Agents get budgets and boundaries

The important AI news this morning is not that agents can do more. It is that large organizations are starting to treat them like things that need owners, budgets, sandboxes, logs, and kill switches.

Microsoft made the control plane concrete. At Build, Microsoft said Agent 365 for local agents extends Entra, Defender, and Purview into “a single control plane” for observing, governing, and securing agents across an estate. That is the key sentence in Microsoft’s Build post . The rest of the announcements fill in the shape: Microsoft Execution Containers, now in preview, are meant to let developers and IT define containment requirements once and have Windows enforce them; NVIDIA’s OpenShell uses MXC and adds policy management, inference routing, and PII obfuscation.

The security version is even more explicit. Microsoft’s security post says the Agent 365 SDK is generally available, Windows 365 for Agents can run agents in isolated, policy-governed Cloud PCs, and an Agent Registry can surface unmanaged local agents discovered by Defender, Entra, and Intune. It also says the registry supports more than 20 local-agent types, including coding agents, AI desktop apps, and local or remote MCP servers. This is not safety as a slogan. It is asset inventory, endpoint policy, data-loss prevention, and audit trails pointed at agents.

The local-PC story is now about prompt injection risk, not just speed. NVIDIA’s developer post says MXC exists because agents interacting with personal files and apps “pose real prompt injection risks,” and that MXC prevents them from accessing the full system. That matters because the frontier for agents is not chat. It is acting through browsers, filesystems, calendars, terminals, and enterprise apps. Once an agent can touch those surfaces, the question becomes less “is the model smart?” and more “what can this process reach after it is fooled?”

Uber put a price on the other side of the problem. TechCrunch reports that, citing Bloomberg, Uber now caps employees at $1,500 per month per agentic coding tool, including Claude Code and Cursor, after the company burned through its annual AI budget in four months. The notable detail is the dashboard. Usage is trackable by employees, with permission needed to exceed the cap. This is the financial twin of the security story: agents are becoming measurable operating expense, not magic productivity mist.

The substance is not that every Microsoft primitive will work, or that Uber has found the perfect number. The substance is that the agent era is moving from demo logic to management logic. Who owns the agent? What identity does it use? Which files, tools, networks, and credentials can it touch? What did it do yesterday? What did it cost? Who can stop it?

If you want to know whether agents are becoming real infrastructure, watch for those fields. The companies that can answer them will ship agents into actual workflows. The companies that cannot will keep discovering, one incident and one bill at a time, that autonomy without accounting is just another way to lose control.

Source graph: Semble collection .