Today's signals share a single spine, and it is not capability. It is provenance.
Mastercard's Verifiable Intent puts a cryptographic attestation primitive into the payment layer — a tamper-resistant answer to did an authorized agent, acting in sanctioned scope, trigger this? Stripe and Tempo's MPP, with Visa bridging to x402, completes the settlement half. And Microsoft Research's Vega delivers the same selective-disclosure property one layer down, at identity itself. Three independent actors, converging on the same Identity Control Surface this quarter: non-human identity governance has stopped being a whitepaper and become deployable infrastructure.
The enterprise problem is that the rails now exist before the internal policy does. That is not a metaphor — it is the index. Brand sits at 38, the lowest dimension we track, and Rasa's buyer research explains the mechanism precisely: architectural governance has displaced raw capability as the top selection criterion. Buyers are filtering out vendors that cannot prove policy-bounded behavior — and, by extension, filtering out their own programs that cannot articulate agent operating policy. The 38 is not an ethics score. It is a procurement score.
Meanwhile SAP's Autonomous Enterprise ships 200+ agents across every core function in Q3 at zero pricing uplift. This is the Compiled Corporation arriving by default, not by decision. For any firm already on SAP, the build-vs-buy calculus inverted overnight — and the one-million-conversation TCO threshold is the only honest way to decide which side of the default you should be on.
Here is the argument: the governance gap that blocked regulated deployment is closing on the vendor side faster than on the buyer side. The credentialed payment rail, the ZK identity proof, the platform-native agent fleet — all available now. What most enterprises lack is the prerequisite the rails assume: a defined map of which agents may act, within what scope, spending whose authority, provable to whom. Organization sits at 62 because the will exists. Product at 55 because the tooling is maturing. Brand lags at 38 because the identity architecture connecting them has not been written down.
The move this morning is not to buy a rail. It is to define the scope the rail will carry. Before Q3, map your roadmap's highest-volume agent use cases against the million-conversation line, then assign each a credentialed authorization model — payment authority, data scope, audit path. The vendors solved provenance. You still own intent.
Watch: The Trump administration's reported sovereign wealth fund model for AI equity stakes — a principal with regulatory authority and ownership simultaneously rewrites vendor independence, data sovereignty, and audit access assumptions that current enterprise risk models price at zero.
WatchTrump administration sovereign wealth fund model for AI equity stakes (Techmeme/Semafor): Senior officials are structuring potential government ownership positions in major AI companies. If enacted, this introduces a new class of principal into AI vendor governance — one with regulatory authority and equity interest simultaneously. The Identity Control Surface implications for enterprise AI procurement (vendor independence, data sovereignty, audit access) are significant and underpriced in current enterprise risk assessments.