Every monitoring tool I've ever inherited was built to answer one kind of question. That's fine at first. Then the tool becomes the default, and the failures that don't fit its shape stop registering as failures at all. They're just weird outcomes nobody has a graph for, right up until they take down a Saturday. I spent a decade of on-call watching that happen with metrics dashboards. It's happening again with agents, except this time you can watch the category get fixed in place through acquisitions.
Dynatrace agreed to pay $915 million for Arize, a bet that agents are applications, and applications get traced and scored. Fortinet picked up Virtue AI and folded agent defense into a security portfolio, which classifies agents as attack surface. Okta's roughly $200 million deal for Permiso extends identity governance to non-human actors that keep doing things long after they've authenticated. Asana bought StackAI for $75 million, which puts agents somewhere closer to teammates you assign work to. All four are defensible on their own terms. Read together, though, each one encodes a theory about what an agent is, and the theory decides which problems the product hands you on a plate and which ones you have to go looking for.
Take the observability frame first, since it's the one I'd be most tempted by. Arize had already pushed well past basic model metrics into agent planning, tool selection, trajectory quality. But the objects it uses to represent those judgments are software-execution objects: traces, spans, evaluator scores. Agent misbehavior therefore looks like application misbehavior. What doesn't sit naturally in that shape is an agent that executes perfectly, right tool, right parameters, quick response, and makes a call that closes off something the user needed to keep open. A purchase that can't be unwound. A message sent to the wrong stakeholder at the wrong hour. Clean trace, bad outcome. A prior Market Pulse piece made a version of this point about authorization and behavioral evaluation sharing a word while belonging to different problems.
Virtue AI covered more than adversarial attacks. Hallucination, policy compliance, task completion were all in scope. Still, the center of gravity is whether an action broke a configured rule or matched a known threat pattern. An agent operating inside its permissions, complying with every policy, executing a plan that turns out to be wrong in a way nobody thought to prohibit, isn't a security event. It's a judgment failure, and the security frame has nowhere obvious to put it.
The other two work the same way. Identity governance catches the agent that exceeds its permissions and says considerably less about whether authorized behavior was wise. The workflow frame gives an agent a seat at the table without necessarily telling anyone whether its choices at that table were any good. You can see it's been assigned to the process. What it decided inside the process is a different question.
Protocol consolidation does something similar one layer down. As agent communication standards converge under shared governance (MCP for wiring agents to tools, A2A for agents coordinating with each other), agents get classified as endpoints on a network. That prioritizes connectivity, capability discovery, message format. Whether the agent that connected and coordinated successfully then made a sensible decision belongs to somebody else's layer.
So picking agent infrastructure right now also means picking a theory of what your agents are. The theory sets the questions you can ask, which sets the failures you catch early and the ones you meet later, after a consequence has traveled further than you'd like. None of these frames are wrong. But you should know which one you've signed up for, particularly if you didn't notice signing.
- Protocols can express authorization without defining what it means: the A2A specification includes task cancellation and an
AUTH_REQUIREDstate, but deliberately leaves the scope, validity, and revocation of that authorization to implementations, which means the consequential semantics remain someone else's problem. - Multi-agent coordination produces both specialization and common-mode risk: Anthropic's swarm experiment found complementary vulnerability discovery alongside conformity, collusion, and agents sabotaging each other when given incompatible goals, raising questions about what "redundancy" actually buys.
- Cheaper tokens may not mean cheaper operations: Google launched Gemini 3.7 Flash with introductory pricing at half the predecessor's rate, but if teams respond by adding retries, sub-agents, and longer loops, the number of consequential transitions requiring human judgment could grow faster than the per-token cost falls.
- Attribution inside long agent trajectories is becoming a research target: a recent preprint introduces a framework for identifying which instructions, tool results, or memory components caused a specific agent action, which matters because most evaluation still grades the final output without asking where responsibility sits along the path.