Weekly signal

This week (2026-08-17 through 2026-08-25) the agentic automation story tightened around three concrete moves: consumer-grade vendors and infrastructure makers shipped "automation-of-automation" features that let agents discover and build workflows, core agent runtimes hardened multi-agent supervision and permission controls, and security/ops vendors introduced agentic playbooks for defensive automation and observability. These developments together accelerate straight-through business automation while also increasing the need for governance, cost modeling, and runtime observability.

What changed

1. Serval shipped Catalyst (GA), a "super agent" that inspects ticket history and drafts, stages and (with admin approval) publishes full automations; it also creates long-running background agents that proactively detect and remediate problems before a human files a ticket. Catalyst is enabled by default for customers and is positioned as an admin-layer that turns operational history into automation drafts ready for staged review.

2. Anthropic continued frequent Claude Code platform releases in mid-August that tighten agent supervision, background-subagent behavior, permission reviews, data-residency controls and improved session/state labels so stalled agents are visible and capped. Anthropic’s release notes and changelogs show multiple hotfixes and capability tweaks that matter for teams running agentic automation in production.

3. Progress (Telerik / Kendo UI) released UI tooling updates aimed at "agent-ready" apps and tighter RAG/agent integration for.NET apps—indicating a vendor push to make application surfaces directly consumable by agents (structured outputs, RAG-as-a-Service connectors, and MCP-style automation hooks). That lowers integration burden for agentic automations inside business apps.

4. Harness and other infra vendors launched targeted agentic security and delivery tooling (AI SAST, agentic triage/remediation, agent lifecycle controls) that treat agents as first-class runtime artifacts in CI/CD and security triage. These platforms also emphasize visibility into agent decisions and faster, automated remediation paths.

5. Enterprise operators report growing operational appetite to automate deployments (limited or gated no-approval pipelines) after experiencing test-to-prod gaps — a survey of enterprise teams shows many organizations are building pipelines that allow some agentic changes to flow without human approval, increasing the importance of post-deploy monitoring and fast rollback.

What to do with it

• Pilot around discovery, not full autonomy: run a 6–8 week test where an agent drafts automations and stages them in a sandboxed "draft" repo or draft automation workspace for human review before any publish. Use the super-agent (or Catalyst-like) capability only to surface candidates, not to publish.

• Add runtime observability and budget controls now: require per-agent spend caps, spawn limits, and tracing (tool calls, model calls, approvals) so you can reconstruct decision paths and cap runaway token or subagent costs. Track metrics: executions/day, average subagent spawn, cost per completed task.

• Harden integration boundaries: expose business objects (DTOs) or microservice endpoints rather than raw DB access; prefer connector patterns that return structured JSON to reduce prompt brittleness and accidental data exposure. (If you must expose DBs, isolate a read-only business-object view.)

• Update security playbooks: introduce automated SAST runs on agent-generated code, require staged approvals for anything touching access policies, and run small-scale chaos tests to see how agents behave under partial failures.

• Measure value with outcome metrics (time saved, errors avoided, approvals reduced) and pair each automation candidate with a rollback plan and SLA for human review frequency. Start small, instrument everything, iterate.