Agents get a control plane: Cato inventories skills, Arrakis funds runtime governance, and Article 50 takes effect (2026)

The agent story in this 24-hour window is less about another orchestration library and more about the control plane around agents: seeing them, profiling what they do, testing their failure modes, and disclosing what they generate. That is a more useful signal for anyone building or funding agentic systems because it moves governance from a policy document into runtime surfaces.

The read in one minute

Signal	What changed	Why it matters
Cato's security console	Cato added local-agent activity views, MCP-server and skill visibility, policy outcomes, and agentic threat prevention to its product updates. 1	Local agents are becoming an enterprise inventory and enforcement problem, not just a developer-tool choice.
Arrakis Security funding	Calcalist Tech reports an $8 million seed round led by Hetz Ventures for a platform that monitors and governs enterprise-agent behavior. 2	Capital is moving toward runtime discovery, behavioral baselines, and intervention.
Red-team methodology	A Cloud Security Guy explainer, drawing on the Cloud Security Alliance's agentic AI red-teaming guide, lays out architecture mapping, attack-surface definition, staged testing, trace capture, and continuous repetition. 3	Testing an agent means testing its loop, tools, memory, and delegation paths, not only its final answer.
EU AI Act Article 50	The European Commission says Article 50 transparency obligations apply from August 2, 2026, including machine-readable marking or detection and disclosure duties for specified AI-generated content. 4	Provenance and disclosure now belong in the delivery pipeline for affected systems.

Cato puts local agents, MCP servers, and skills into the security console

Cato's August 3 product update adds an Agents Overview for Local AI Activity alongside AI Security Access Control with User Access Policy and Agentic Threat Prevention. The overview is designed to show local-agent usage, policy outcomes, top users, tools, MCP servers, and violations, with drill-downs into agent inventory and individual sessions. 1

The notable detail is the granularity. Cato says visibility extends to Claude agent skills, including skill content, source, repository, and file path. It also calls out license dependencies and a gradual two-week rollout. 1

That changes the enterprise question from 「Which model are employees using?」 to 「Which agent, skill, tool, and MCP server can reach which data, under which policy, and what happened in the session?」 The first question is useful for procurement. The second is what incident response and access review need.

For builders, the design target is clear: make the same inventory possible inside your own platform. An agent registry without session evidence is a directory. A policy engine without the reason for the decision is difficult to debug. The useful unit is the combination of identity, tool request, policy outcome, and resulting action.

Arrakis raises for runtime behavior governance

Calcalist Tech reports that Arrakis Security raised an $8 million seed round led by Hetz Ventures. The company was founded by veterans of Torq and Palantir and is building a platform for discovering enterprise AI agents, creating behavioral profiles, monitoring activity in real time, and responding to deviations. The reported controls include blocking suspicious actions, revoking permissions, suspending integrations, and triggering response workflows. 2

These are company and investor claims reported by a secondary source, not an independent benchmark of the platform. The investment signal is still useful: the commercial boundary is shifting from agent construction to agent operation. Discovery and baseline behavior are becoming products in their own right because enterprises cannot govern systems they cannot find or describe.

The practical test for this category is whether the platform can connect three layers without losing context:

Inventory: identify agents, owners, models, tools, MCP servers, skills, and integrations.
Behavior: establish what normal activity looks like for a specific agent and workflow.
Intervention: enforce a reversible response when behavior crosses a defined boundary, then preserve the evidence needed to review it.

A dashboard that only counts invocations will miss the important question: was the action expected for this agent, this user, this data source, and this stage of the workflow?

Red-teaming moves from prompt tricks to architecture tests

The Cloud Security Guy's August 2 explainer presents agentic AI red teaming as an architecture exercise. It attributes the approach to the Cloud Security Alliance's guide and recommends mapping the system, defining its attack surfaces, testing progressively, recording traces, and repeating the process continuously. It specifically points readers toward planning loops, tool permissions, memory injection, and multi-agent interactions. 3

That is a better frame than treating jailbreaks as the entire security test. An agent can produce a harmless final answer after taking an unsafe intermediate action, leaking a secret into memory, or delegating work to a component with broader permissions. Those paths exist in the trace even when the final text looks acceptable.

A minimal test plan for an agent workflow should therefore capture:

the initial instruction and retrieved context;
every plan revision and tool call;
the identity and scope attached to each tool permission;
memory writes, cross-agent messages, and external side effects;
the stop condition, rollback result, and human approval state.

The goal is not to predict every bad prompt. It is to make a failure reproducible enough that an owner can tighten a permission, change a boundary, or add a veto and then run the same scenario again.

Article 50 turns generated-content transparency into operations

The European Commission says the EU AI Act's Article 50 transparency obligations apply from August 2, 2026. The Commission's guidance describes obligations around marking or detecting AI-generated content in a machine-readable format, as well as disclosure for deepfakes and certain AI-generated or manipulated text intended to inform the public about matters of public interest. 4

The operational implication is straightforward: teams covered by these duties need more than a sentence in a policy. They need a path from generation to publication that can preserve provenance, apply the required machine-readable signal, and decide when a visible disclosure is required. The exact scope depends on the system, content type, and role in the chain, so the Commission's guidance should be checked against the deployment rather than reduced to a generic 「AI-generated」 label.

This is adjacent to agent runtime security, but not separate from it. The same harness that records a tool call can record who approved publication, what model or agent produced an asset, and whether the output passed a disclosure gate. Governance becomes cheaper when evidence is captured as part of execution instead of reconstructed after an incident.

What to do next

For builders: inventory local agents, MCP servers, skills, and integrations before adding another capability. Attach an owner and permission scope to each one. Make session traces searchable by policy result, not only by model or user.

For security teams: red-team the architecture in stages. Start with the planning loop and tool boundary, then add memory injection, delegated agents, and external side effects. Keep the trace and rerun the scenario after each control change.

For product and compliance teams: treat provenance and disclosure as a pipeline concern. Define where machine-readable marking is added, where human review is recorded, and which publication paths can bypass those checks.

For investors: separate agent-building demand from runtime-governance demand. The stronger infrastructure signals now include discovery, behavioral baselines, enforcement, audit evidence, and a clear response path.

Scope note

This issue covers the strict window from August 2 at 09:00 through August 3 at 09:00 Asia/Shanghai. No new agent-relevant arXiv submission or major agent-framework release was verified inside that window, so this briefing does not use older releases to fill the gap. The useful conclusion is narrower: in this window, the fresh signals clustered around runtime visibility, intervention, red-team evidence, and content transparency.

Agents get a control plane: Cato inventories skills, Arrakis funds runtime governance, and Article 50 takes effect