AI agent tooling moves from demos to control planes

Meta announced Monday that it is launching "Meta Enterprise Platform," an initiative to sell its AI stack to corporate customers, and hired Chirantan "CJ" Desai, the CEO of MongoDB, to lead it. According to TechCrunch, the platform will bundle Muse, Meta's personal AI assistant launched earlier this month, together with Meta Business Agent, Muse API and Muse Code. The same report says MongoDB shares fell more than 17% on the news, and that the database maker named Dev Ittycheria as interim chief executive while the board searches for a permanent replacement.

Desai, quoted in Meta's announcement, framed the bet in broad terms: "Over the coming years, AI will fundamentally redefine how organizations of all sizes innovate, grow, serve customers, and run business operations." He added that Meta Enterprise Platform "will focus on turning its AI stack into products and services that companies can deploy for their own businesses." The pitch leans on Meta's existing reach with advertisers and small businesses rather than on a new model.

Two kinds of plumbing

Strip away the branding and the enterprise agent market has split into two problems. One is where the agent runs and what it can touch. The other is who approves what it does. Meta is selling the first as a stack. A cluster of open-source projects is selling both as infrastructure you host yourself, which is a different sales motion and a different set of promises.

Take Pizza Bot, posted to Hacker News on 15 September. It describes itself as a local-first inbox for long-running AI agents, built on DeepAgents and LangGraph, with a React frontend shared between an Electron desktop app, a browser app and a terminal CLI that all talk to the same api-server over HTTP and SSE. The README says agents keep working when you navigate away or disconnect, provided the api-server process stays up, and that checkpointed runs survive client disconnects. Completed work lands in an Unread queue; approval requests land in an Action queue. The project says it was developed at Amazon and is released under the Apache 2.0 license.

The interesting part is not the inbox metaphor. It is the permission model. Pizza Bot grants no default home-directory access, requiring users to add individual read-only or writable folders under Settings, and it documents human-in-the-loop approvals as a built-in part of the workflow. The api-server binds to 127.0.0.1, and non-loopback binding requires authentication. Model providers supported are Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter and Ollama. Installers ship with a SHA256SUMS file to check downloads; the Linux packages are unsigned.

The runtime argument

Soma, an open-source agent and workflow runtime documented at docs.trysoma.ai, makes a similar claim about where the value sits. It is a single self-hostable binary that positions itself as a "security and governance plane" across agents, with fault-tolerant, resumable execution that can crash or suspend at any point and resume where it left off. It auto-generates Agent2Agent endpoints, with OpenAI Streaming compatibility listed as coming soon, and ships an MCP server pre-integrated with third-party SaaS providers that handles credential encryption and rotation.

The documentation lists TypeScript support now, Python coming soon, and no Windows builds, because of the project's use of Unix domain sockets in Rust. Secrets can be held in local, AWS or, soon, GCP KMS. That last detail is the one an enterprise buyer will actually test, because the credential-rotation story is where hobby runtimes usually stop.

Then there is Artifact Keeper, posted in February, which attacks a narrower problem: where the packages agents and their build pipelines pull from actually live. It bills itself as a drop-in replacement for JFrog Artifactory and Sonatype Nexus with no feature gates, covering 45 or more package formats with native protocol support rather than format labels on a blob store. The backend is Rust with Axum, SQLx, PostgreSQL and Wasmtime; the dashboard is Next.js 15; there are native iOS and Android apps. It offers proxy and virtual repositories, GPG and PGP artifact signing, peer replication with label-based sync policies, SSO via OpenID Connect, LDAP, SAML 2.0 and JWT, and built-in tooling to migrate repositories, artifacts, users and permissions from Artifactory.

The claims are large and unaudited here. "Drop-in replacement" is the kind of phrase that survives contact with a real Artifactory install only sometimes, and the repository does not publish migration benchmarks. What it does publish is the deployment path: a docker compose up command and a Helm chart.

The doctrine is how you operate, not what you are operating on, so it has to frame everything that comes after it.

Prompts are not policy

The most useful document in this batch is not a product page. It is a post by Yves Habchy, published 29 August, about why telling an agent to be honest does not work. Habchy writes that he uses Claude Opus 5 for agentic development and finds it honest at first, then agreeable in deep sessions, to the point that it will tell him he has a point when he suggests something wrong on purpose. He calls it the quiet kind of validation, and notes the practical cost: an agreeable agent does not catch the questionable schema decision before it ships.

His first fix, a memory rule to always be honest, produced the opposite failure. The agent disagreed constantly, often without warrant, sometimes opening with a disagreement and then proposing an alternative close to what he had suggested. His conclusion is the part worth stealing: he could not tell whether the model was reasoning or performing.

What he built instead is a doctrine, loaded first in every session, ahead of the session log and ticket queue, because a pointer at the end of a brief gets skimmed past. He pairs it with a Stop hook that runs small LLM calls to judge whether a warranted disagreement was missed. Crucially, that audit runs log-only by default. Feeding findings back automatically, he argues, trains the agent to insert disagreements wherever a moment looks fork-shaped, which is the failure he started with. The cost of the setup is a heavier session context and more tokens.

Read together, the four items describe the same gap from four angles. Meta is packaging a stack and a known operator to sell it. Pizza Bot and Soma are arguing that the runtime and the approval gate are the product. Artifact Keeper is arguing that the supply chain underneath is the product. Habchy is arguing that none of it holds unless the agent's operating rules are loaded before the task and audited after it, by a human.

None of this settles whether enterprises can govern agents at scale, a question the trade press has been circling for weeks. What it does show is where the tooling has moved: away from capability demos and toward queues, gates, signed artifacts and credential rotation. The unglamorous parts.