The Agent Approval Gate Now Belongs to a Vendor

On 3 November, a security lead at a mid-sized company pulled two dashboards side by side. One, from the endpoint vendor, showed which commands an agent had executed on a laptop the night before, with timestamps on every process. The other, from the AI gateway, showed which model calls it made, how many tokens each cost, and which allowed list let it through. Neither dashboard could answer the only question his auditor had asked: who approved the payment. That approval happened inside an application classifier belonging to a third vendor entirely.

This is not an integration failure at one company. It is the shape of a structural shift that finished somewhere in the last eighteen months: agent authorization moved out of enterprise policy documents and into product code. Whoever owns the runtime now owns the gate, and whoever owns the gate writes the record of what the gate saw. Buyers get a ledger kept by someone else, in someone else’s format, covering only that vendor’s slice of the action.

Three announcements, roughly three weeks apart, describe the same movement from three directions.

On 21 October, Anthropic opened a research preview of Claude Duet, a proactive agent that sends a morning brief, watches your mail and calendar, and keeps working while you are away. Its safety promise is unusually concrete. Before it sends a message, makes a payment, signs a document, or deletes anything, it shows you what it is about to do and waits for approval. Some actions stay off-limits even with your approval, such as trading securities or moving money between accounts. The approval itself is delegated to the same model-based classifier that guards Claude Code. Source: Introducing Claude Duet.

On 25 June, DigiCert published a survey of 1,001 IT and cybersecurity decision makers in the United States, the United Kingdom, and Australia, fielded in May 2026. Seventy-eight percent reported experiencing AI-related incidents or identifying AI-related vulnerabilities. In the same sample, only half had a formal AI governance program, while 90 percent had discussed AI governance at the board or executive level. Source: DigiCert news release. A secondary reading splits that 78 percent and reports that about half of respondents had experienced an incident tied to an unauthorized or misconfigured agent in six months. That split appears in The Deep View’s reporting, reproduced by MarketScale, not in DigiCert’s own release. So treat it as a lead, not a quotable numerator.

On 3 November, at its Fal.Con Europe conference, CrowdStrike did three things in one day. It signed agreements to acquire Fiddler AI and Dreadnode, launched an AI Kill Switch, and put its Falcon sensor inside Anthropic’s Claude Cowork virtual machine. The Wall Street Journal reported a combined price of $495 million, roughly $400 million for Fiddler and $95 million for Dreadnode, mostly cash with some stock subject to vesting (WSJ, paywalled). CrowdStrike’s own announcements mention only definitive agreements and no figure at all. See Fiddler and Dreadnode. That distinction matters commercially: a reporter’s number is a market signal, a disclosed number is a fact a buyer can put in a file.

Put the three on one table and the direction is unambiguous. The model vendor builds the gate inside its own product. The security vendor buys observability and offensive testing into the same runtime and installs a sensor in the model vendor’s machine. The buyer, according to its own survey data, has the gate and not the governance program.

There are three enforcement points, and they do not see the same thing

To understand why two dashboards cannot produce one answer, look at where the gate actually sits. An enterprise can buy authorization at three positions today, and the positions do not share a clock or a vocabulary.

The first is the endpoint, where the action executes. CrowdStrike’s argument for this layer is written plainly in its launch release. Agent-level hooks see the prompt but not the model’s response, and cannot catch every action the agent takes. Network-only tools watch traffic but cannot stop the action, because the agent executes on the endpoint. And when an agent runs a local or open-weight model whose traffic never leaves the machine, network-only tools go blind. The company’s answer is a single sensor that connects what an agent was told to do, what it communicated, and what it executed. An endpoint network inspection feature then pairs the two. The agent-level hooks ship policy into the most widely used agent clients by name: Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor (release).

The second is the gateway, where model traffic passes. The Kill Switch does its first enforcement here: it terminates unauthorized agents, blocks them from running again, and cuts their access to models. Read the name literally and you will overestimate it. It cuts the line between the agent and the models behind it. It does not delete the agent’s code and does not revoke the credentials in its hands. For a company running agents on its own hardware, that is enough. For a company running agents inside somebody else’s virtual machine, the question becomes who holds the switch and what the contract says about it (release).

The third is inside the application, where the classifier decides. Duet’s four gates are not a row of rules in a configuration file. They are a model deciding, before each action, whether this step is what the user asked for. Anthropic describes the implementation more precisely in its engineering write-up on Claude Code’s auto mode. The transcript classifier runs on Sonnet 4.6 in two stages: a single-token filter that decides block or allow, then chain-of-thought reasoning only for transcripts the filter flags. It sees only user messages and the agent’s tool calls; the model’s own messages and tool outputs are stripped, making it reasoning-blind by design. A session that accumulates three consecutive denials, or twenty in total, is stopped and escalated to a human. In headless mode the process is terminated (How we built Claude Code auto mode).

Each position is sound. Together they are incoherent. The endpoint knows what the action was and where it ran, but not which sentence authorized it. The gateway knows which model was called and what it cost, but not whose money moved. The in-app classifier knows the user’s instruction and the tool call, but not what the same agent did on another platform ten minutes earlier. The artifact an auditor actually wants is one line that ties an action to its authorization and to the decision that allowed it. That line spans all three positions, and it is stored by three vendors who do not reconcile.

Approval moved from a click to a classifier, and the numbers explain why

Why hand the gate to a model at all? Anthropic’s engineering post offers an answer that is uncomfortable but honest: in practice, users accept 93 percent of manual permission prompts. Nine in ten confirmations never get read. That is not a user defect. It is what happens when a confirmation dialog appears more often than attention can absorb; approval degrades into ritual. The post calls it approval fatigue, then lists its own incident log to show the failure mode on the other side: remote git branches deleted after a misinterpreted instruction, an engineer’s GitHub token uploaded to an internal compute cluster, migrations attempted against a production database. None of it malicious. All of it overeager.

So the number a buyer should put in an acceptance clause is no longer “does the gate exist.” It is the classifier’s error rate and, more importantly, what the system does when it errs. Auto mode reports a 0.4 percent false-positive rate. Small, but read it with the design attached: a false positive costs one retry and a nudge to find another path, not a dead session. False positives are absorbed as noise, and only sustained disagreement escalates to a person. That design is reasonable, and it also tells you where the parameters live: with the vendor. Buyers see outcomes, not thresholds, and they see the thresholds change when a model is upgraded.

The harder point is what the classifier cannot see. Stripping tool outputs is a deliberate defense: injected content on a webpage should not be able to rewrite the judgment. The cost is that the action classifier cannot tell whether the input to that action was already poisoned. Anthropic covers that gap in a second layer. A server-side prompt-injection probe scans file reads, web fetches, shell output and external tool responses before they enter the agent’s context, tagging suspect content so the agent treats it as untrusted. One layer watches the input, one watches the action. That structure belongs in a procurement question: does your gate judge the action only, or the action and its input?

The refusal list shows who owns the boundary

Beyond the four gates, Duet carries a list of things it will not do even with your approval: trading securities, moving money between accounts. That list explains more than the gates do. The four gates are configurable in principle. An enterprise can add a rule such as two-person approval before an outbound contract. The refusal list is not configurable. It is decided by the product team, hard-coded into the product, on the grounds that these actions are irreversible and the brand risk lands on the platform.

So the boundary is cut in two. The configurable half belongs to the enterprise; the fixed half belongs to the platform. In a contract, you can negotiate the first half and only accept or switch vendors on the second. On a consumer product that distinction is invisible. In an enterprise audit it becomes a live disagreement, because internal audit asks which actions are impossible in the system, and the honest answer is a supplier document rather than the company’s own policy.

What buyers should ask instead

For two years the procurement question was whether the product has guardrails and an audit log. Both can now be answered yes, because platforms built the gate and the log into the product. Once the answer is yes, three questions take over.

Who decides. A rule, an allow list, or a model classifier? If a classifier, which model does it run on, and what happens to your process design when that model is upgraded and yesterday’s allowed action is today’s denial? This is not hygiene. The enterprise’s workflows were designed against yesterday’s behavior.

What does it see. Judging only the user message and the tool call, versus also judging tool outputs, are different security postures with different failure modes. The first is cheap, fast, and resistant to injection through tool output. The second is more accurate and exposes the judge to the injection surface. A buyer should know which gate it bought.

Can it be recomputed. This is the question most often skipped and hardest to retrofit. An audit does not need the system to say “approved.” It needs one action, one authorizing instruction, one decision, and one outcome, tied together in a form that someone outside the platform can replay. A dashboard is the platform’s own conclusion. A screenshot is the weakest possible evidence when a regulator, a board, or a client’s auditor asks.

Why the platform cannot hand you that ledger

Not unwillingness. Position. A security vendor’s ledger counts events: process, connection, timestamp. It is excellent at what happened and structurally blind to what was permitted and by which sentence, because the permission model lives in the identity system and the application. A model vendor’s ledger counts instructions and decisions: it knows which message authorized the action, but it does not see every command on an endpoint or anything outside the gateway. Both ledgers are true, neither is complete, and neither sits in the buyer’s hands.

There is also a commercial motive. Observability is the entrance both vendor types are fighting for. CrowdStrike’s chief executive put it plainly in the acquisition announcement. “When a regulator or your board asks what an agent did, saying ’the model did it’ is not an answer,” he said, then added: “Fiddler is the flight recorder for every agent.” That sentence is a product claim and a claim to the audit franchise at the same time. Whoever defines what counts as a record defines the acceptance criteria.

The third reason is vocabulary. The same event has three names in three ledgers. The application calls it a user-approved payment, the gateway calls it an allowed model call, the endpoint calls it a successfully executed process. Reconciling them requires someone to define the unit of authorization first: which approval level counts, how many actions one approval covers, how a cross-platform action gets one identifier. Nobody currently sells that definition.

Two consequences for buyers outside the US

First, internal audit wants a traceable decision record, not a product screenshot. In organizations where “who approved it” eventually has to appear in an inspection, the answer has to be a row: time, action, basis and decider, where the decider may be a person or a named classifier version. A platform’s statistics page answers a different question, because it summarizes outcomes rather than decisions.

Second, procurement language should specify the gate rather than its existence. Four clauses are both writable and verifiable. First, the layer where the decision is enforced: endpoint, gateway or in-application. Second, whether the decider is a rule or a model, and the notification duty when the model version changes. Third, which fields one decision retains, for how long, and whether they export in a machine-readable form. Fourth, whether actions across multiple agent frameworks and model providers can be grouped under a single authorization identifier. All four can be checked by a third party, which is exactly why they can be accepted as acceptance criteria.

Together they point at the same vacancy: an authorization decision ledger that belongs to no platform, which the buyer or an independent third party can recompute.

Where this does not apply

A rule that is claimed everywhere deserves its boundaries stated.

A team of one to ten people using a consumer proactive agent does not need this. Duet’s four gates are sufficient; the risk is a mis-sent email, not an inspection finding, and building a ledger costs more than the mistake.

Fully offline automation that never touches money or outbound communication does not need it either. With no irreversible action there is no boundary requiring approval; what such systems need is version control and rollback.

An enterprise that has standardized on a single platform stack should not build a parallel ledger today. Its gates and its records are in one vendor’s hands, and the price is bargaining power, not missing evidence. The work becomes necessary the moment a second platform enters, or a switch is contemplated.

One residual risk should be stated rather than hidden: the failure distribution of a classifier gate is known only to its maker. Buyers can observe the false-positive rate and the escalation rate, but not the share of actions that should have been blocked and were not. That number requires a labeled test set, and the right to construct that test set sits with the vendor. This is a structural weakness of model-mediated gates, not a defect of one company.

Our judgment

Agent security is being absorbed by platforms, and that will not reverse, because a gate only works next to the runtime and the runtime left the enterprise data center years ago. Absorption does not mean the enterprise can stop worrying. It redistributes responsibility. The platform answers whether the gate exists and how accurate it is. The enterprise answers whether the gate covers the actions it is accountable for, and whether the record can leave the building.

Over the next year, acceptance will shift from feature checklists to evidence checklists. A feature list asks whether you have it. An evidence list asks you to show this one. The first can be answered by marketing; the second can only be answered by someone who has run production.

We will also be explicit about what we sell. It is not another gate. Gates are already built, and better than we could build them. What we sell is a record of the gate that someone else can recompute: a ledger that does not belong to the supplier. That seat is empty today, for a simple reason: the two companies best positioned to fill it happen to own the two halves of the gate.

Three things to do this week

Pick one agent already in production and ask about its last irreversible action: who approved it, which instruction authorized it, which layer made the decision, and where the record lives. Answering three of four puts you ahead of most enterprises.

Put those four questions into the next contract or renewal, and require decision records in a machine-readable export with a notification duty on model version changes. Clauses work where questionnaires do not, because clauses are executable.

If you run two or more agent platforms, run one comparison: take a single business action, execute it in both systems, and try to reconcile the two records. Where they do not reconcile is your future audit gap, and it is cheapest to close now.

A last question for anyone who finishes this piece. If a regulator asked tomorrow for every agent-initiated payment above a threshold in the past thirty days, with its approval record, how long would it take you to produce a list someone else could check? If the answer is not immediate, what is missing is not compliance awareness. It is the unit of authorization that nobody ever defined for you.

References

All external figures come from the pages below, accessed 9 November 2026. Vendor claims and press reporting are labeled separately.

Anthropic, Introducing Claude Duet, 21 Oct 2026 (four approval gates, refusal list, classifier delegation)

Anthropic, How we built Claude Code auto mode (two-stage classifier, 93% manual approval rate, 0.4% false-positive rate, escalation rules)

Anthropic, Claude Duet product page (research preview scope, connector count, hosted VM)

CrowdStrike, CrowdStrike to Acquire Fiddler to Deliver Agent Observability, 3 Nov 2026 (no disclosed terms; CEO quote)

CrowdStrike, CrowdStrike to Acquire Dreadnode to Advance AI Trust, 3 Nov 2026 (100+ attack strategies, framework mapping)

CrowdStrike, CrowdStrike Introduces the AI Kill Switch for AI Safety, 3 Nov 2026 (gateway-first enforcement, relaunch block, network cut)

CrowdStrike, CrowdStrike Delivers AI Security and Safety for the Enterprise, 3 Nov 2026 (agent-level hook clients, sensor inside Claude Cowork VM)

Wall Street Journal, CrowdStrike to Buy Two AI Security Startups for $495 Million (combined price and split are press figures, not company disclosure; paywalled)

DigiCert, Latest DigiCert Research Shows AI Security Risks Already Hitting Enterprises, with 78% Reporting Incidents, 25 Jun 2026 (1,001 respondents, US/UK/AU, fielded May 2026; 78%, 75%, half with formal programs, 86%, 47%)

The Deep View via MarketScale, Half of enterprises hit by AI agent security incidents (secondary split of the 78% into agent-specific incidents; absent from DigiCert’s release)

The Next Web, CrowdStrike agrees to buy AI security startups Fiddler and Dreadnode (Fiddler’s claim of up to 98% lower evaluation cost is vendor self-reported)