The agent category just redefined itself in 13 days.

Four autonomous-agent product launches in thirteen days. None shipped with runtime governance. Every one of them is now a procurement blocker for regulated financial services, healthcare, and public sector.

Four product moments. Thirteen days. None shipped with runtime governance.

The assumption that broke

Coding assistants used to have a human in the loop by default. The developer sat at the keyboard, read the suggestion, clicked approve, caught the weird idea before it shipped. Per-tool permissions were a safety net under someone who was already watching.

What shipped this month removes that assumption. An agent in a tiled pane, on a schedule, on a GitHub event, on a remote cloud box while your laptop is off. Execution, testing, code review, PR open. All without you there.

That is the new category. It does not have a governance model.

The procurement wall

EU AI Act Articles 9, 12 and 15 apply from 2 August 2026. Three questions every enterprise procurement team will ask from April 2026:

• Where does your enforcement layer live?
• Who audited it?
• Can you produce the event log on demand?

None of the four products above answer any of them. Model-level governance does not reach the tool-call layer. Allow-lists and auto-approve toggles do not satisfy Article 9. An in-process approval UI that an autonomous agent has already clicked past on your behalf is not an enforcement layer.

Every deployment of these products into regulated financial services, healthcare, or public-sector environments is now blocked until someone shows up with a runtime governance layer underneath.

What a runtime governance layer looks like

A vendor-neutral event bus. Every lifecycle event the agent emits flows through the bus. UserPromptSubmit, PreToolUse, PostToolUse, SessionStart, Stop, SubagentStop, Notification, PreCompact. Subscribers decide. Deny wins.

Subscribers are independent services. Governance is one. Audit is another. Data-loss prevention is another. Knowledge injection, session memory, orchestration. All plug in at the same layer. Open SDK. Any language.

The enforcement engine itself is two-tier. Deterministic regex at layer one. A reasoning model at layer two, running on-premises, no external call, with access to the full session history and the rule that fired. It returns allow, deny, or ask, with reasoning. The agent cannot disable it, cannot argue with it, cannot bypass it. It lives outside the process.

That is HookBus. Eight live subscribers, five publisher integrations, two UK patents pending (GB2608069.7 + GB2604445.3).

The L1 just commoditised itself

Microsoft open-sourced their Agent Governance Toolkit on 2 April 2026, the same day Cursor 3.0 shipped. Sub-millisecond deterministic L1 enforcement. CRE wraps AGT and adds a regex layer above it. Fast, deterministic, free. What Microsoft does not have is L2.

CRE L2 runs IBM Granite 4 3B on-premises, air-gapped. It reads the whole composed tool call in context and makes a reasoning-grade decision. It is the only Agent-in-the-Loop semantic policy engine in production.

Microsoft just validated the L1 category and gave it away. L2 is the moat.

Agent in the Loop

The four products that shipped this month removed the human from the loop. They did not replace the human. They just left the loop empty.

Something has to sit there. A composable external subscriber that watches every tool call, applies policy before execution, produces the tamper-evident log the regulator will ask for, and keeps the autonomous agent on rails when nobody is watching.

When there is no human in the loop, CRE is the Agent in the Loop.

HookBus is vendor-neutral, patent-protected, and already running in production with eight live subscribers and five publisher integrations. Every autonomous agent product that ships through the rest of Q2 2026 will have to answer the same three questions from enterprise procurement. We answer them today.

Build a subscriber →