The nine-plane convergence: Microsoft (Agent Control Specification + Agent 365 for local agents, Build, 2-3 June 2026); Workday (Agent Passport, 2 June 2026); Salesforce (Agent Fabric); ServiceNow (AI Control Tower, open action layer); IBM (multi-agent control plane preview + sovereign offering, Think 2026, 5 May 2026); Google (consolidated enterprise agent platform); AWS (agent policy engine general availability, deny-by-default, gateway-enforced, government-cloud availability); plus the model layer (a new frontier model available across major clouds, 2 June 2026) and the deployment layer (first named enterprise references). Vendor newsrooms and primary blogs as cited in The Capability Brief — Edition 11, 8 June 2026.

[^2]: Microsoft, Microsoft Build 2026: Be Yourself at Work, Official Blog, 2 June 2026; Microsoft Foundry Blog, What's New in Microsoft Foundry, Build 2026 (Agent Control Specification — deterministic controls at five lifecycle checkpoints: input, model, state, tool execution, output; hosted-agent platform general availability early July 2026). Build 2026 held 2-3 June, Fort Mason Center, San Francisco.

[^3]: GeekWire, Microsoft Unveils Seven Homegrown AI Models in Bid for Long-Term Self-Sufficiency, 2 June 2026; CNBC, Microsoft Unveils New AI Models to Lessen Reliance on OpenAI, 2 June 2026. The "self-sufficiency" and "lessen reliance" framing is a characterisation of the coverage, attributed here, not a verified direct quote. The structural fact — Microsoft hosting every rival model on its substrate while building its own — is not in dispute.

[^4]: Independent practitioner analysis, The Harness Is the Product, 3 June 2026. The "system around the models," "swap models without losing your operating system," "fund the harness," and "not a strategy, it is a bet" framings are the practitioner's own; the structural mapping to Capability Sovereignty is ours, used with attribution and without claim of endorsement.

[^5]: Exponential-organisation / abundance-strategy register — the AI-native operating-model thesis (own the AI-native stack; roughly four-in-five AI projects stall when intelligence is bolted onto a legacy org). The magnitude claims attached to this argument — headcount reductions, extraordinary annual improvement multiples — are the proponents' own assertions, without audited provenance, and are attributed to them rather than asserted as fact. June 2026.

The Way Pointer is published by BusinessGPS — the transformation capability platform helping organisations make strategic choices about what they build, what they buy, and what they own.