{"schema":"cain42.agentic75.v1","generated_at":"2026-11-11","source":"Operator-supplied 'Top 75 agentic AI developments of 2026', coverage through 2026-11-11. Summaries are paraphrases; statuses are the list's statuses.","honesty":{"vendor_affiliation":"none claimed; no named vendor is a CAIN-42 customer, partner or endorser","evidence_legend":{"LIVE":"A public route in this deployment exercises this mechanism today, within its stated scope.","LIBRARY":"Production code and tests exist in this repository; there is no hosted route for this exact use.","SIMULATED":"A lab, replay or physical-simulation path. It is not hardware, not a real customer action, and not a safety certification.","PROPOSED":"A design mapping only. No dedicated implementation exists yet; do not buy this as a finished control."},"prices":"proposals, not validated rates","team":"a three-person team","team_size":3,"not_claimed":["patents","third-party audit","SOC 2","certification","production integration"]},"counts":{"LIVE":30,"LIBRARY":24,"SIMULATED":3,"PROPOSED":18},"moats":{"1":{"name":"Trust State","question":"Who do we trust right now?","plain":"Evidence-backed trust computed at the moment of the action, never a static badge."},"2":{"name":"Security-Context Continuity","question":"Does authority survive every boundary?","plain":"Identity, scope and delegation are carried across tools, agents, memories and systems."},"3":{"name":"Trust Graph","question":"How is everything connected?","plain":"Entities, resources, delegations and effects as a graph that can be traversed and audited."},"4":{"name":"Execution Provenance & Attestation","question":"Can we prove what actually happened?","plain":"Hash-chained, signed records binding decision to execution to observable effect."},"5":{"name":"Predictive Trust & Blast Radius","question":"What could happen before we let it happen?","plain":"Pre-execution analysis of reach, exposure and consequence, including simulations."},"6":{"name":"Adversarial Trust Engine","question":"Can CAIN break its own guarantees?","plain":"Continuous attack, mutation and red-team testing of the controls themselves."},"7":{"name":"Autonomous Trust Control Loop","question":"Can verified experience change future trust?","plain":"Monitor, detect, contain, recover, and re-authorise from observed outcomes."}},"bundles":{"code-proof":{"title":"Code & Proof","promise":"Prove the fix, not just the diff.","buyer":"Platform engineering, AI coding-tool vendors, security engineering","entry":"Fabrication audit or long-run engineering attestation","range":"$1,500–$6,000 per audit; $2,500–$4,000/month retainer","streams":"Streams 1, 2, 5 and 9 of the operator playbook"},"memory-context":{"title":"Memory & Context","promise":"Memory that cannot launder authority.","buyer":"Agent-platform teams, enterprise AI governance, regulated data owners","entry":"Memory authority audit; hosted memory-sanitisation pilot","range":"$2,500 per audit; metered from $0.0002 per inspection","streams":"Streams 2, 4 and 6 of the operator playbook"},"identity-authority":{"title":"Identity & Authority","promise":"Every agent, every delegation, every boundary.","buyer":"CISO, IAM, platform security, agent-tool vendors","entry":"Agent authority review; MCP/A2A boundary review","range":"$2,500–$7,500 per review; integration from $10,000","streams":"Streams 2, 4 and 8 of the operator playbook"},"commerce-payments":{"title":"Commerce & Payments","promise":"Delegated spending with a ceiling and a receipt.","buyer":"Fintech, commerce platforms, marketplaces, treasury teams","entry":"Payment-mandate review; browser-agent checkout review","range":"$2,500–$7,500 per review; integration from $10,000","streams":"Streams 2, 4 and 9 of the operator playbook"},"physical-lab":{"title":"Physical & Lab","promise":"A validity check between the plan and the machine.","buyer":"Lab automation, robotics, industrial operations, construction technology","entry":"Physical-action assurance review (advisory, simulation-first)","range":"$5,000–$15,000 per engagement","streams":"Streams 2 and 4 of the operator playbook; advisory, not a certified safety case"},"swarm-multiagent":{"title":"Swarm & Multi-Agent","promise":"Delegation you can follow across every hop.","buyer":"Agent orchestrator vendors, research labs, enterprise platform teams","entry":"Swarm delegation audit; collusion and drift review","range":"$3,500–$7,500 per audit; $2,500–$4,000/month retainer","streams":"Streams 2, 3 and 5 of the operator playbook"},"runtime-evidence":{"title":"Runtime Containment & Evidence","promise":"Contain first, then prove what happened.","buyer":"SOC, incident response, compliance, enterprise IT","entry":"Runtime containment review; signed evidence pack","range":"$2,500–$5,000 per review; $2,000–$10,000 per evidence pack","streams":"Streams 2, 3 and 4 of the operator playbook"}},"developments":[{"rank":1,"slug":"full-day-autonomous-software-engineering","title":"Full-day autonomous software engineering","category":"Software engineering","status_2026":"Research demonstration","in_2026":"OpenAI reported a Codex experiment sustaining roughly 25 hours of implementation, testing and repair on one software project.","risk":"A run that long crosses many context boundaries. The trust question stops being whether the model can write code and becomes whether anyone can reconstruct which authority, files, tests and decisions each hour ran under.","moat":4,"role":"Bind every long-horizon run to a hash-chained record: the action proposal, the authority it ran under, the test that failed before and passed after, and the signed verdict. KEYSTONE already does this for bounded repo fixes; the same spine extends to a multi-hour run.","wiring":["Open a run record per task with tenant, agent identity and the exact repository revision.","Wrap each tool call so the record captures proposal, authority, policy revision and result digest.","Require an independent reference test that fails on the original tree and passes on the fix.","Close the run with a signed verdict that names every check, and export an offline verifier."],"modules":["keystone/repo.py","keystone/guard.py","keystone/engine.py","keystone/bundle.py","cain/mission_control/longhorizon.py"],"proof":[{"label":"Run the live KEYSTONE loop","href":"/keystone"}],"evidence":"LIVE","limits":"The hosted KEYSTONE loop proves bounded fixes, not a 25-hour run. Long-horizon duration and multi-hour context retention are library paths, not a demonstrated hosted capability.","offer":"Long-Run Engineering Attestation","buyer":"AI coding-tool vendors and platform engineering teams","price":"$3,500 per run audit; $1,500–$6,000 fixed audits","bundle":"code-proof","stream":1},{"rank":2,"slug":"agent-operated-molecular-biology-labs","title":"Agent-operated molecular-biology laboratories","category":"Scientific labs","status_2026":"Research demonstration","in_2026":"AutoDNA coordinated AI agents and laboratory equipment for about 200 hours, with humans still handling consumables and waste.","risk":"A digital agent that can command physical equipment needs a validity check between the plan and the machine: reagent identity, volume, inventory, state and a reversible stop. A text-only guardrail cannot see any of that.","moat":5,"role":"Model the physical action before it is sent: equipment state, reagent identity and volume, inventory and exposure. CAIN's digital-twin emulator and ARGUS physical-assurance stage provide the simulation surface; the honest label is SIMULATED, not live hardware.","wiring":["Register each instrument and reagent as a typed resource with a current state digest.","Translate the agent's proposed step into a physical action with explicit volumes and targets.","Run the action against the digital twin and compute blast radius before dispatch.","Emit a signed receipt binding the plan, the simulated state and the observed instrument result."],"modules":["cain/cain_digital_twin.py","cain/argus/physical.py","cain/argus/path.py","cain/worm_export.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"SIMULATED","limits":"There is no laboratory hardware attached to this deployment. The physical stage is a simulation, and it must not be presented as a validated lab control or a safety case.","offer":"Physical Autonomy Assurance Review","buyer":"Lab-automation vendors and research institutes","price":"$7,500–$15,000 per engagement","bundle":"physical-lab","stream":2},{"rank":3,"slug":"closed-loop-experimental-discovery","title":"Closed-loop experimental discovery","category":"Scientific discovery","status_2026":"Research demonstration","in_2026":"Google laboratory agents used actual experimental results to revise aptamer-discovery strategies across successive cycles.","risk":"A loop that learns from physical results will also learn from contaminated, delayed or mislabeled results. The evidence chain has to separate what was observed from what was inferred, and it has to survive a bad cycle.","moat":7,"role":"The control loop needs a fact-segregated record: observed, verified, derived, unverified and counterfactual kept apart. A cycle may change strategy, but it may not silently promote an unverified inference into a trusted premise.","wiring":["Record each cycle's inputs and observed outputs with an explicit fact class.","Require the strategy change to cite the observations that caused it.","Re-score the new strategy against retained evidence before the next physical step.","Halt the loop when evidence quality falls below the declared floor."],"modules":["cain/argus/evolution.py","cain/continuum/assurance.py","cain/runtime/world_model.py","cain/causality/graph.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"LIBRARY","limits":"The fact-class and cycle-control primitives exist and are tested. No hosted closed-loop scientific workflow is running here, and no external lab result has been validated.","offer":"Discovery Loop Evidence Review","buyer":"AI-for-science teams and research foundations","price":"$5,000–$12,000 per review","bundle":"physical-lab","stream":2},{"rank":4,"slug":"machine-checkable-security-proofs","title":"Machine-checkable security proofs","category":"Formal verification","status_2026":"Vendor-reported research demonstration","in_2026":"Google reported an agentic framework generating Lean proofs of specified security properties in code underlying Signal's cryptographic protocol.","risk":"A proof is only as good as the statement it proves, and an agent can quietly weaken the statement, the assumptions or the build that produced the artifact. The chain from source to checked proof has to be reproducible.","moat":4,"role":"Treat the proof as evidence with a subject: bind the exact source revision, the specification, the toolchain, the checker output and the signer. CAIN's VeriCoding KEYSTONE already does this for a Python subset with Z3, and refuses a proof when the checker does not run.","wiring":["Pin the source revision and the specification text before the agent starts.","Compile the target into the checker's logic and record the compiler output digest.","Run the checker; UNSAT is a proof only for the recorded statement, never for the whole application.","Sign the bundle and embed a verifier that imports no CAIN code."],"modules":["vericoding-gate/expr_compiler.py","cain/cain_z3_verifygate.py","keystone/vericoding.py","cain/cain_proof_carrying_code.py"],"proof":[{"label":"Run a live Z3-proved fix","href":"/vericoding-keystone"}],"evidence":"LIVE","limits":"The hosted Z3 proof covers a bounded Python subset and a stated property. It is not a Lean proof, not a whole-application proof, and not a claim about Signal.","offer":"Proof-Carrying Change Review","buyer":"Cryptography teams, protocol vendors, safety-critical software","price":"$5,000–$15,000 per proof review","bundle":"code-proof","stream":5},{"rank":5,"slug":"open-world-multi-agent-mathematics","title":"Open-world multi-agent mathematical discovery","category":"Mathematical research","status_2026":"Research preprint","in_2026":"The Station study let agents independently choose research directions, experiment, collaborate and build on one another's findings.","risk":"Independent agents building on each other's results create a provenance problem: which lemma came from whom, which proof was checked, and which claim was only asserted. Collaboration without attribution turns errors into foundations.","moat":3,"role":"Represent the research programme as a trust graph of claims, proofs, agents and dependencies. Each edge records whether the dependency was verified, and a downstream result cannot inherit more confidence than its weakest checked input.","wiring":["Register each claim and proof as a node with author, checker and status.","Record every dependency edge when one result is used by another.","Refuse to promote a result whose checked dependencies are incomplete.","Export the graph with the paper so a reviewer can walk the derivation."],"modules":["cain/causality/graph.py","cain/causality/certificate.py","cain/runtime/swarm.py","keystone/ledger.py"],"proof":[{"label":"Run the live swarm delegation demo","href":"/swarm-keystone"}],"evidence":"LIBRARY","limits":"The graph and certificate code is real and tested. The specific multi-agent mathematics workflow is a mapping, not a deployed research system.","offer":"Research Provenance Review","buyer":"AI research labs and academic consortia","price":"$3,500–$7,500 per review","bundle":"swarm-multiagent","stream":2},{"rank":6,"slug":"single-prompt-specialized-agent-teams","title":"Single-prompt coordination of specialised agent teams","category":"Agent orchestration","status_2026":"Product preview","in_2026":"Google previewed an Antigravity swarm feature with parallel workspaces, specialised responsibilities and checking agents.","risk":"A planner that can spawn workers and checkers can also spawn a worker with more authority than the planner holds, or let a checker approve its own sibling. Parallelism multiplies the places where scope can drift.","moat":2,"role":"Make delegation attenuation structural: a child capability can only narrow the parent's scope, lifetime and resources. CAIN's execution-chain capability type refuses a handoff that widens scope or extends life, regardless of what the planner says.","wiring":["Issue the planner a capability with explicit scope, destination and expiry.","Derive each worker capability from the parent, allowing only narrowing.","Require the checker to be a different identity from the worker it checks.","Record the delegation tree and verify it after the run."],"modules":["cain/execution_chain/capability.py","cain/execution_chain/multiagent.py","cain/argus/envelope.py","keystone/swarm.py"],"proof":[{"label":"Run the live swarm delegation demo","href":"/swarm-keystone"}],"evidence":"LIVE","limits":"The hosted demo proves attenuation and collusion checks on fixed presets. It does not operate Antigravity or any Google product.","offer":"Swarm Delegation Audit","buyer":"Agent-orchestrator vendors and enterprise platform teams","price":"$3,500–$7,500 per audit","bundle":"swarm-multiagent","stream":2},{"rank":7,"slug":"digital-twins-for-physical-actions","title":"Digital twins for safe physical agent actions","category":"Physical safety","status_2026":"Research infrastructure","in_2026":"Google's VERID framework modelled laboratory equipment, reagent identities, volumes and inventory before commands reached robots.","risk":"The twin is only useful if the real action is bound to the simulated one. Without a signed binding, an agent can validate one action and dispatch another.","moat":5,"role":"Simulate before dispatch and bind the simulation to the dispatched action with a digest. CAIN's digital-twin emulator records equipment state, tool calls and blast-radius profiles; ARGUS adds a pre-execution physical stage.","wiring":["Snapshot the twin state and the proposed action parameters.","Simulate the action and compute a blast-radius profile.","Bind the simulation digest into the dispatch command.","Reconcile the observed effect against the simulated one and flag divergence."],"modules":["cain/cain_digital_twin.py","cain/argus/physical.py","cain/argus/envelope.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"SIMULATED","limits":"The twin is an emulator, not a certified model of any named lab. No robot or instrument is connected in this deployment.","offer":"Physical Action Twin Review","buyer":"Robotics and lab-automation vendors","price":"$7,500–$15,000 per engagement","bundle":"physical-lab","stream":2},{"rank":8,"slug":"robot-programming-through-agent-teams","title":"Robot programming through agent teams","category":"Robotics","status_2026":"Robotics research","in_2026":"Berkeley described agents that write, simulate, test and refine interpretable robot-control programmes.","risk":"Generated control code is executable in the physical world. The dangerous transition is not the code generation; it is the promotion of a simulated success into a real actuator command.","moat":4,"role":"Keep generation, simulation, test and deployment as separate signed stages. A programme may be promoted only when the same artifact hash passed the simulator and the deployment gate, and the gate records the operator who released it.","wiring":["Hash the generated programme and its test corpus.","Run the simulator in an isolated sandbox with no actuator access.","Require a human release step for the first physical deployment of any new programme.","Record actuator commands and observed motion as effects bound to the released hash."],"modules":["cain/isolation/sandbox.py","cain/argus/physical.py","keystone/sandbox.py","cain/talos/talos_sandbox_launcher.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"SIMULATED","limits":"Sandboxing and provenance are real. No robot-control programme has been generated, simulated or deployed by this deployment.","offer":"Robotics Release Gate Review","buyer":"Robotics vendors and industrial automation teams","price":"$7,500–$15,000 per review","bundle":"physical-lab","stream":2},{"rank":9,"slug":"end-to-end-autonomous-r-and-d","title":"End-to-end autonomous R&D loops","category":"Research engineering","status_2026":"Published research system","in_2026":"Salesforce's SFR-AutoR&D agents were designed to improve codebases and train models through a research workflow.","risk":"An R&D loop can modify its own codebase and training data. That is a supply-chain change with a research label, and it needs the same review as any other change that affects the model that later makes decisions.","moat":7,"role":"Treat each loop iteration as a governed change: proposal, experiment, measured outcome, review and rollback. The control loop may update future behaviour only from verified experience, and a failed experiment must remain visible.","wiring":["Record the experiment hypothesis and the exact code/data revision.","Run the experiment in an isolated environment with a resource budget.","Compare the measured outcome against the pre-registered metric.","Require review before the change becomes the new baseline."],"modules":["cain/runtime/software_factory.py","cain/argus/evolution.py","keystone/agentci.py","cain/mission_control/longhorizon.py"],"proof":[{"label":"Run the live KEYSTONE loop","href":"/keystone"}],"evidence":"LIBRARY","limits":"The change-control and experiment primitives exist. No autonomous R&D loop is operated by this deployment.","offer":"Autonomous R&D Change Review","buyer":"AI labs and enterprise research groups","price":"$5,000–$12,000 per review","bundle":"code-proof","stream":2},{"rank":10,"slug":"failure-driven-agent-improvement","title":"Failure-driven agent improvement","category":"Evaluation","status_2026":"Reported research architecture","in_2026":"Third Moment Research described identifying recurring agent weaknesses and generating targeted scenarios to address them.","risk":"A system that generates its own test scenarios can also generate easy ones. Improvement is only measurable against a held-out distribution the improver did not author.","moat":6,"role":"Separate the attacker from the improver and keep a held-out suite the improver cannot edit. CAIN's red-team and eval-run paths already produce signed failure records and re-run them after a change.","wiring":["Harvest failures from signed production records, not from the agent's own summary.","Generate targeted scenarios and freeze them before the fix.","Re-run the frozen suite plus a held-out set after the change.","Publish the delta and refuse to call an unmeasured change an improvement."],"modules":["keystone/redteam.py","keystone/evalrun.py","cain/runtime/mutation.py","platform-gateway/adversarial_engine.py"],"proof":[{"label":"Run the live red-team loop","href":"/redteam-keystone"}],"evidence":"LIVE","limits":"The hosted red-team demo attacks and patches fixed tool policies. It is not a general agent-improvement benchmark.","offer":"Failure-Driven Improvement Audit","buyer":"Agent-platform teams and evaluation vendors","price":"$3,500–$7,500 per audit","bundle":"code-proof","stream":9},{"rank":11,"slug":"self-supervised-theorem-discovery","title":"Self-supervised theorem discovery","category":"Formal mathematics","status_2026":"Research preprint","in_2026":"Researchers described an agent that starts from axioms and inference rules and builds a reusable library of theorems.","risk":"A growing theorem library compounds both capability and error. If a theorem enters the library unchecked, every later result that depends on it inherits the defect.","moat":4,"role":"Make library admission depend on a checker verdict, not on the agent's confidence. Each theorem carries its statement, proof, checker version and dependency set, and a later result can cite only admitted theorems.","wiring":["Parse the candidate theorem into a canonical statement.","Run the checker against the statement and proof in an isolated environment.","Admit the theorem only on a positive verdict and record its dependencies.","Re-check dependants when a checker or axiom set changes."],"modules":["cain/cain_z3_verifygate.py","vericoding-gate/expr_compiler.py","cain/causality/graph.py"],"proof":[{"label":"Run a live Z3 proof","href":"/vericoding-keystone"}],"evidence":"LIBRARY","limits":"The checker gate is real for a bounded logic subset. No theorem-library agent is operated here.","offer":"Formal Artifact Review","buyer":"Formal-methods teams and proof-assistant vendors","price":"$5,000–$12,000 per review","bundle":"code-proof","stream":2},{"rank":12,"slug":"validated-biological-binder-discovery","title":"Experimentally validated biological binder discovery","category":"Biotechnology","status_2026":"Research demonstration","in_2026":"Google reported human–agent research producing high-affinity binders for a cancer-associated target.","risk":"A computational result that later becomes a wet-lab decision needs a chain from model output to assay to conclusion. The failure mode is a confident generated candidate treated as a validated binder.","moat":4,"role":"Keep computational predictions and experimental observations in separate fact classes, and bind each conclusion to the assay that supports it. A prediction may guide the next experiment; it may not be reported as a result.","wiring":["Record the model, version, inputs and generated candidates as predictions.","Link each candidate to the assay protocol and the observed measurement.","Require an independent review before any candidate is described as validated.","Preserve negative and inconclusive results alongside positive ones."],"modules":["cain/argus/physical.py","cain/runtime/research_agent.py","cain/worm_export.py","cain/causality/evidence.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"PROPOSED","limits":"No biological workflow, assay data or wet-lab integration exists in this repository. This page is a governance design, not a scientific claim.","offer":"Research Evidence Review","buyer":"Biotech platforms and research institutes","price":"Advisory engagement from $10,000","bundle":"physical-lab","stream":2},{"rank":13,"slug":"multi-model-workflow-orchestration","title":"Multi-model workflow orchestration","category":"Agent orchestration","status_2026":"Product launch","in_2026":"Perplexity Computer decomposed goals into tasks and coordinated subagents and different model capabilities.","risk":"Routing one task across several models multiplies the number of identities, prompts and tool grants in play. The orchestration layer becomes the only place where the whole trajectory can be seen.","moat":1,"role":"Score each step against the trust state of the model, tool and data involved, and make the score a gate rather than a dashboard. CAIN's runtime bus and kernel already carry trust context across a multi-stage action.","wiring":["Register each model and tool as an entity with an owner and a trust state.","Attach the task's authority and budget to the orchestration context.","Evaluate each handoff before the next model receives the task.","Record the full trajectory, including which model produced which step."],"modules":["cain/runtime/runtime_bus.py","cain/kernel.py","keystone/actors.py","cain/runtime/a2a.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"LIBRARY","limits":"The kernel and runtime bus are real. The hosted decision demo exercises the decision path, not a Perplexity integration.","offer":"Multi-Model Orchestration Review","buyer":"Agent-platform vendors and enterprise AI teams","price":"$3,500–$7,500 per review","bundle":"swarm-multiagent","stream":2},{"rank":14,"slug":"persistent-correction-aware-memory","title":"Persistent, correction-aware agent memory","category":"Memory","status_2026":"Reported internal deployment","in_2026":"OpenAI's internal data agent saved corrections and organisational knowledge for reuse.","risk":"A saved correction is a high-value memory with a provenance problem: who corrected it, against which source, and does it still apply after the source changes? Unchecked, a correction becomes an unappealable rule.","moat":2,"role":"Store memory with its author, source, scope and supersession chain, and never let a retrieved memory carry authority. CAIN's governed-memory client and MEMGUARD enforce write-time screening, tenant scope and revocation.","wiring":["Write the correction with its source, author and scope.","Screen the write for injection and policy conflict before it is stored.","Retrieve with tenant and purpose filters, not only similarity.","Supersede or revoke rather than overwrite, and keep the chain."],"modules":["cain/memory.py","cain/argus/memory_firewall.py","keystone/memguard.py","cain/continuum/memory_continuity.py"],"proof":[{"label":"Run the live memory-sanitisation demo","href":"/memguard-keystone"}],"evidence":"LIVE","limits":"The hosted memory demo sanitises fixed adversarial memories. It is not an OpenAI deployment and does not prove long-term memory quality.","offer":"Memory Authority Audit","buyer":"Agent-platform teams and enterprise knowledge owners","price":"$2,500 per audit; pilot from $5,000","bundle":"memory-context","stream":2},{"rank":15,"slug":"retained-reasoning-context-compaction","title":"Retained reasoning and context compaction","category":"Context management","status_2026":"Benchmark-specific research result","in_2026":"OpenAI reported substantial ARC-AGI-3 improvements from preserving useful reasoning and compacting history.","risk":"Compaction is lossy by design. If the summary drops the authority, the constraint or the failed attempt, the next step can repeat a prohibited action with a clean-looking context.","moat":4,"role":"Treat the compacted context as a derived artifact with a link to what was dropped. The record keeps the original trajectory; the model gets a summary; a reviewer can always walk back.","wiring":["Hash the original context window before compaction.","Mark the summary as derived and list the retained constraints and dropped spans.","Keep authority and prohibition statements outside the lossy summary.","Rehydrate the original when a decision depends on a dropped span."],"modules":["cain/runtime/fingerprint.py","cain/continuum/memory_continuity.py","cain/argus/memory_firewall.py"],"proof":[{"label":"Run the live memory-sanitisation demo","href":"/memguard-keystone"}],"evidence":"LIBRARY","limits":"Context fingerprinting and continuity code exist. No ARC-AGI-3 benchmark or compaction-quality claim is made here.","offer":"Context Integrity Review","buyer":"Model providers and agent-platform teams","price":"$3,500–$7,500 per review","bundle":"memory-context","stream":2},{"rank":16,"slug":"offline-memory-consolidation","title":"Offline memory consolidation (dreaming)","category":"Memory","status_2026":"Research architecture","in_2026":"Anthropic described revisiting previous experience offline to revise notes and form higher-level knowledge.","risk":"Offline consolidation is an unobserved write process. It can merge a hostile memory, amplify a single anecdote, or quietly rewrite a record that a past decision relied on.","moat":2,"role":"Run consolidation as a governed batch: inputs are immutable, outputs are new records with derivation links, and no consolidated memory may gain authority or lose its tenant boundary. CAIN's memory firewall rejects laundering, amplification and resurrection.","wiring":["Snapshot the input memories and their version digests.","Produce consolidated notes as new records with explicit derivation edges.","Test the outputs for laundering, amplification and cross-tenant leakage.","Require review before a consolidated note outranks its sources."],"modules":["cain/argus/memory_firewall.py","cain/memory.py","cain/argus/evolution.py","cain/continuum/memory_continuity.py"],"proof":[{"label":"Run the live memory-sanitisation demo","href":"/memguard-keystone"}],"evidence":"LIBRARY","limits":"The firewall and governed-memory code are real. The dreaming loop itself is not operated by this deployment.","offer":"Memory Consolidation Review","buyer":"Agent-memory vendors and enterprise AI teams","price":"$3,500–$7,500 per review","bundle":"memory-context","stream":2},{"rank":17,"slug":"agent-skills-portable-standard","title":"Agent skills as a portable ecosystem standard","category":"Agent interoperability","status_2026":"Ecosystem standardisation","in_2026":"Anthropic announced broader platform adoption and foundation stewardship of Agent Skills.","risk":"A portable skill is executable content that crosses vendor boundaries. The standard makes reuse easy; it also makes a malicious or over-privileged skill portable.","moat":2,"role":"Treat a skill as untrusted code with a manifest: declared tools, data scope, network needs and author. Sandbox it, scan the manifest, and grant only the declared capabilities at run time.","wiring":["Parse the skill manifest and compare declared capabilities with requested ones.","Static-scan the skill for dangerous calls and hidden network access.","Run it in a sandbox with no inherited secrets and default-deny egress.","Record the skill digest and the exact capability grant for each invocation."],"modules":["cain/isolation/skill_sandbox.py","cain/runtime/skills.py","keystone/openclaw.py","keystone/skill_static.py"],"proof":[{"label":"Run the live skill-sandbox demo","href":"/openclaw-keystone"}],"evidence":"LIVE","limits":"The hosted OpenClaw demo audits and sandboxes fixed sample skills. It does not certify the Agent Skills standard or any vendor implementation.","offer":"Portable Skill Review","buyer":"Agent-platform vendors and marketplace operators","price":"$2,500–$5,000 per review","bundle":"identity-authority","stream":8},{"rank":18,"slug":"full-stack-agent-safety-infrastructure","title":"Full-stack agent safety infrastructure","category":"Platform security","status_2026":"Platform announcement","in_2026":"NVIDIA announced a platform spanning agent security, governance, testing and deployment infrastructure.","risk":"A platform announcement defines a category, not a guarantee. Buyers still need to know which control is enforced in the data path, which is a dashboard, and what happens when the control is unavailable.","moat":7,"role":"CAIN's answer is a single decision path with fail-closed semantics: no authorization, no execution; unknown and error never become allow. The same path carries authority, risk, prediction, enforcement and evidence.","wiring":["Put every agent action behind one enforcement boundary.","Evaluate identity, authority, policy, risk and prediction in a fixed order.","Fail closed on timeout, error or missing evidence.","Emit a signed decision record before the tool is allowed to run."],"modules":["cain/kernel.py","cain/guard.py","cain/mcp_proxy.py","platform-gateway/fabric_control_plane.py"],"proof":[{"label":"Fire a live decision through every stage","href":"/fabric/try"}],"evidence":"LIVE","limits":"CAIN is not NVIDIA's platform and this page claims no partnership. The live decision path is CAIN's own; several adjacent engines remain prototypes.","offer":"Enterprise Agent Governance Review","buyer":"CISO and platform-security teams","price":"$5,000–$12,000 per review; appliance from $50k/yr","bundle":"runtime-evidence","stream":2},{"rank":19,"slug":"runtime-agent-quarantine","title":"Runtime agent quarantine","category":"Runtime containment","status_2026":"Vendor-reported platform capability","in_2026":"NVIDIA described Sentry as able to isolate agents attempting to exceed their permitted boundaries.","risk":"Quarantine is only trustworthy if it is fast, cross-process and recorded. A quarantine that depends on the same process it is containing can be starved by that process.","moat":7,"role":"Contain the agent, not just the request: revoke capabilities, stop the fleet, preserve the evidence and require a human release. CAIN's quarantine and fleet-kill paths use a shared store so a second process can halt a runaway first process.","wiring":["Detect the boundary breach from the decision path, not from the agent's self-report.","Revoke the agent's outstanding capability tokens.","Signal the fleet halt through the cross-process store and verify the halt.","Preserve a signed containment receipt and require dual-key recovery."],"modules":["cain/quarantine.py","cain/fleet_kill.py","cain/argus/reauthorization.py","cain/execution_chain/capability.py"],"proof":[{"label":"Run the live quarantine drill","href":"/api/v1/quarantine/drill"}],"evidence":"LIVE","limits":"The public drill runs against a throwaway database and a demo agent. Sub-50ms halt is a design target measured in the drill, not a guarantee for every deployment.","offer":"Runtime Containment Audit","buyer":"SOC and agent-platform teams","price":"$2,500–$5,000 per audit; $1,500–$4,000/month retainer","bundle":"runtime-evidence","stream":3},{"rank":20,"slug":"os-enforced-agent-containment","title":"Operating-system-enforced agent containment","category":"Endpoint security","status_2026":"Reported release announcement","in_2026":"Microsoft announced Execution Containers to constrain agent access and actions on PCs.","risk":"An instruction in a prompt is not a security boundary. The boundary has to sit below the agent: filesystem, network, process and secrets, enforced by the OS and verified at run time.","moat":6,"role":"Layer OS controls under the application decision: Landlock and seccomp for filesystem and syscalls, an eBPF guard for runtime events, and a sandbox that starts with no inherited secrets. CAIN's isolation and Talos paths implement parts of this on Linux.","wiring":["Start the agent in a sandbox with a read-only root and no inherited environment secrets.","Apply a syscall and filesystem policy before the first tool call.","Monitor runtime events for policy divergence.","Terminate and preserve the sandbox state when the policy is violated."],"modules":["cain/landlock_sandbox.py","cain/ebpf_enforcer.py","cain/isolation/sandbox.py","cain/talos/talos_sandbox_launcher.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"LIBRARY","limits":"The Linux controls exist and are tested on this host class. There is no Windows or macOS execution-container implementation here, and no claim of parity with Microsoft.","offer":"OS Containment Review","buyer":"Endpoint vendors and enterprise IT","price":"$5,000–$12,000 per review","bundle":"runtime-evidence","stream":2},{"rank":21,"slug":"task-scoped-short-lived-credentials","title":"Task-scoped, short-lived agent credentials","category":"Identity","status_2026":"Integration announcement","in_2026":"TrueFoundry and Okta announced access tied to user identity, limited tasks and temporary tokens.","risk":"A short lifetime is necessary but not sufficient. A token that is still valid for the wrong tool, resource or parameter is a long-lived grant in a short-lived wrapper.","moat":2,"role":"Bind the credential to identity, task, resource, parameter digest and a single use. CAIN's JIT capability issuer and execution-chain tokens refuse replay, expiry extension and scope widening.","wiring":["Mint the token for one action, one resource and one parameter set.","Set a short expiry and a nonce that is consumed on first use.","Attenuate, never expand, when delegating to a sub-agent.","Record issuance and consumption as separate evidence events."],"modules":["cain/jit_capability.py","cain/execution_chain/capability.py","keystone/broker.py","cain/spiffe.py"],"proof":[{"label":"Run the live action-credential demo","href":"/broker-keystone"}],"evidence":"LIVE","limits":"The hosted broker demo proves mint, attenuate, replay-refusal and expiry on fixed presets. It is not an Okta or TrueFoundry integration.","offer":"Agent Credential Review","buyer":"IAM teams and agent-platform vendors","price":"$3,500–$7,500 per review","bundle":"identity-authority","stream":2},{"rank":22,"slug":"bounded-agent-identities-and-wallets","title":"Bounded agent identities and wallets","category":"Payments","status_2026":"Staged platform announcement","in_2026":"Cloudflare announced agent identities and wallets with spending caps, approved merchants and transaction limits.","risk":"A spending cap is a policy, and a wallet is a credential. The hard part is making the cap, the merchant list and the per-transaction limit hold at the moment of payment, not in a monthly report.","moat":1,"role":"Make the mandate the unit of authority: principal, agent, merchant set, amount ceiling, velocity, expiry and revocation. CAIN's payment-mandate guard evaluates all of them before release and records the decision.","wiring":["Issue a signed mandate from the principal to the agent.","Check merchant identity, including look-alike domains, before checkout.","Enforce per-transaction and cumulative ceilings at authorization time.","Release once, record the settlement, and revoke on anomaly."],"modules":["cain/commerce/mandate_guard.py","cain/runtime/transactions.py","keystone/governor.py"],"proof":[{"label":"Run the live spending-governor demo","href":"/governor-keystone"}],"evidence":"LIVE","limits":"The hosted governor demo proves budget and velocity refusal on fixed presets. No real wallet, card network or Cloudflare product is involved.","offer":"Agent Wallet Mandate Review","buyer":"Fintech, marketplaces and treasury teams","price":"$3,500–$7,500 per review","bundle":"commerce-payments","stream":2},{"rank":23,"slug":"autonomous-vulnerability-investigation","title":"Autonomous vulnerability investigation and repair","category":"Security engineering","status_2026":"Vendor-reported deployment","in_2026":"Google described Project Fortify workflows spanning security scanning, triage and remediation.","risk":"An agent that can find and patch vulnerabilities can also patch the production path without review. Speed is useful; unreviewed write access to a security control is not.","moat":6,"role":"Keep detection deterministic, make the fix a proposal, and prove it with a test the fixer did not author. CAIN's MCP scanner and KEYSTONE loop already separate the detector, the actor and the independent prover.","wiring":["Run the deterministic detector and record its verdict and rule version.","Have the agent propose a minimal patch with its rationale.","Run an independent reference test on the original and the patched tree.","Sign the result only when every check holds; otherwise label it not verified."],"modules":["mcp-security-scanner/engine.py","keystone/mcp.py","keystone/redteam.py","keystone/engine.py"],"proof":[{"label":"Scan a live MCP tool definition","href":"/mcpgate-keystone"}],"evidence":"LIVE","limits":"The hosted scanner is heuristic and the hardened fixes are bounded samples. It is not Project Fortify and does not scan a customer production estate.","offer":"Vulnerability-to-Patch Proof","buyer":"Security engineering and AppSec teams","price":"$2,500–$5,000 per engagement","bundle":"code-proof","stream":5},{"rank":24,"slug":"coding-agents-in-xcode","title":"Coding agents inside native development tools","category":"Developer tooling","status_2026":"Release-candidate announcement","in_2026":"Apple integrated Claude Agent and Codex into Xcode workflows, including builds and visual previews.","risk":"An agent inside the IDE inherits the developer's build, signing and repository access. The boundary has to distinguish read, build, test and release, because they are not the same authority.","moat":4,"role":"Gate the agent at the tool boundary, not at the chat boundary. CAIN's codeguard and KEYSTONE repo paths classify build, test and write actions, and require a proved test before a change is called verified.","wiring":["Give the agent read and build authority without release or signing authority.","Require a separate grant for any write to the repository.","Run the build and the reference test in an isolated worktree.","Sign the patch and its test result; never sign the model's own claim."],"modules":["keystone/codeguard.py","keystone/repo.py","keystone/guard.py","keystone/sandbox.py"],"proof":[{"label":"Run the live coding-agent gate","href":"/codeguard-keystone"}],"evidence":"LIVE","limits":"The hosted gate evaluates fixed coding-agent actions. It is not an Xcode plugin and has no Apple integration.","offer":"Coding-Agent Action Gate","buyer":"IDE vendors and engineering organisations","price":"$2,500–$5,000 per review","bundle":"code-proof","stream":2},{"rank":25,"slug":"ten-thousand-concurrent-agents","title":"Reported orchestration of 10,000 concurrent agents","category":"Scale","status_2026":"Reported research deployment","in_2026":"Third Moment Research described investigations involving 10,000 agents running over extended periods.","risk":"Agent count is not a control. At fleet scale the questions are identity uniqueness, delegation fan-out, budget aggregation, collusion and whether one compromised worker can poison a shared conclusion.","moat":3,"role":"Model the fleet as a graph and evaluate the fleet, not only each call: unique identities, attenuation per edge, aggregated budget, collusion signals and a quarantine path for a subgraph.","wiring":["Register each worker with a unique identity and a parent edge.","Aggregate resource and budget use across the whole subtree.","Detect unexpected delegation and shared-resource anomalies.","Quarantine a subgraph without halting unrelated tenants."],"modules":["cain/runtime/swarm.py","cain/federation/assurance.py","cain/mesh/dispute.py","cain/execution_chain/multiagent.py"],"proof":[{"label":"Run the live swarm delegation demo","href":"/swarm-keystone"}],"evidence":"PROPOSED","limits":"No 10,000-agent run exists in this repository. The graph, attenuation and quarantine primitives are real; fleet-scale capacity is untested.","offer":"Fleet Governance Design Review","buyer":"Agent-orchestrator vendors and research labs","price":"Advisory from $10,000","bundle":"swarm-multiagent","stream":2},{"rank":26,"slug":"finished-knowledge-work-deliverables","title":"Finished knowledge-work deliverables","category":"Knowledge work","status_2026":"Released product capability","in_2026":"ChatGPT Work was described as researching, analysing and producing documents, spreadsheets, presentations, reports and sites.","risk":"A finished deliverable is a consequential artifact that leaves the organisation. The questions are source provenance, who approved the final version, and whether the file can be altered after it was signed.","moat":4,"role":"Bind the deliverable to its sources, its generator, its reviewer and a content digest, then export a verifier. CAIN's WORM export and KEYSTONE bundle already produce tamper-evident packages with offline verification.","wiring":["Record the sources and the model/tool versions used.","Hash the final artifact and bind the reviewer's approval.","Export a package with a standalone verifier.","Detect any post-signing change on re-verification."],"modules":["cain/worm_export.py","keystone/bundle.py","cain_audit/deliver.py","cain/audit.py"],"proof":[{"label":"Inspect a live signed product bundle","href":"/product-demo"}],"evidence":"LIVE","limits":"The hosted demos export and verify fixed sample records. They do not prove the quality or truth of a knowledge-work deliverable.","offer":"Signed Deliverable Pack","buyer":"Enterprise knowledge teams and consultancies","price":"$2,000–$10,000 per pack","bundle":"runtime-evidence","stream":4},{"rank":27,"slug":"always-on-workplace-teammates","title":"Always-on workplace teammates","category":"Workplace agents","status_2026":"Product launch","in_2026":"Perplexity Teammates introduced persistent agents using workspace context, memory and specialised roles.","risk":"An always-on agent accumulates authority by default. A persistent role needs a lease that expires, a review that can revoke it, and a boundary between the role's standing context and a one-off instruction.","moat":7,"role":"Treat authority as a lease, not a permission. ARGUS issues time-bounded assurance leases, requires re-authorisation when behaviour or environment changes, and refuses self-renewal by the agent.","wiring":["Issue a lease naming the role, scope, resources and expiry.","Re-evaluate the lease on a schedule and on every material change.","Require a human or independent verifier to renew a high-impact lease.","Revoke immediately on drift, incident or missing evidence."],"modules":["cain/argus/lease.py","cain/argus/reauthorization.py","cain/argus/state_machine.py","cain/argus/assurance.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"LIBRARY","limits":"The lease and re-authorisation engine is real and tested. It is not a Perplexity product and no always-on hosted teammate runs here.","offer":"Agent Lease Review","buyer":"Workplace-agent vendors and enterprise IT","price":"$3,500–$7,500 per review","bundle":"runtime-evidence","stream":3},{"rank":28,"slug":"cross-application-mobile-task-execution","title":"Cross-application mobile task execution","category":"Mobile agents","status_2026":"Beta announcement","in_2026":"Gemini task automation operated supported Android apps through a restricted virtual window.","risk":"A mobile agent sees personal and work data in the same session. App-level permissions do not express the intent boundary, and a virtual window is only a boundary if the action layer enforces it.","moat":5,"role":"Evaluate the destination app, the data being read and the action being taken before the tap. CAIN's browser-agent firewall scores blast radius per action and can refuse a cross-app transfer that exceeds the declared intent.","wiring":["Declare the task's allowed apps, data classes and destinations.","Classify each proposed action and its blast radius before execution.","Refuse reads or writes outside the declaration, including clipboard and share intents.","Record the action and the observed screen state as evidence."],"modules":["cain/browser/agent_firewall.py","cain/argus/envelope.py","cain/argus/path.py"],"proof":[{"label":"Run the live browser-agent blast-radius demo","href":"/api/v1/browser-agent-firewall/presets"}],"evidence":"LIVE","limits":"The hosted firewall demo evaluates fixed browser-agent presets. It does not operate Android, Gemini or a real device.","offer":"Mobile Agent Action Review","buyer":"Mobile-platform and app vendors","price":"$3,500–$7,500 per review","bundle":"commerce-payments","stream":2},{"rank":29,"slug":"personal-context-mobile-actions","title":"Personal context connected to mobile actions","category":"Mobile agents","status_2026":"Announced phased rollout","in_2026":"Google described workflows that use information from one app to perform a task elsewhere.","risk":"Cross-app context is where personal data leaks into a tool call. The agent needs the fact, not the whole inbox, and the destination should receive the minimum necessary.","moat":2,"role":"Apply purpose limitation at retrieval: the agent gets a scoped, minimised context object with a provenance tag, and the destination call is checked against the purpose it was granted.","wiring":["Resolve the task's purpose and the minimum data needed.","Retrieve a scoped context object rather than raw app data.","Check the destination against the purpose and the user's grant.","Record which fields crossed which boundary."],"modules":["cain/argus/memory_firewall.py","cain/memory.py","cain/spiffe.py"],"proof":[{"label":"Run the live memory-sanitisation demo","href":"/memguard-keystone"}],"evidence":"LIBRARY","limits":"Purpose-scoped memory and identity primitives exist. No mobile OS integration exists here.","offer":"Personal Context Review","buyer":"Mobile platforms and privacy teams","price":"$3,500–$7,500 per review","bundle":"memory-context","stream":2},{"rank":30,"slug":"agent-communication-across-business-systems","title":"Agent communication across business systems","category":"Enterprise integration","status_2026":"Platform announcement","in_2026":"Google Cloud announced a work agent connecting tools, skills and business applications.","risk":"Every connector is an authority boundary. A work agent that can read CRM, write ERP and send email needs per-system scope, not one broad service account.","moat":2,"role":"Put every connector behind the MCP/API boundary with a per-tool allowlist and a per-tenant credential. CAIN's MCP proxy evaluates the tool, arguments and blast radius before forwarding.","wiring":["Register each business system and tool with an owner and risk class.","Grant the agent a per-tool, per-tenant credential.","Inspect arguments for destructive or exfiltrating patterns.","Log the forwarded call and the observed result."],"modules":["cain/mcp_proxy.py","cain/tool_metadata_guard.py","cain/runtime/a2a.py"],"proof":[{"label":"Fire a live governed tool call","href":"/fabric/try"}],"evidence":"LIVE","limits":"The MCP proxy and demo are real. There is no Google Cloud work-agent integration.","offer":"Business-System Connector Review","buyer":"Enterprise integration and platform teams","price":"$2,500–$5,000 per review","bundle":"identity-authority","stream":2},{"rank":31,"slug":"shared-organizational-context-graphs","title":"Shared organisational context graphs","category":"Knowledge graphs","status_2026":"Enterprise implementation","in_2026":"V7 described a Context Graph combining active context with retrievable organisational history.","risk":"A shared graph is a shared attack surface. One poisoned edge can influence every workflow that traverses it, and a tenant boundary that exists only in the query layer is not a boundary.","moat":3,"role":"Make the graph tenant-scoped and evidence-typed: every edge names its source, author and confidence class. Traversal cannot cross a tenant, and a node without provenance cannot become a premise.","wiring":["Store nodes and edges with tenant, source and fact class.","Filter traversal by tenant and purpose at the storage layer.","Flag contradictions instead of silently choosing a winner.","Record which subgraph supported each decision."],"modules":["cain/causality/graph.py","cain/runtime/passport.py","cain/trustnet","cain/argus/memory_firewall.py"],"proof":[{"label":"Open the live governed-memory service","href":"/aether33"}],"evidence":"LIBRARY","limits":"Graph and tenant-isolation primitives exist. No V7 implementation or customer graph is involved.","offer":"Context Graph Review","buyer":"Enterprise knowledge and data-platform teams","price":"$5,000–$12,000 per review","bundle":"memory-context","stream":2},{"rank":32,"slug":"agent-assisted-biological-archive-search","title":"Agent-assisted search through biological archives","category":"Scientific data","status_2026":"Early research result","in_2026":"Google reported multi-agent retrieval of remote protein relatives from large sequence and structure archives.","risk":"Retrieval agents improve the inputs to specialist models, which makes the retrieval trail part of the scientific result. A missing or misordered archive query can change the conclusion.","moat":4,"role":"Record the archive, query, result set, version and retrieval time for every step, and bind the downstream model input to that record. A specialist model's output inherits the provenance of its inputs.","wiring":["Log each archive query with its parameters and result digest.","Record archive versions and retrieval timestamps.","Bind the model input to the retrieval record.","Export the chain with the result for independent review."],"modules":["cain/runtime/research_agent.py","cain/argus/path.py","cain/worm_export.py"],"proof":[{"label":"Open the live governed-memory service","href":"/aether33"}],"evidence":"PROPOSED","limits":"No biological archive connector exists here. This is a provenance design, not a scientific result.","offer":"Research Retrieval Provenance","buyer":"Bioinformatics platforms and research institutes","price":"Advisory from $7,500","bundle":"physical-lab","stream":2},{"rank":33,"slug":"pathology-agents-as-mcp-tools","title":"Pathology agents as interoperable MCP tools","category":"Clinical tools","status_2026":"Product and infrastructure announcement","in_2026":"Owkin announced MCP-compatible biological agents, including tools for digital pathology analysis.","risk":"MCP makes a specialist capability callable by any agent. A callable pathology tool needs input validation, PHI boundaries, a named responsible clinician and a refusal path for out-of-scope images.","moat":2,"role":"Treat the tool definition as part of the security surface. CAIN's MCP scanner grades the definition; the proxy validates arguments and tenant scope; the decision record names the tool version and caller.","wiring":["Scan the tool definition for description injection and unsafe schemas.","Validate image references and patient identifiers before the call.","Enforce a tenant and purpose boundary on the request.","Record the tool version, caller and result digest."],"modules":["cain/mcp_proxy.py","mcp-security-scanner/engine.py","cain/tool_metadata_guard.py"],"proof":[{"label":"Scan a live MCP tool definition","href":"/mcpgate-keystone"}],"evidence":"LIVE","limits":"The scanner and proxy are real. This is not a clinical device, not Owkin, and not autonomous diagnosis.","offer":"Clinical Tool Boundary Review","buyer":"Clinical AI vendors and hospital IT","price":"$5,000–$12,000 per review","bundle":"identity-authority","stream":2},{"rank":34,"slug":"clinical-trial-oversight-agents","title":"Clinical-trial oversight agents","category":"Clinical operations","status_2026":"Announced customer adoption","in_2026":"Medable announced customer adoption of an agent providing intelligence across clinical-development systems.","risk":"Trial oversight touches regulated records. An agent that summarises or flags a trial event needs an audit trail that distinguishes the source record from the agent's interpretation.","moat":4,"role":"Record the source document, the extracted fact, the agent's interpretation and the human reviewer as separate layers. A flag is a proposal, not a finding.","wiring":["Ingest the source record with a content digest.","Extract facts and label them as extracted, not verified.","Attach the agent's interpretation as a separate layer.","Require a named reviewer before the flag enters the trial record."],"modules":["cain/compliance.py","cain/worm_export.py","cain/causality/evidence.py","cain/cain_iso42001_notary.py"],"proof":[{"label":"Inspect a signed evidence package","href":"/product-demo"}],"evidence":"PROPOSED","limits":"No clinical-trial connector or regulated validation exists in this repository. Do not treat this page as clinical or regulatory advice.","offer":"Regulated Workflow Evidence Review","buyer":"Clinical sponsors and CROs","price":"$7,500–$15,000 per engagement","bundle":"runtime-evidence","stream":4},{"rank":35,"slug":"voice-agents-reasoning-while-listening","title":"Voice agents that reason while listening","category":"Voice interfaces","status_2026":"Research preprint","in_2026":"Heartbeat Thinking let voice agents begin reasoning and tool execution from partial transcripts.","risk":"Acting on a partial transcript is acting before the intent is complete. The faster the agent, the more important it is to separate speculative preparation from an irreversible action.","moat":5,"role":"Allow speculative computation, but gate external effects on a completed-intent check. A partial transcript may warm a cache; it may not send the email or move the money.","wiring":["Classify work as speculative preparation or consequential effect.","Run preparation freely against the partial transcript.","Require a completed-intent boundary before any external effect.","Record the transcript state that authorised the effect."],"modules":["cain/argus/envelope.py","cain/runtime/runtime_bus.py","cain/guard.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"PROPOSED","limits":"There is no voice or streaming-transcript implementation in this repository. The gating design is portable; the latency result is not ours.","offer":"Real-Time Agent Gate Review","buyer":"Voice-agent vendors and contact-centre platforms","price":"$3,500–$7,500 per review","bundle":"runtime-evidence","stream":2},{"rank":36,"slug":"evidence-grounded-threat-investigation","title":"Evidence-grounded threat investigation","category":"Security operations","status_2026":"Product launch","in_2026":"Flashpoint launched agents investigating vulnerabilities, credentials, fraud and threat actors across datasets.","risk":"An investigation that loses its sources becomes an opinion. Multi-step threat work needs every claim linked to the artifact that supports it, and a way to show where the trail stops.","moat":4,"role":"Build the investigation as an evidence graph: claims, artifacts, source timestamps and confidence. The agent may propose a conclusion; the graph must show which artifacts support it and which do not.","wiring":["Ingest artifacts with source, timestamp and digest.","Attach each claim to the artifacts that support or contradict it.","Mark unsupported inference explicitly.","Export the graph with the report so a reviewer can audit it."],"modules":["cain/causality/evidence.py","cain/causality/graph.py","cain/worm_export.py","cain/telemetry.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"LIBRARY","limits":"The evidence-graph and export code exist. No threat-intelligence dataset or Flashpoint integration is present.","offer":"Threat Investigation Evidence Review","buyer":"SOC, CTI and incident-response teams","price":"$2,500–$5,000 per review","bundle":"runtime-evidence","stream":4},{"rank":37,"slug":"enterprise-agent-execution-with-governance","title":"Enterprise agent execution with governance","category":"Enterprise platform","status_2026":"Platform announcement","in_2026":"IBM and Microsoft announced Imagine Enterprise for building, running and governing industry-specific agents.","risk":"Governance bolted onto a runtime after the fact sees only logs. It cannot stop the action it is reviewing, and it cannot prove the policy version that was in force.","moat":7,"role":"Put governance in the execution path: policy version, authority and risk are evaluated before the action, and the decision is signed before the tool runs. Dashboards consume that record; they do not replace it.","wiring":["Pin a policy revision to the tenant and the action.","Evaluate authority, policy and risk before execution.","Refuse to run when the policy engine is unavailable.","Emit a signed decision that names the policy revision."],"modules":["cain/kernel.py","cain/opa.py","cain/cain_policy_compiler.py","cain/worm_export.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"LIVE","limits":"CAIN's decision path is real and fail-closed. This is not IBM or Microsoft Imagine Enterprise and no partnership is claimed.","offer":"Enterprise Execution Governance","buyer":"Enterprise architecture and governance teams","price":"$5,000–$12,000 per review; appliance from $50k/yr","bundle":"runtime-evidence","stream":2},{"rank":38,"slug":"multi-agent-desktop-supervision","title":"Multi-agent desktop supervision","category":"Developer tooling","status_2026":"Released product","in_2026":"The Codex app provided parallel agents, isolated worktrees, background tasks and reviewable changes.","risk":"Parallel agents on one repository create merge, test and authority conflicts. Isolation is not only a git feature; each agent needs its own scope and a record of what it changed.","moat":4,"role":"Give each agent an isolated worktree, a scoped task and a signed trail. Review is a decision over artifacts, not over a chat transcript.","wiring":["Create a throwaway worktree per agent and task.","Restrict each agent to its own branch and declared paths.","Run the reference test per worktree and record the result.","Present the diff, test and authority trail for review."],"modules":["keystone/repo.py","keystone/recorder.py","keystone/sandbox.py"],"proof":[{"label":"Inspect a live signed run record","href":"/recorder-keystone"}],"evidence":"LIVE","limits":"The hosted recorder proves signed run records on fixed samples. It is not the Codex app.","offer":"Parallel Agent Run Review","buyer":"Engineering organisations and coding-agent vendors","price":"$2,500–$5,000 per review","bundle":"code-proof","stream":5},{"rank":39,"slug":"faster-models-for-subagents","title":"Faster models for collaborative subagents","category":"Model infrastructure","status_2026":"Model and platform release","in_2026":"Google paired Gemini 3.5 Flash with collaborative subagent support in Antigravity.","risk":"Lower latency encourages more calls, which increases the number of delegated actions and the chance that a fast subagent outruns its authority check.","moat":5,"role":"Keep the authority check independent of model latency. A fast path may cache a decision, but it must carry the same authority, policy revision and expiry, and it must fail closed on a miss.","wiring":["Cache only decisions bound to an exact action and policy revision.","Give every cached decision a short expiry.","Re-evaluate on any parameter or authority change.","Measure the guard's own latency separately from the model's."],"modules":["cain/guard.py","cain/runtime/runtime_bus.py","cain/argus/verifier_mesh.py"],"proof":[{"label":"Run the live swarm delegation demo","href":"/swarm-keystone"}],"evidence":"LIBRARY","limits":"The fast path and cache rules are implemented in the guard. No Gemini model or Antigravity integration exists here.","offer":"Fast-Path Authority Review","buyer":"Model providers and agent-platform teams","price":"$3,500–$7,500 per review","bundle":"swarm-multiagent","stream":2},{"rank":40,"slug":"creative-project-editing-through-mcp","title":"Native creative-project editing through MCP","category":"Creative tools","status_2026":"Integration preview","in_2026":"Adobe previewed integrations letting third-party agents act inside Photoshop, Illustrator, Premiere and After Effects.","risk":"Creative project files are valuable and often irreplaceable. An agent that can edit them needs scoped file access, reversible operations and a clear distinction between a preview and a save over the original.","moat":2,"role":"Treat the creative application as a tool with typed operations: read, preview, write-as-copy and overwrite. Only the last requires an explicit, separate grant and a backup.","wiring":["Grant read and preview before write.","Require a distinct grant for overwrite or destructive edits.","Write to a new artifact by default and keep the original digest.","Record the operation and the resulting file hash."],"modules":["cain/mcp_proxy.py","cain/isolation/skill_sandbox.py","cain/tool_metadata_guard.py"],"proof":[{"label":"Run the live skill-sandbox demo","href":"/openclaw-keystone"}],"evidence":"LIVE","limits":"The MCP boundary and sandbox are real. There is no Adobe integration and no claim of one.","offer":"Creative Tool Boundary Review","buyer":"Creative-software vendors and studios","price":"$2,500–$5,000 per review","bundle":"identity-authority","stream":2},{"rank":41,"slug":"multistep-creative-agents","title":"Multistep creative agents","category":"Creative production","status_2026":"Product announcement","in_2026":"Adobe expanded Creative Agent across Creative Cloud and Firefly.","risk":"A sequence of creative operations can drift from the brief one reasonable step at a time. The final artifact may be internally consistent and still not be what was authorised.","moat":4,"role":"Bind the brief, the plan and the final artifact, and check each step against the intent. A step may be locally reasonable and still violate the global intent.","wiring":["Record the brief and the approved plan as the intent baseline.","Check each step for drift from the plan and the brief.","Require review at declared checkpoints.","Bind the final artifact to the approved plan."],"modules":["cain/execution_chain/chain.py","cain/causality/graph.py","cain/worm_export.py"],"proof":[{"label":"Run the live KEYSTONE loop","href":"/keystone"}],"evidence":"LIBRARY","limits":"Chain and provenance primitives exist. No Adobe or Firefly integration exists.","offer":"Creative Workflow Provenance","buyer":"Creative-software vendors and agencies","price":"$2,500–$5,000 per review","bundle":"code-proof","stream":2},{"rank":42,"slug":"continuous-creative-production-agents","title":"Continuous creative-production agents","category":"Creative operations","status_2026":"Planned capability","in_2026":"Adobe described background agents for asset organisation, quality checks and channel preparation.","risk":"Background agents act without a human in the loop. The controls have to be standing policy, a bounded queue and a safe default when the agent is uncertain.","moat":7,"role":"Run the background agent under a lease with a bounded queue and a fail-closed default. Uncertain or out-of-policy work waits for review; it does not get published.","wiring":["Give the background agent a standing, time-bounded lease.","Bound the queue and the rate of external publication.","Route uncertain items to a human review queue.","Record every published asset and its approval path."],"modules":["cain/argus/lease.py","cain/argus/reauthorization.py","cain/mission_control/governed_runtime.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"PROPOSED","limits":"No unattended creative pipeline is implemented or operated here. The list itself calls this a planned capability.","offer":"Background Agent Lease Review","buyer":"Marketing operations and creative platforms","price":"$3,500–$7,500 per review","bundle":"runtime-evidence","stream":3},{"rank":43,"slug":"agentic-construction-scheduling","title":"Agentic construction scheduling","category":"Construction","status_2026":"Product announcement","in_2026":"Trimble connected construction schedules to live jobsite data, weather, RFIs and submittals.","risk":"A schedule change has cost and safety consequences. An agent reacting to live data needs a model of dependencies and a stop before it moves a safety-critical or contractual milestone.","moat":5,"role":"Model the schedule as a dependency graph and simulate a proposed change before it is committed. Cost, safety and contractual impact are computed, not inferred from prose.","wiring":["Load the current schedule and dependency graph.","Simulate the proposed change and compute impact.","Block changes that move a safety or contractual milestone without approval.","Record the change, the simulation and the approver."],"modules":["cain/cain_digital_twin.py","cain/argus/path.py","cain/causality/graph.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"PROPOSED","limits":"No construction schedule, jobsite feed or Trimble integration exists here. This is a blast-radius design, not a deployed scheduler.","offer":"Physical Schedule Assurance Review","buyer":"Construction-technology vendors and contractors","price":"Advisory from $10,000","bundle":"physical-lab","stream":2},{"rank":44,"slug":"evidence-based-construction-change-orders","title":"Evidence-based construction change orders","category":"Construction","status_2026":"Product announcement","in_2026":"Trimble described agents drafting potential change orders from contracts, drawings and project records.","risk":"A change order is a financial and contractual instrument. The agent's draft must show which clause, drawing revision and record supports each line, and a human must own the approval.","moat":4,"role":"Build the change order as an evidence-backed claim: each line cites a document, a revision and a reviewer. The signed package preserves the source hashes and the approval chain.","wiring":["Extract each line item and cite its source document and revision.","Flag unsupported or conflicting citations.","Require a human reviewer for each financial line.","Sign the package and preserve the source hashes."],"modules":["cain/worm_export.py","cain/causality/graph.py","cain/compliance.py"],"proof":[{"label":"Inspect a live signed evidence package","href":"/product-demo"}],"evidence":"PROPOSED","limits":"No contract or drawing ingestion exists in this repository. Do not treat this page as legal or contractual advice.","offer":"Contract Evidence Review","buyer":"Construction and legal operations teams","price":"$7,500–$15,000 per engagement","bundle":"physical-lab","stream":4},{"rank":45,"slug":"it-investigation-approval-gated-remediation","title":"IT investigation with approval-gated remediation","category":"IT operations","status_2026":"Product release","in_2026":"ScienceLogic's Skylar AI used live telemetry to investigate incidents and propose repairs.","risk":"The gap between a diagnosis and a repair is the highest-risk moment in operations. An agent that can restart, roll back or patch production needs an approval that is bound to the exact action.","moat":5,"role":"Separate diagnosis from remediation, and bind the human approval to the exact action digest, target and expiry. CAIN's approval KEYSTONE already binds approvals to one action and refuses a swapped payload.","wiring":["Produce a diagnosis with the telemetry evidence it used.","Draft a remediation action with exact target and parameters.","Request approval bound to the action digest.","Execute once, then verify the observed effect."],"modules":["keystone/approval.py","cain/causality/evidence.py","cain/telemetry.py","cain/guard.py"],"proof":[{"label":"Run the live action-bound approval demo","href":"/approval-keystone"}],"evidence":"LIVE","limits":"The hosted approval demo binds and verifies fixed actions. It does not connect to ScienceLogic or a production estate.","offer":"Approval-Gated Remediation Review","buyer":"IT operations and MSPs","price":"$2,500–$5,000 per review","bundle":"runtime-evidence","stream":3},{"rank":46,"slug":"business-ontologies-for-regulated-agents","title":"Business ontologies for regulated-industry agents","category":"Enterprise knowledge","status_2026":"Platform launch","in_2026":"Argonos combined enterprise search, explicit business relationships, orchestration and governance.","risk":"An ontology is a policy surface. If the agent grounds an action in a relationship model that is stale or unaudited, the action looks justified while resting on a false premise.","moat":3,"role":"Version the ontology and bind every policy decision to the version it used. A relationship change is a governed change with an owner, a review and an effective date.","wiring":["Version the ontology and record its owner.","Bind each decision to the ontology version used.","Require review for relationships that affect regulated actions.","Re-evaluate open decisions when the ontology changes materially."],"modules":["cain/opa.py","cain/cain_policy_compiler.py","cain/policy_evolution.py","cain/runtime/passport.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"LIBRARY","limits":"Policy compilation and versioning exist. No ontology product or Argonos integration exists here.","offer":"Ontology & Policy Review","buyer":"Regulated enterprises and GRC teams","price":"$5,000–$12,000 per review","bundle":"identity-authority","stream":2},{"rank":47,"slug":"universal-commerce-protocol","title":"Universal commerce protocol","category":"Commerce","status_2026":"Standards launch","in_2026":"Google launched a standard spanning shopping discovery, purchase and post-purchase support.","risk":"A protocol that spans discovery to post-purchase also spans several authorities: browsing, payment, returns and data use. One session identity must not silently become all four.","moat":2,"role":"Scope each phase of the transaction separately and carry the purchase mandate only into the phases that need it. Discovery gets read scope; payment gets a bounded mandate; post-purchase gets order scope.","wiring":["Issue phase-specific scopes rather than one session-wide grant.","Carry the payment mandate only into checkout.","Enforce merchant, amount and velocity limits at payment.","Record the handoff between phases."],"modules":["cain/commerce/mandate_guard.py","cain/runtime/transactions.py","cain/interop/commerce.py"],"proof":[{"label":"Run the live payment-mandate demo","href":"/api/v1/payment-mandate-guard/presets"}],"evidence":"PROPOSED","limits":"No universal-commerce protocol implementation exists here. The mandate guard is real and useful for the payment phase only.","offer":"Commerce Protocol Authority Review","buyer":"Commerce platforms and standards bodies","price":"Advisory from $10,000","bundle":"commerce-payments","stream":2},{"rank":48,"slug":"browser-payments-without-card-details","title":"Browser payments without exposing card details","category":"Payments","status_2026":"Product release","in_2026":"KERNEL announced payments using protected credentials in authorised browser sessions.","risk":"The safety property is that raw card data never enters model context. That requires a credential boundary the agent cannot read through, plus a mandate that limits what the credential may be used for.","moat":2,"role":"Keep the credential in a broker the agent cannot read, and authorise each use against a mandate. CAIN's broker and payment-mandate paths separate the agent's intent from the secret that fulfils it.","wiring":["Store the credential outside the agent's context.","Authorise the payment against a bounded mandate.","Release the credential only to the authorised checkout flow.","Record the authorisation without recording the secret."],"modules":["cain/commerce/mandate_guard.py","keystone/broker.py","cain/browser/agent_firewall.py"],"proof":[{"label":"Run the live payment-mandate demo","href":"/api/v1/payment-mandate-guard/presets"}],"evidence":"LIVE","limits":"The mandate guard and broker concepts are real; the hosted demo uses fixed presets. No card network, wallet or KERNEL integration exists.","offer":"Agent Checkout Mandate Review","buyer":"Merchants, PSPs and browser vendors","price":"$3,500–$7,500 per review","bundle":"commerce-payments","stream":2},{"rank":49,"slug":"structured-website-actions-webmcp","title":"Structured website actions through WebMCP","category":"Web agents","status_2026":"Reported implementation of a proposed standard","in_2026":"Cashfree reported exposing checkout operations as explicit agent-callable tools.","risk":"Structured tools are less brittle than visual clicking, but a tool definition is an instruction to an agent. A poisoned description or an over-broad schema can redirect the agent just as effectively as a fake button.","moat":2,"role":"Scan the tool definition before the agent sees it, validate arguments against a schema, and keep the tool's authority narrower than the session's.","wiring":["Scan the tool name, description and schema for injection.","Constrain arguments to the documented business operation.","Give the tool a scope no broader than the operation.","Record the tool version and the caller."],"modules":["cain/mcp_proxy.py","mcp-security-scanner/engine.py","cain/tool_metadata_guard.py"],"proof":[{"label":"Scan a live MCP tool definition","href":"/mcpgate-keystone"}],"evidence":"LIVE","limits":"The scanner and proxy are real. No WebMCP implementation or Cashfree integration exists here.","offer":"Web Tool Definition Review","buyer":"Merchants and web-platform vendors","price":"$2,500–$5,000 per review","bundle":"commerce-payments","stream":5},{"rank":50,"slug":"banking-detection-of-agent-activity","title":"Banking detection of agent activity","category":"Financial security","status_2026":"Product launch","in_2026":"BioCatch AiRE aimed to distinguish agent-driven interactions using behavioural and infrastructure signals.","risk":"Detection is not authorisation. A bank that can tell an agent is present still needs to know whether that agent holds a valid mandate for this account and this transaction.","moat":1,"role":"Combine behavioural risk with cryptographic authority: a high trust score cannot substitute for a missing mandate, and a valid mandate cannot bypass a fraud hold.","wiring":["Score the interaction for agent and fraud signals.","Check the mandate and the account authority separately.","Require both a passing score and a valid mandate.","Record the signals used without storing sensitive raw behaviour."],"modules":["cain/runtime/fingerprint.py","cain/commerce/mandate_guard.py","cain/telemetry.py"],"proof":[{"label":"Run the live payment-mandate demo","href":"/api/v1/payment-mandate-guard/presets"}],"evidence":"LIBRARY","limits":"Fingerprint and mandate code exist. No bank deployment or BioCatch integration exists.","offer":"Agent Interaction Risk Review","buyer":"Banks and fraud-prevention vendors","price":"$5,000–$12,000 per review","bundle":"identity-authority","stream":2},{"rank":51,"slug":"know-your-agent-identity-intelligence","title":"Know Your Agent identity intelligence","category":"Identity","status_2026":"Product announcement","in_2026":"LexisNexis Risk Solutions introduced agent-focused identity and fraud intelligence.","risk":"An agent identity is not only a keypair. It includes the operator, the model, the purpose, the delegation chain and the accountable human, and those attributes change over time.","moat":1,"role":"Represent the agent as a composite identity with an operator, a workload, a purpose and a delegation history. Trust is computed from that record and decays when the evidence is stale.","wiring":["Register the agent with operator, workload and purpose.","Record the model and tool versions it runs.","Compute trust from current evidence, not from registration alone.","Decay or revoke when the record is stale."],"modules":["cain/cain_crypto_identity.py","cain/spiffe.py","cain/argus/lease.py","cain/runtime/fingerprint.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"LIBRARY","limits":"Composite identity and workload-identity primitives exist. No credit-bureau data or LexisNexis integration exists.","offer":"Agent Identity Review","buyer":"Identity vendors, banks and enterprises","price":"$5,000–$12,000 per review","bundle":"identity-authority","stream":2},{"rank":52,"slug":"controlled-agent-to-agent-commerce","title":"Controlled agent-to-agent commerce experiments","category":"Agent commerce","status_2026":"Controlled experiment","in_2026":"Anthropic's Project Deal assigned agents to buy, sell and negotiate in an internal marketplace.","risk":"Two agents negotiating can collude, misrepresent or converge on a price that neither principal authorised. The principals' mandates, not the agents' preferences, have to bound the deal.","moat":2,"role":"Put both sides' mandates into the settlement check: price ceiling, quantity, counterparty and expiry. A deal that exceeds either mandate is refused even if both agents agree.","wiring":["Record each principal's mandate before negotiation.","Evaluate the proposed deal against both mandates.","Detect collusion and self-dealing across the agent graph.","Settle only when both sides are within authority."],"modules":["cain/commerce/mandate_guard.py","cain/federation/assurance.py","cain/mesh/dispute.py","cain/runtime/transactions.py"],"proof":[{"label":"Run the live A2A trust demo","href":"/api/v1/a2a-trust-guard/presets"}],"evidence":"LIBRARY","limits":"Mandate and settlement primitives exist. No marketplace experiment is run by this deployment.","offer":"Agent-to-Agent Deal Review","buyer":"Marketplaces and trading platforms","price":"$5,000–$12,000 per review","bundle":"commerce-payments","stream":2},{"rank":53,"slug":"consumer-agents-connected-to-services","title":"Consumer agents connected to real services","category":"Consumer agents","status_2026":"Regional product rollout","in_2026":"Meta Muse launched in Singapore with shopping, transport, travel and deal-service connections.","risk":"Consumer convenience crosses several service providers with different terms. The agent needs a per-service authority and a clear answer to who pays, who cancels and who is accountable when a booking is wrong.","moat":2,"role":"Keep a per-service mandate and a per-action receipt. The agent may act for the user, but the service sees a bounded delegated authority, not the user's whole account.","wiring":["Grant a per-service scope with a clear purpose.","Bind each booking or purchase to a receipt.","Record the cancellation and refund path.","Name the accountable principal for each action."],"modules":["cain/commerce/mandate_guard.py","cain/browser/agent_firewall.py","cain/runtime/transactions.py"],"proof":[{"label":"Run the live payment-mandate demo","href":"/api/v1/payment-mandate-guard/presets"}],"evidence":"PROPOSED","limits":"No consumer-service connector exists here. This is an authority design, not a Meta Muse integration.","offer":"Consumer Agent Authority Review","buyer":"Consumer platforms and marketplaces","price":"Advisory from $10,000","bundle":"commerce-payments","stream":2},{"rank":54,"slug":"deployment-driven-agent-benchmarks","title":"Deployment-driven agent benchmarks","category":"Evaluation","status_2026":"Reported research system","in_2026":"TraceDance converted real deployment traces into targeted behaviour tests.","risk":"A benchmark built from production traces contains production data and production failures. Using it safely requires consent, redaction, tenant separation and a way to tell whether a failure is still reproducible.","moat":6,"role":"Convert signed production records into a redacted, frozen test suite. The suite is an adversarial asset: the agent being tested must not be able to edit it, and every result names the trace it came from.","wiring":["Select traces with consent and tenant approval.","Redact secrets and personal data before the trace becomes a test.","Freeze the suite and hash it.","Re-run the frozen suite after every change and record the delta."],"modules":["keystone/agentci.py","keystone/evalrun.py","cain/runtime/incident.py","keystone/heldout.py"],"proof":[{"label":"Run the live agent release gate","href":"/agent-ci-keystone"}],"evidence":"LIVE","limits":"The hosted release gate evaluates fixed agent behaviour suites. It is not TraceDance and does not use customer traces.","offer":"Deployment Trace Evaluation","buyer":"Agent-platform teams and QA organisations","price":"$3,500–$7,500 per audit","bundle":"code-proof","stream":10},{"rank":55,"slug":"multi-session-memory-evaluation","title":"Multi-session memory evaluation","category":"Memory evaluation","status_2026":"Research benchmark","in_2026":"MemoryArena tested whether agents use earlier experience to complete interdependent later tasks.","risk":"Memory that is useful can also be stale, contaminated or applied outside its original scope. Evaluation has to test refusal and scope, not only recall.","moat":2,"role":"Score memory on four axes: recall, scope, freshness and authority effect. A memory that is recalled into the wrong tenant or purpose is a failure, not a hit.","wiring":["Define the memory's tenant, purpose and validity window.","Test recall on the intended task.","Test refusal on an out-of-scope task.","Test supersession when the source changes."],"modules":["cain/argus/memory_firewall.py","cain/continuum/memory_continuity.py","cain/memory.py"],"proof":[{"label":"Run the live memory-sanitisation demo","href":"/memguard-keystone"}],"evidence":"LIBRARY","limits":"The memory firewall and continuity tests exist. No MemoryArena implementation is present.","offer":"Memory Evaluation Review","buyer":"Agent-memory vendors and enterprise AI teams","price":"$3,500–$7,500 per evaluation review","bundle":"memory-context","stream":2},{"rank":56,"slug":"visually-complex-knowledge-work-evaluation","title":"Visually complex knowledge-work evaluation","category":"Evaluation","status_2026":"Released benchmark","in_2026":"Google and Artificial Analysis introduced the Multimodal Knowledge Agent benchmark.","risk":"A benchmark score is a statement about a benchmark. It becomes trustworthy for a buyer only when the task distribution, the grading method and the failure cases are inspectable.","moat":4,"role":"Treat benchmark artifacts like any other evidence: record the task, the model, the inputs, the grader and the result, and publish the failures. A score without its grading record is marketing.","wiring":["Record the exact task and input files.","Record the model, version and decoding settings.","Record the grader and its rubric.","Publish failures and near-misses alongside the score."],"modules":["keystone/evalrun.py","keystone/modelcard.py","keystone/heldout.py","cain/worm_export.py"],"proof":[{"label":"Inspect a live signed evaluation run","href":"/keystone"}],"evidence":"LIBRARY","limits":"Evaluation and model-card code exist. CAIN does not publish a multimodal knowledge-work score.","offer":"Benchmark Evidence Review","buyer":"Benchmark authors and procurement teams","price":"$2,500–$5,000 per review","bundle":"runtime-evidence","stream":10},{"rank":57,"slug":"shopping-benchmarks-that-reward-refusal","title":"Shopping benchmarks that reward refusing bad purchases","category":"Evaluation","status_2026":"Released benchmark","in_2026":"Visa's Agentic Commerce Benchmark tested requirements gathering, evidence, selection and refusal.","risk":"Refusal is a control, not a score. A shopping agent should refuse when the mandate, merchant, amount or evidence is missing, and the refusal should be recorded as a decision.","moat":1,"role":"Make refusal a first-class outcome in the mandate engine: missing evidence, unknown merchant and exceeded limit all produce a recorded DENY rather than a best guess.","wiring":["State the purchase requirements and the mandate.","Verify the merchant and the amount.","Refuse when evidence or authority is missing.","Record the refusal and its reason."],"modules":["cain/commerce/mandate_guard.py","cain/guard.py","cain/runtime/transactions.py"],"proof":[{"label":"Run the live payment-mandate demo","href":"/api/v1/payment-mandate-guard/presets"}],"evidence":"LIVE","limits":"The mandate demo exercises refusal on fixed carts. It is not Visa's benchmark and does not publish a score.","offer":"Commerce Refusal Review","buyer":"Merchants, PSPs and commerce platforms","price":"$2,500–$5,000 per review","bundle":"commerce-payments","stream":2},{"rank":58,"slug":"repeated-run-framework-comparisons","title":"Repeated-run comparisons of agent frameworks","category":"Evaluation","status_2026":"Independent benchmark report","in_2026":"AI Multiple reported thousands of controlled runs comparing thirteen frameworks.","risk":"Repeated runs are more informative than a demo, but only if the harness, model, prompts, tools and scoring are fixed and published. Otherwise the comparison measures the harness.","moat":6,"role":"Publish the harness as a signed artifact and re-run it. CAIN's eval-run and agent-ci paths keep the suite, the model version and the result together.","wiring":["Freeze the harness, tasks and scoring rubric.","Pin the model and tool versions.","Run enough repetitions to report variance.","Publish the harness and the raw results."],"modules":["keystone/evalrun.py","keystone/agentci.py","keystone/heldout.py"],"proof":[{"label":"Run the live agent release gate","href":"/agent-ci-keystone"}],"evidence":"LIBRARY","limits":"The evaluation harness exists. CAIN has not run a thirteen-framework comparison.","offer":"Framework Evaluation Review","buyer":"Procurement teams and platform vendors","price":"$5,000–$12,000 per study","bundle":"code-proof","stream":10},{"rank":59,"slug":"efficient-browser-action-loops","title":"More efficient browser representations and action loops","category":"Browser agents","status_2026":"Engineering evaluation","in_2026":"Engineering evaluations examined trimmed accessibility trees, action batching and adaptive waiting.","risk":"Efficiency changes the failure mode. Batching actions reduces the number of checkpoints, which can turn several independently reviewable steps into one opaque leap.","moat":5,"role":"Keep the checkpoint at the consequential boundary, not at every keystroke. Batching is allowed for reversible preparation; an irreversible action still needs its own decision.","wiring":["Classify batched actions as reversible or consequential.","Allow batching of reversible preparation.","Require a separate checkpoint before an irreversible effect.","Record the expanded action sequence for review."],"modules":["cain/browser/agent_firewall.py","cain/argus/path.py","platform-gateway/action_risk.py"],"proof":[{"label":"Run the live browser-agent demo","href":"/api/v1/browser-agent-firewall/presets"}],"evidence":"LIVE","limits":"The browser firewall demo evaluates fixed presets. It does not measure browser-agent efficiency.","offer":"Browser Agent Control Review","buyer":"Browser-agent vendors and web platforms","price":"$2,500–$5,000 per review","bundle":"commerce-payments","stream":2},{"rank":60,"slug":"composable-web-research-toolchains","title":"Composable web-research toolchains","category":"Research tooling","status_2026":"Tool release","in_2026":"Parallel MCP 2.0 combined search, extraction, grounded decisions and research tools.","risk":"A research agent that delegates evidence gathering to several tools needs to know which tool produced which evidence, and whether a result was retrieved, inferred or generated.","moat":2,"role":"Tag every retrieved artifact with its tool, query and timestamp, and keep the tags through summarisation. A summary that loses its source tags cannot support a decision.","wiring":["Tag each retrieval with tool, query and time.","Keep source tags through extraction and summary.","Mark generated text as generated, not retrieved.","Refuse a grounded decision whose evidence tags are missing."],"modules":["cain/mcp_proxy.py","cain/runtime/a2a.py","cain/causality/evidence.py"],"proof":[{"label":"Scan a live MCP tool definition","href":"/mcpgate-keystone"}],"evidence":"LIVE","limits":"The MCP boundary is real. No Parallel MCP 2.0 integration exists.","offer":"Research Toolchain Review","buyer":"Research-tool vendors and analyst teams","price":"$3,500–$7,500 per review","bundle":"identity-authority","stream":2},{"rank":61,"slug":"crm-specialized-reasoning-models","title":"CRM-specialised reasoning models","category":"Domain models","status_2026":"Model announcement","in_2026":"Salesforce and NVIDIA announced Koa for Agentforce, built on Nemotron.","risk":"A domain model is still a model. Specialisation can improve the answer while leaving the authority, data-access and action-boundary questions exactly where they were.","moat":1,"role":"Evaluate the model as one input to a trust decision, not as the decision. The CRM record's sensitivity, the user's authority and the action's consequence determine what the model may do.","wiring":["Classify the CRM record and the requested action.","Check the user's and agent's authority for that record.","Use the domain model to propose, not to authorise.","Record the model version and the authority decision."],"modules":["cain/argus/verifier_mesh.py","keystone/actors.py","cain/runtime/runtime_bus.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"PROPOSED","limits":"No Salesforce or NVIDIA model integration exists here. This is a placement argument, not a benchmark.","offer":"Domain Model Authority Review","buyer":"CRM and enterprise application vendors","price":"$5,000–$12,000 per review","bundle":"identity-authority","stream":8},{"rank":62,"slug":"local-ai-coding-on-personal-computers","title":"Local AI coding on personal computers","category":"Developer tooling","status_2026":"Reported model and hardware announcement","in_2026":"Microsoft presented a coding model intended to run directly on PCs.","risk":"Local execution reduces data exposure but not action risk. A local agent still writes files, runs builds and can reach the network, and the user may have less monitoring than a server deployment.","moat":6,"role":"Apply the same guard locally: a scoped sandbox, an allowlist of tools, no inherited secrets, and a signed local record. Local is a deployment mode, not a trust exemption.","wiring":["Run the model and tools in a local sandbox.","Restrict filesystem and network access to the task.","Keep secrets out of the model context.","Write a local signed record of the run."],"modules":["cain/isolation/sandbox.py","keystone/guard.py","keystone/sandbox.py","cain/landlock_sandbox.py"],"proof":[{"label":"Run the live IDE-diff gate","href":"/vibeguard-keystone"}],"evidence":"LIBRARY","limits":"The sandbox and guard are real on this host. No Microsoft model or PC hardware is involved.","offer":"Local Agent Containment Review","buyer":"Developer-tool vendors and enterprise IT","price":"$3,500–$7,500 per review","bundle":"code-proof","stream":2},{"rank":63,"slug":"agent-permission-review-in-collaboration-tools","title":"Agent permission review inside collaboration tools","category":"Workplace governance","status_2026":"Integration announcement","in_2026":"Salesforce and NVIDIA described Slack-based inspection and approval of agent permission requests.","risk":"Approval in chat is convenient and easy to spoof. The approver needs to see the exact action, the target and the consequence, and the approval must be bound to that action rather than to a message thread.","moat":2,"role":"Bind approval to an action digest and a named approver. A chat message can carry the request, but the approval record is separate, signed and single-use.","wiring":["Render the exact action and consequence in the request.","Bind the approval to the action digest and expiry.","Verify the approver's identity and authority.","Consume the approval once and record it."],"modules":["keystone/approval.py","cain/argus/reauthorization.py","cain/worm_export.py"],"proof":[{"label":"Run the live action-bound approval demo","href":"/approval-keystone"}],"evidence":"LIVE","limits":"The approval demo is real on fixed actions. No Slack or Salesforce integration exists.","offer":"Chat Approval Review","buyer":"Collaboration platforms and enterprise IT","price":"$2,500–$5,000 per review","bundle":"identity-authority","stream":2},{"rank":64,"slug":"enterprise-agent-inventory-and-cost","title":"Enterprise agent inventory and cost accountability","category":"Agent operations","status_2026":"Product release","in_2026":"AgentNuro offered discovery, usage measurement and policy checks across agent platforms.","risk":"You cannot govern an agent you cannot enumerate. Inventory, owner, authority and spend have to be joined in one record, or every control has a blind spot.","moat":1,"role":"Maintain a registry that joins identity, owner, authority, tools, data scope and metered spend. An unregistered agent is denied by default, not discovered later.","wiring":["Register each agent with an accountable owner.","Record its tools, data scope and authority.","Meter usage and attribute cost to the owner.","Deny unregistered agents at the boundary."],"modules":["cain/metering.py","cain/runtime/fingerprint.py","cain/spiffe.py","cain/entitlements.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"LIBRARY","limits":"Metering and identity code exist. No AgentNuro integration or customer inventory is present.","offer":"Agent Inventory Review","buyer":"Enterprise IT and FinOps teams","price":"$5,000–$12,000 per review","bundle":"runtime-evidence","stream":3},{"rank":65,"slug":"work-personal-data-separation","title":"Work–personal data separation for mobile agents","category":"Mobile security","status_2026":"Enterprise platform announcement","in_2026":"Android Enterprise described controls preventing personal agents from accessing corporate data.","risk":"A separation control is only real if the data path enforces it. If the agent can read a work profile through a share sheet, clipboard or accessibility service, the policy is decorative.","moat":2,"role":"Enforce the boundary at the data and identity layer, not only in the UI. Work data carries a tenant tag; the agent's context is filtered by that tag; the tool call is checked against it.","wiring":["Tag work data with a tenant and a handling class.","Filter the agent's readable context by tag.","Block cross-boundary share, clipboard and screen capture.","Record every boundary decision."],"modules":["cain/argus/memory_firewall.py","cain/spiffe.py","cain/argus/envelope.py"],"proof":[{"label":"Run the live memory-sanitisation demo","href":"/memguard-keystone"}],"evidence":"PROPOSED","limits":"No Android Enterprise or mobile data-path implementation exists here. This is a boundary design.","offer":"Mobile Data Boundary Review","buyer":"Mobile-platform vendors and enterprise mobility teams","price":"$5,000–$12,000 per review","bundle":"memory-context","stream":2},{"rank":66,"slug":"mobile-browser-agents-for-errands","title":"Mobile browser agents for real-world errands","category":"Browser agents","status_2026":"Announced rollout","in_2026":"Google announced Chrome auto browse for bounded tasks such as appointments and parking reservations.","risk":"An errand may spend money, accept terms or create a booking. The agent needs a bounded task, a payment ceiling and a clear stop before it commits.","moat":5,"role":"Declare the errand's bounds before browsing: sites, spend, time and acceptable commitments. The firewall refuses a checkout or a terms acceptance outside the declaration.","wiring":["Declare allowed sites, spend ceiling and commitment types.","Score each action against the declaration.","Pause before payment or binding terms.","Record the confirmation and the receipt."],"modules":["cain/browser/agent_firewall.py","cain/commerce/mandate_guard.py","cain/argus/path.py"],"proof":[{"label":"Run the live browser-agent demo","href":"/api/v1/browser-agent-firewall/presets"}],"evidence":"LIVE","limits":"The browser firewall demo evaluates fixed presets. It does not drive Chrome or book anything.","offer":"Browser Errand Review","buyer":"Browser vendors and consumer platforms","price":"$2,500–$5,000 per review","bundle":"commerce-payments","stream":2},{"rank":67,"slug":"agent-to-agent-advertising-execution","title":"Agent-to-agent advertising execution","category":"Advertising","status_2026":"Platform launch","in_2026":"PubMatic launched AgenticOS for agent-coordinated advertising workflows.","risk":"Advertising agents move real budgets across many counterparties. The risk is not a bad single ad; it is a sequence of small, individually defensible moves that breaches the campaign's authority.","moat":2,"role":"Aggregate spend and placement authority across the campaign, not per call. A trajectory-level ceiling catches the salami pattern that per-request checks miss.","wiring":["Issue a campaign-level budget and counterparty authority.","Aggregate spend across all agents and calls.","Detect a sequence that approaches the ceiling through small moves.","Pause the campaign when the aggregate is exhausted."],"modules":["cain/federation/assurance.py","cain/runtime/transactions.py","cain/argus/path.py","cain/commerce/mandate_guard.py"],"proof":[{"label":"Run the live A2A trust demo","href":"/api/v1/a2a-trust-guard/presets"}],"evidence":"PROPOSED","limits":"No advertising platform or budget connector exists here. The aggregate-control primitives are real; the campaign workflow is a design.","offer":"Campaign Authority Review","buyer":"Ad-tech platforms and media buyers","price":"Advisory from $10,000","bundle":"commerce-payments","stream":8},{"rank":68,"slug":"bring-your-own-agent-advertising","title":"Bring-your-own-agent advertising","category":"Advertising","status_2026":"Platform announcement","in_2026":"Yahoo DSP announced support for native agents, customer models and combinations connected through APIs or MCP.","risk":"A customer-supplied agent on a platform is third-party code with budget authority. The platform needs a capability boundary, a sandbox and an audit trail that does not depend on the customer's own logging.","moat":2,"role":"Treat the customer agent as an untrusted workload: scoped credentials, a typed tool surface, a spend mandate and platform-side evidence.","wiring":["Issue platform-scoped credentials per customer agent.","Expose a typed tool surface, not a general API key.","Bound spend and counterparties with a mandate.","Keep platform-side evidence independent of the customer's logs."],"modules":["cain/mcp_proxy.py","cain/runtime/a2a.py","cain/argus/lease.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"PROPOSED","limits":"No Yahoo DSP or advertising API integration exists. This describes the boundary a platform would need.","offer":"Third-Party Agent Review","buyer":"Ad platforms and enterprise marketing teams","price":"Advisory from $10,000","bundle":"identity-authority","stream":8},{"rank":69,"slug":"agentic-advertising-interoperability","title":"Agentic advertising interoperability standards","category":"Standards","status_2026":"Standards initiative","in_2026":"IAB Tech Lab adapted advertising infrastructure for agent communication and execution.","risk":"Interoperability standards define message shape, not authority. Two compliant agents can still agree to a transaction neither principal authorised.","moat":2,"role":"Keep authority outside the message standard: a mandate and a settlement check on each side, independent of the protocol's fields.","wiring":["Map the protocol message to an action and a principal.","Check the principal's mandate outside the protocol.","Settle only when both sides' mandates agree.","Record the protocol version and the authority decision."],"modules":["cain/interop/adapters.py","cain/interop/commerce.py","cain/acp/objects.py","cain/federation/assurance.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"PROPOSED","limits":"No IAB Tech Lab implementation exists here. CAIN's interop adapters are real but not certified against that standard.","offer":"Interop Authority Review","buyer":"Standards bodies and ad-tech platforms","price":"Advisory from $10,000","bundle":"identity-authority","stream":2},{"rank":70,"slug":"retailer-controlled-agents-in-search","title":"Retailer-controlled agents in search","category":"Commerce","status_2026":"Product announcement","in_2026":"Google announced Business Agent for branded product conversations directly in Search.","risk":"A retailer agent speaking for a brand is a delegated representative. Its claims, prices and commitments need a source and a limit, especially when it speaks inside someone else's surface.","moat":1,"role":"Give the retailer agent a bounded representation mandate: which catalogue, which prices, which promises. A claim outside the mandate is refused, and every answer cites its source.","wiring":["Issue a representation mandate for catalogue, price and policy.","Bind each answer to a product and price record.","Refuse claims outside the mandate.","Record the answer and its sources."],"modules":["cain/mcp_proxy.py","cain/commerce/mandate_guard.py","cain/runtime/passport.py"],"proof":[{"label":"Fire a live governed decision","href":"/fabric/try"}],"evidence":"PROPOSED","limits":"No Google Search or retailer integration exists. This is a representation-boundary design.","offer":"Brand Agent Review","buyer":"Retailers and commerce platforms","price":"Advisory from $7,500","bundle":"commerce-payments","stream":2},{"rank":71,"slug":"proactive-personal-assistants","title":"Proactive personal assistants","category":"Personal agents","status_2026":"Product launch","in_2026":"Anthropic introduced Claude Duet as an assistant able to reach out before being prompted.","risk":"Initiative is a standing authority to interrupt and act. A proactive agent needs a reason, a relevance check, a quiet default and a hard limit on what it may do without a fresh instruction.","moat":7,"role":"Separate initiative from authority: the agent may propose, but a standing lease defines what it may execute unattended, and that lease is reviewable and revocable.","wiring":["Define the proactive lease: topics, sources, actions and frequency.","Check relevance and consent before reaching out.","Require a fresh grant for any new class of action.","Let the user revoke and audit the lease."],"modules":["cain/argus/lease.py","cain/argus/reauthorization.py","cain/argus/state_machine.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"LIBRARY","limits":"The lease engine is real. No proactive assistant product is operated here.","offer":"Proactive Agent Lease Review","buyer":"Assistant vendors and platform teams","price":"$3,500–$7,500 per review","bundle":"runtime-evidence","stream":3},{"rank":72,"slug":"reusable-user-defined-workflow-skills","title":"Reusable user-defined workflow skills","category":"Agent skills","status_2026":"Product transition announcement","in_2026":"Google announced skills for recurring tasks as a replacement for Gems.","risk":"A saved workflow is a standing instruction that can outlive its context. If it embeds a credential, a destination or an assumption, reuse turns one decision into many.","moat":2,"role":"Store the skill as a manifest with declared tools, data and limits. At run time, re-evaluate the authority instead of inheriting it from the saved definition.","wiring":["Save the skill as a manifest, not as a blob of instructions.","Declare tools, data scope and limits.","Re-evaluate authority on every run.","Version the skill and record which version ran."],"modules":["cain/runtime/skills.py","cain/isolation/skill_sandbox.py","keystone/skill_static.py"],"proof":[{"label":"Run the live skill-sandbox demo","href":"/openclaw-keystone"}],"evidence":"LIVE","limits":"The skill sandbox and static checks are real on fixed samples. No Google product integration exists.","offer":"Saved Workflow Review","buyer":"Assistant platforms and enterprise IT","price":"$2,500–$5,000 per review","bundle":"memory-context","stream":2},{"rank":73,"slug":"industrial-expertise-captured-as-agents","title":"Industrial expertise captured as agents","category":"Industrial knowledge","status_2026":"Product announcement","in_2026":"Trimble Agent Studio aimed to encode operating procedures and experienced workers' knowledge.","risk":"Captured expertise is only as good as its source and its currency. A procedure that was correct five years ago can be dangerous today, and a model's summary can lose the exception that made it safe.","moat":3,"role":"Bind each procedure to its expert, revision and effective date, and keep exceptions explicit. The agent may retrieve the procedure; it may not invent the exception.","wiring":["Record the expert, source and revision of each procedure.","Keep exceptions and preconditions explicit.","Expire procedures that have no current review.","Cite the procedure version in every recommendation."],"modules":["cain/runtime/world_model.py","cain/cain_digital_twin.py","cain/causality/graph.py"],"proof":[{"label":"Inspect the live ARGUS status","href":"/fabric/argus/status"}],"evidence":"PROPOSED","limits":"No industrial procedure corpus or Trimble integration exists. Tacit-expertise capture is an unsolved problem, as the source list notes.","offer":"Industrial Knowledge Review","buyer":"Industrial vendors and operators","price":"Advisory from $10,000","bundle":"physical-lab","stream":2},{"rank":74,"slug":"international-mobile-agent-deployment","title":"Broader international mobile-agent deployment","category":"Mobile agents","status_2026":"Deployment expansion","in_2026":"Google announced task-automation expansion to additional markets and devices.","risk":"A wider deployment multiplies jurisdictions, languages and device behaviours. A control that held in one market may fail on a different app version, language or legal regime.","moat":2,"role":"Keep the control independent of the app surface: identity, authority and data boundary are checked at the action layer, and the evidence records the locale and app version.","wiring":["Record locale, app version and device class per action.","Apply the same authority and data-boundary checks across markets.","Re-test the action surface when an app version changes.","Keep evidence portable across jurisdictions."],"modules":["cain/browser/agent_firewall.py","cain/federation/assurance.py","cain/argus/envelope.py"],"proof":[{"label":"Run the live browser-agent demo","href":"/api/v1/browser-agent-firewall/presets"}],"evidence":"PROPOSED","limits":"No international mobile deployment or Google integration exists here.","offer":"Mobile Expansion Review","buyer":"Mobile platforms and app vendors","price":"$5,000–$12,000 per review","bundle":"commerce-payments","stream":2},{"rank":75,"slug":"observational-evidence-of-task-delegation","title":"Observational evidence of larger task delegation","category":"Adoption research","status_2026":"Observational research","in_2026":"OpenAI's Codex research documented parallel-agent use and requests estimated to represent substantial human work.","risk":"Estimated task size is not verified time saved, and adoption is not control. The useful measurement is what was delegated, under what authority, with what result and what rework.","moat":4,"role":"Measure the delegated unit, not the anecdote: task, authority, duration, result, rework and reviewer. CAIN's run recorder and metering keep those together so a claim about delegation can be checked.","wiring":["Define the delegated unit and its authority.","Record duration, result and rework.","Separate estimated from observed effort.","Publish the measurement method with the result."],"modules":["keystone/recorder.py","cain/metering.py","cain/worm_export.py","cain/runtime/fingerprint.py"],"proof":[{"label":"Inspect a live signed run record","href":"/recorder-keystone"}],"evidence":"LIVE","limits":"The recorder produces signed run records on fixed samples. CAIN has not measured customer delegation or time saved.","offer":"Delegation Measurement Review","buyer":"Agent vendors and enterprise buyers","price":"$2,500–$5,000 per review","bundle":"runtime-evidence","stream":4}]}