Agent products are centering on bounded access and visible supervision

The highest-risk item is credential exposure. The DevFortress piece argues that agents, Model Context Protocol (MCP) servers, CI/CD tools, IDE plugins, and cloud integrations often run close to reusable secrets. Its cited incident set is concrete: 28,649,024 new secrets exposed on public GitHub in 2025, 64% of credentials leaked in 2022 still active in January 2026, and 24,008 unique secrets found in MCP configuration files.

The proposed control is credential aliasing. Agents and integrations receive an alias while the real credential stays in controlled infrastructure. The product claims include session monitoring, scoped credentials, signed payloads, anti-replay checks, and under-two-second quarantine or revocation. The evidence is strong on incident scale, but the product itself has no third-party benchmark, false-positive rate, or latency distribution in the excerpt.

Two items frame agents as assignable coworkers inside existing collaboration surfaces. CrewAI’s Iris works through Slack: an engineer tags @Iris, and the agent can file Linear issues, run Claude Code, open GitHub pull requests, and report back in the thread. The concrete example is small and useful: a two-line whitespace fix that would have taken nine manual steps was closed in about three minutes, with a test added for the reported newline case.

Notion’s /Dev product makes the same bet at workspace scale. Users can @mention agents in pages, comments, or chats. Notion Workers run isolated code for syncs, custom tools, webhooks, and external API calls on Notion-managed infrastructure. The product claims are about shared permissions, review points, and agent-visible workspace data; the excerpt gives no reliability or latency numbers.

Coding-agent use is being shaped around human attention. Mux is a narrow tool for people running several Claude Code sessions in tmux. It reads Claude Code status files, matches them to live panes, and opens an fzf overlay that sorts waiting sessions above working or idle ones. The useful action is direct: press Enter and jump to the blocked session.

The Usefulness of AI Agents essay reaches a similar operating rule through personal use. The author reports better results when coding agents are limited to one or two files, asked to state a plan before coding, and gated before changes above 100 lines or multiple files. The claim is qualitative. Agents helped with smaller prototypes and setup work, while research outputs looked coherent but weak as research.

Role-model and Comparative Advantage in Software both treat general models as a resource that needs product-level discipline. Role-model proposes an open protocol for routing AI requests by task, capability, policy, modality, cost, locality, and observed endpoint behavior. Its RouterDecision records the chosen endpoint, fallbacks, exclusions, and selection reasons. The excerpt provides a design and runtime claim, with no routing-quality or latency measurements.

Comparative Advantage in Software gives the business version of the same constraint. If a customer can ask a large language model (LLM) to create a tool, paid software needs a clearer reason to exist. The essay names two levers: reduce the tokens needed for a task, or raise correctness through persistent state, evaluations, typed data, and error-correcting workflows. Restaurant operations supply the concrete example: automated procurement needs precise state and approvals because purchasing can affect about 30% of revenue.