The gap
Everything below is quoted verbatim from published vendor documentation and held as a dated capture. We have not characterised anyone’s product for them. Read the sources, and draw your own conclusion — that is the point of publishing it this way rather than asserting it.
Captured 26 September 2026 and 30 September 2026 · every quotation links to its source
Every row has the first column. Not one has the last two. The middle columns are where these systems genuinely differ, and where some of them do things we do not claim to do. The assessment is ours, made from the documentation quoted below — where a vendor describes no such capability we record its absence rather than infer its presence, which means a No may mean “undocumented” rather than “absent”. Tell us where that is wrong and we will change it.
“The runtime is stateless. It MUST NOT retain mutable state that influences a verdict from one evaluation to the next.”
Agent Control Specification §1.1 — microsoft/agent-governance-toolkit · captured 26 September 2026
Not an omission. A design rule, written as a prohibition. A runtime that must not remember cannot weigh an action against a decision made three sessions ago.
“Because an agent instance is unaware of the block action, the agent owner must actively monitor a DLP policy that uses this configuration and understand the impact to subsequent workflows.”
Microsoft Purview documentation, AI Agent 365 · captured 26 September 2026
The consequence, documented by the vendor as a customer caveat: the action is blocked, and a human must watch the policy because the agent does not know.
“Network inspection extends runtime protection to agents that don’t expose agent-native event interfaces.”
Microsoft Defender documentation, AI agent runtime protection · captured 26 September 2026
The strongest capability on this page that we do not claim. Governing an agent that exposes no hook at all is genuinely hard, and Microsoft ships it.
“stores only your hook configuration and metadata about hook activity, such as verdicts, timestamps, and request identifiers”
Anthropic platform documentation, Inference hooks · captured 26 September 2026
Verdicts are retained as operational metadata. The hook can refuse. What it does not do is make the refusal part of what the model reads on the next turn.
“OpenShell software provides a secure runtime boundary that traces all actions and enforces policy as agents run on NVIDIA Vera CPUs.”
NVIDIA newsroom, 28 September 2026 · captured 30 September 2026
A containment boundary, launched with more than 100 partners. Sentry “can quarantine agents that attempt to move outside their boundaries in milliseconds” — and the next agent begins from zero.
Every system above can stop an agent. That is the half the industry built, and it built it well. The half that is missing is what happens next: the refusal is recorded for a human to read, and the agent that was refused carries nothing forward. It will try again, because nothing it can see says otherwise.
Microsoft wrote that limitation into a specification as a rule. Anthropic keeps verdicts as metadata. NVIDIA quarantines and moves on. Three independent teams, three implementations of the same half.
If you work at one of these companies and this misreads your architecture, we want to know. Write to us and we will correct the page and say that we did.