I told you the verdict would come after June 3. It’s a few days late, and the delay was deliberate. I flew home from San Francisco and spent the week with my son instead of opening the laptop. The distance helped. The thing about a conference is that the noise is loudest on the floor, and the signal only resolves once you’re far enough away to stop hearing the keynote music.

I went to Fort Mason to resolve a binary. In the post I wrote on the plane out, I framed the whole trip around one fork. Either a thin harness I own plus external governance is real (and the strategy works), or governance only travels with Microsoft’s SDK and its managed service, and I’m forced to choose control or governance, never both.

I came back with an answer to a question I hadn’t quite asked. The fork I was bracing for didn’t happen. Microsoft conceded the harness. And then it did something more interesting.

The Fork Didn’t Happen

The fear in the second post was specific: that governance would be a property of the runtime you don’t own. Adopt Microsoft’s framework, host inside its service, and you’re governed. Bring your own runtime (a thin harness on pi, the kind of thing I’m building for the code factory) and you’re on your own.

That’s not what shipped. Across the keynote and the sessions underneath it, Microsoft did close to the opposite of locking the runtime. Three moves, and they point the same direction.

The harness became bring-your-own. OpenClaw, the agent that defined the maximal-privilege coding-agent category, was on stage as a plugin model. The pitch from its creator was blunt: bring Copilot, Codex, whatever you already trust, and your rules come with it. He stood up a nonprofit foundation around it, “any model, any OS,” and shipped it as a native Windows companion. The harness layer Microsoft could have tried to own, it instead declared open.

The framework stopped being the toll booth. Microsoft Agent Framework 1.0 went GA, but the governance hook isn’t gated to it. The Agent 365 SDK is free and framework-agnostic, with first-party packages for the Microsoft Agent Framework, the OpenAI Agents SDK, LangChain, Semantic Kernel, and Azure AI Foundry. That is the explicit door for agents I didn’t build on Microsoft’s stack to come under the same governance umbrella. The conflation I spent half of the last post untangling, SDK versus service versus platform, resolved in the direction I wanted: governance attaches through a free SDK, not through runtime captivity.

And containment became an OS feature. That one deserves its own section, because it’s the cleanest answer to the cleanest question I brought.

Control or Visibility: Answered on Stage

The break scenario I wrote down was a coding agent mid-task, and a revocation that either stops it or just colors a dashboard red thirty seconds later. Enforcement versus a transcript. Control versus visibility.

Microsoft answered it with theater that had teeth. They introduced Microsoft Execution Containers, or MXC, a policy-driven isolation layer baked into Windows and WSL, hypervisor-backed, with single-digit-millisecond startup. Then they ran the demo I would have asked for: they told OpenClaw to delete every file on the desktop, disabled OpenClaw’s own safety layers, and the OS sandbox blocked it anyway. Read-only boundary, enforced below the agent, indifferent to what the agent had been talked into doing.

That’s enforcement, not a transcript. And the design choice that matters is where it lives. Containment is enforced by OS policy “regardless of who builds the agent.” It is not a feature of the agent’s good behavior, not a setting inside the harness, not an app-level checkbox an agent can reason its way around. It’s the environment refusing.

This is exactly the layer I said network proxies can’t reach in What witness.ai Doesn’t See: the execution surface below the wire, where the real damage happens. Microsoft just put a control there, in the OS. Which is the answer to control-versus-visibility: at the containment layer, it’s control.

Does the Governance Reach a Runtime I Brought Myself?

The harder question from the last post wasn’t about Microsoft’s own agents. Of course it can govern those. It was whether the governance plane reaches a runtime I brought: does Purview see my proprietary code leaving in a model-call payload, or does it stop at the agent boundary?

The answer is yes, on the data path, and the mechanism is Foundry IQ. It replaces hand-built RAG with one retrieval endpoint across your sources, and (the part that matters for governance) it runs queries under the caller’s Microsoft Entra identity, honors Purview sensitivity labels, and enforces permissions at query time. An agent grounded through Foundry IQ retrieves only what the invoking identity is allowed to see. The security plane is what makes the context plane safe to turn on.

On the runtime side, Agent 365 for local agents discovers and governs the coding agents engineers actually run (Claude Code, GitHub Copilot CLI, OpenClaw, Codex) through Defender, Intune, and Purview, with Purview’s agentic risk detection covering all four by name. Defender and Intune find the agent on the managed device; Purview watches what data it touches. The governance reaches down to the local agent on the laptop, not just the agent hosted in the cloud.

So the strategy I described (own the thin harness, let governance attach from outside) is real. Microsoft built the attachment points. The fork dissolved.

So Where Did the Lock-In Go?

Here’s where it gets honest. If the harness is open, the SDK is free, containment is in the OS, and governance is framework-agnostic and cross-cloud (registry sync now spans AWS Bedrock and Google Cloud), then the obvious question is: where’s the catch? Microsoft doesn’t open layers out of generosity.

The catch is that the lock-in didn’t disappear. It moved up the stack. This is the exact pattern I traced through the platform-strategy posts: open at the bottom, locked at the top with Fabric, and the same inversion at the agent control plane. Each layer that gets commoditized pushes the durable switching cost up to the layer above it. Build 2026 ran that play at full scale.

It moved up in three places.

The economics. The framework-agnostic SDK is free, but the richest path is Microsoft 365 E7, the “Frontier Suite,” which bundles E5, Copilot, Entra Suite, and Agent 365. Nothing forces you onto it. The depth pulls you there. It’s gravitational, not contractual, which is the most durable kind.

The maturity. More on this below, but the headline is that the cross-runtime governance, the part that reaches your harness, is mostly preview, and the depth of telemetry, policy, and remediation is richest inside Entra plus Purview plus Defender plus M365. The architecture is genuinely cross-cloud and framework-agnostic at the SDK level. The experience rewards consolidation.

And the moat itself. Microsoft said the quiet part out loud, repeatedly: the model is not the moat; the context is. The IQ layer (Work IQ over your Microsoft 365 signal, Fabric IQ over your business data as a living ontology, Foundry IQ as the retrieval plane), plus reinforcement-learning environments and “frontier tuning,” all argue one thing: as raw intelligence commoditizes, the differentiator becomes ownership of context. Which is true. It’s also the new lock-in. The grounding that makes your agents useful is now wired to Microsoft’s identity and context plane. You can own the runtime. The question is whether you own the context that runs through it.

The Part I Got Wrong: The Two Postures Converged

I framed control-by-containment and control-by-governance as opposing strategies: own your runtime and enforce from below, or live inside the platform and let governance flow down. The whole second post was built on that opposition.

Build collapsed it. MXC is control-by-containment: out-of-process enforcement on the environment, a compromised agent unable to disable a boundary it doesn’t control. That’s precisely the posture I argued for in The Sandbox Isn’t the Hard Part, describing NVIDIA’s NemoClaw and OpenShell. Microsoft didn’t position itself against that posture. It shipped it into Windows, with NVIDIA’s OpenShell as the secure runtime underneath OpenClaw, and OpenAI on board too.

Containment wasn’t the alternative to Microsoft’s governance. It became a feature of it. Which means the containment-versus-governance debate I was running is, for practical purposes, settled: you get both, and the OS does the containing. The live frontier isn’t where the agent runs anymore. It’s the context the agent reasons over.

No Fluff, or Fluff With a Ship Date?

I went in calibrating one distinction: “generally available” versus “works in production across thousands of tenants with years of identity-configuration debt.” Build’s own “no-fluff” promise deserved the same scrutiny. Here’s the honest split.

Shipped and GA: Microsoft Agent Framework 1.0, the free Agent 365 SDK, the IQ layer, and MXC’s process and session isolation reaching Windows Insiders. Those are real today.

Preview, or dated: Agent 365 for local agents is public preview. The MXC-to-Agent-365 integration (the part that brings Defender, Entra, Intune, and Purview down onto the OS-contained agent) is a July preview, not a Build-week GA. Purview’s runtime DLP for agent prompts is preview. Cross-cloud registry sync is preview, and it’s “registry sync” (discover, inventory, start, stop, delete), basic lifecycle, not deep governance everywhere.

So the calibrated read: the headline is real, and most of the depth is preview. I can architect the governed-harness posture now, with confidence the attachment points exist and Microsoft has committed to them. I cannot deploy it at scale across a regulated bank today, because the pieces that make it enforceable across runtimes I brought myself are still landing. That’s not fluff. But it’s a roadmap I’m betting on, not a platform I’m running.

Identity: Still the Open Wound

One question didn’t get the clean answer the others did. I asked whether Entra Agent ID binds to ephemeral execution (a CI job that spins up, gets a short-lived scoped identity, and expires when the job ends) or forces durable service principals and sprawl at job granularity.

What I saw was split. Execution is ephemeral: each agent session spins up a dedicated microVM with its own filesystem, torn down after. But identity is durable: agents get their own enterprise identities, and the “autopilot” agents, the always-on ones like Scout, get their own identity and a productivity license, living in Teams like an employee. So the runtime is disposable while the identity persists.

That doesn’t close the concern from Who Issued the Agent? It relocates it. The sprawl I worried about isn’t a thousand short-lived CI identities; it’s a growing roster of durable, licensed, employee-shaped agent identities that someone has to govern, certify, and offboard. That’s a better problem than orphaned service principals. It is not a solved one. The leaver problem now has a headcount.

The Decision, Resolved

So: build the thin harness on pi, and let governance attach from outside. The strategy works. Microsoft conceded the layer I was prepared to fight for, and shipped the containment to help. The fork I feared (choose control or governance) was a false binary by the time I landed.

But the verdict isn’t a victory lap, because the more important thing Build taught me is where the next fight is. The lock-in didn’t go away. It went up: out of the runtime, past the framework, into the context. Owning the harness is necessary and no longer sufficient. The durable question is whether the context that makes my agents useful (the ontology, the retrieval plane, the institutional knowledge they reason over) lives somewhere I control, or somewhere I rent.

That’s the next post, and probably the next year. The harness was the right thing to own. It was just a lower hill than I thought.

---

This closes the Build trilogy: the four questions I brought, the binary I framed on the way out, and the verdict here. The companion read for what comes next is Six Primitives for a Code Factory, because the context layer is the primitive I underweighted.

If you were at Build and read it differently, especially on whether the cross-runtime governance depth is real outside Microsoft’s own stack, I want to hear it. Find me on X @orestesgarcia or LinkedIn /in/setsero.