Cloudflare gives AI agents identity and spending limits

What changed: Cloudflare introduced Cloudflare Wallets and cloudflare.pay so AI agents deployed on its platform can have a stable identity plus controlled access to online payments using stablecoins. Each human account receives a unique web address that acts as an ID, which can be delegated to specific agents, and agents can be given "Virtual Wallets" with caps on total spend, approved merchants, and maximum transaction size.

Why it matters: This is one of the first mainstream attempts to make agent-driven online commerce safe, giving buyers and sellers a way to know which agent is acting and how much it can spend without human approval. Founders experimenting with autonomous sales, support, or procurement agents can now design flows where agents pay for online services or data directly while staying inside hard financial guardrails.

Try/watch: Reserve Wallet handles early and design a simple policy: start with low spending caps and narrow merchant lists for non-critical agents, then expand as you gain confidence in their behavior.

Drata launches AI Agent Governance for enterprise compliance

What changed: Drata announced Limited Availability of AI Agent Governance, a new module in its trust management platform that discovers, monitors, and governs AI agents running inside an organization. The product already supports the full lifecycle for agents built on Anthropic, with native coverage for agents on OpenAI, Google Vertex AI, and AWS Bedrock in development.

Why it matters: Many enterprises now have dozens of agents created by different teams, but no central inventory or control over what those agents can access or do. Drata is positioning agent governance as a compliance and audit layer, giving security and risk leaders continuous visibility into live agents plus evidence they can share with regulators, customers, and boards.

Try/watch: If you are piloting agents on Anthropic, apply for Limited Availability and treat the resulting inventory as your source of truth for which agents exist, what data they touch, and whether they meet policy.

Endpoint security vendors start policing AI agent behavior

What changed: Airlock Digital unveiled Agentic AI Control & Governance, extending its preventative endpoint security product with deep visibility into trusted AI agent behavior and real-time control over what those agents are allowed to do on user devices. The system automatically discovers AI applications, logs agent sessions and commands, and evaluates each command against centrally managed policies before allowing or blocking it.

Why it matters: As agents gain the ability to execute commands, modify files, and orchestrate other tools, traditional allow-list security is no longer enough. This approach treats agents as first-class actors on endpoints, giving security teams a way to monitor token usage, costs, and risky actions from a single dashboard instead of relying on model vendors alone.

Try/watch: Map your highest-risk agent workflows—such as agents with admin privileges or access to production data—and test them behind command-level policy controls before scaling to the rest of the fleet.