The most telling AI-industry news this week was not a model release. It was a set of enterprise vendors competing to be the system that stops agents from doing what they should not. On 15 October ServiceNow announced AI Passport, which it describes as an authority layer and a cryptographically signed credential that verifies first- and third-party AI agents' scopes in real time.1 Five days later Salesforce agreed to buy the customer-engagement platform Braze.2 Read together, they show where the money and engineering effort are going as agents move from demos into regulated work.
Governance is being built as infrastructure
ServiceNow's announcement pairs AI Passport with expanded capabilities in its Super Intelligence Control Tower. The release says the Control Tower now covers discovery, visibility, control and cost-to-value measurement on a single data model.1 Jon Sigler's framing in the release is that discovering agents is not enough: “As AI agents proliferate across the enterprise, visibility alone isn't enough. Enterprises need confidence that every AI agent is operating within its authorized scope.”1 The technical point is the move from observing agents to bounding them at runtime, including MCP servers, which the release says AI Passport controls alongside agents.1
The same argument appeared from a different direction in a VentureBeat piece presented by the database company EDB. It says governance has to live in the data layer, and its sharpest line is a design principle: “The enterprise should not rely on a model choosing to follow policy. The policy has to be enforced by the system. That is the difference between hoping an actor stays in bounds and constructing bounds it cannot cross to begin with.”3 Note that this is sponsored content from a vendor with a product to sell. It is useful as a statement of the architecture vendors are converging on, not as independent evidence that it works.
The Braze deal: what a large agent bet looks like on the balance sheet
Salesforce said it entered a definitive agreement to buy Braze for approximately $5.66 billion in enterprise value, with Braze Class A holders receiving $47.50 per share in cash.2 For scale, that is about the amount Salesforce's operations generated in roughly four and a half months of fiscal 2025, when operating cash flow was $14.996 billion.4 That is Via News's own arithmetic on the verified figure, not a company statement.
The verified SEC data show a company with room to do this. Revenue rose from $34.857 billion in fiscal 2024 to $41.525 billion in fiscal 2025, and net income from $4.136 billion to $7.457 billion.4 Operating cash flow rose from $10.234 billion to $14.996 billion.4 Research and development spending grew from $4.906 billion to $5.993 billion.4 Capital expenditure, by contrast, fell from $736 million to $594 million.4 Salesforce is therefore adding AI capability by acquisition and software spending rather than by building out data centres of its own. That is a modest inference from two numbers, and the dossier does not explain the capex decline.
One caution on cash. Salesforce's verified quarterly cash balances swing widely, from $6.453 billion in Q3 2024 to $10.928 billion in Q1 2026 and $8.935 billion in Q1 2027.4 The dossier does not say how the Braze purchase will be funded, so we do not claim to know.
The entity graph we maintain lists Agentforce, Data Cloud and Einstein as Salesforce products, and records Salesforce as a competitor to Claude Cowork.5 The release's stated logic is bringing Braze's real-time engagement capabilities into Salesforce's platform.2 We cannot say from the dossier how the integration will work.
The small deal that says the same thing
A much smaller transaction points the same way. On 6 October, Tiny Ltd. completed its acquisition of the assets of Oso Cloud, an authorization software business, for approximately $1.9 million in cash.6 Tiny says it adds about $5.3 million of annualized recurring revenue, lifting its pro forma total about 7.6%, from $70.0 million to roughly $75.4 million.6 Oso served approximately 80 customers in security, fintech and developer software, all on recurring subscription contracts, including several multi-year agreements.6 Authorization is the layer that decides what a user or an agent may do. It is being priced and bought as a standalone business at the same time that larger vendors bundle it into platforms. The dossier does not show what drove the price, so we do not read more into it.
Why finance is the test case, and where AI is told to stay out
The narrative around this week's news is that governance, data sovereignty and enforced policy are preconditions for regulated sectors such as finance. A venture investor's remarks add a blunt limit. Sean Jacobsohn of Norwest said: “You don't want AI doing calculations because it is not good at math. There are certain workflows it can handle where it doesn't produce precise numbers. But when you need precision, accuracy and calculations, you can't rely on AI for that.”7 That is one investor's view, not a measured finding, but it fits the vendors' own emphasis on enforcement over trust. If a model cannot be relied on for exact figures, the system around it has to constrain or check what it does.
Jacobsohn also sees room for startups, with a caveat. He said it would be “very hard to disrupt the core products of Workday, ADP, SAP, UKG and Dayforce. But it's easier to disrupt some of their secondary products, where the category isn't their core business.”7 He added that CFOs buying their own software face “one less layer of approval,” making it “a little easier to replace it when they're the direct buyer.”7 SAP's 'Autonomous Enterprise' push is part of our topic narrative, but the dossier holds no SAP figures or primary SAP source, so we make no claims about it.
Agents in the field, with a reliability flag
Hospitality offers an early look at agents at scale. Dextr AI says its agents now handle more than 1 million interactions a month across hundreds of hotels.8 That figure is the company's own claim. The outlet that reported it, Crunchbase News, has a measured reliability of 50% across 38 checked claims, so treat it as unverified.8 The same caution applies to the Norwest interview, which comes from the same outlet.7 Press releases from NewsEOD, which carried the Salesforce, ServiceNow and Tiny announcements, have a measured reliability of 56% across 5,087 checked claims.1,2,6 Those announcements are statements of what each company says it is doing, and the deal terms are the parties' own.
Disputes show the same governance theme in a different form
ZenaTech filed a formal complaint with the BCSC and TSXV on 20 October, seeking regulatory intervention over Boardwalktech's failure to hold its 2026 annual meeting and what it calls continuing governance deficiencies.9 The same day it issued an open letter criticizing board independence, securities-law compliance and repeated small dilutive financings.9 These are one party's allegations; the dossier contains no response from Boardwalktech. The link to the AI story is thematic, not causal: consolidation is under way, and shareholder governance is being contested at the same time.
What to watch
- Whether the Braze deal closes, and how Salesforce says it will combine Braze with its agent products, since the release only describes the intent.2
- Whether enterprise buyers adopt runtime credentials like AI Passport, or whether policy enforcement stays a feature of data platforms, as EDB argues.1,3
- Whether Tiny reports how Oso Cloud's roughly 80 customers behave after the sale.6
- Any regulatory response to ZenaTech's complaint over Boardwalktech.9
Sources:
1 NewsEOD, "ServiceNow advances its operational harness for enterprise AI with AI Passport and expanded governance capabilities" (2026-10-15)
2 NewsEOD, "Salesforce Signs Definitive Agreement to Acquire Braze" (2026-10-20)
3 VentureBeat AI, "When agents act on their own, governance has to live in the data layer" (undated)
4 Via News verified data, Salesforce revenue, net income, operating cash flow, R&D expense, capex and cash, from SEC filings (FY 2024, FY 2025; quarterly cash Q3 2024 to Q1 2027)
5 Via News entity graph (Salesforce relationships)
6 NewsEOD, "Tiny Completes Acquisition of Oso Cloud" (2026-10-06)
7 Crunchbase News, "The Sales Test This Norwest Partner Gives Founders Before He’ll Invest" (undated)
8 Crunchbase News, "Exclusive: From Booking Calls To Late Check-Ins, Dextr AI Raises $6.7M For Hotel AI Agents" (undated)
9 Via News event record, ZenaTech complaint and open letter regarding Boardwalktech (October 20, 2026)