Who Controls the AI Agent Layer? What Founders, Investors, and CXOs Should Do

Part II of II of a guest series from AI and innovation expert Bruce MacVarish. The fight over who controls the agent layer has already started, and what founders, investors, and CXOs should do about it, mapped to the five laws from Part I.

Key takeaways

• The recap: Part I showed that agent adoption is gated by trust, not capability, and named five laws that determine whether an agent earns it: continuous verification, identity as accountability, context as a loan, earned (not granted) trust, and pre-emptive governance.
• The new evidence: Two more signals have landed since. Amazon blocked Meta’s Muse from shopping on its site, and OpenAI launched its own competing agent, Dots, built on nearly identical trust architecture. The blocking fight isn’t only a trust story … it’s a second fight over which platforms let a trustworthy agent through the door at all. The Dots launch confirms the first fight is real: a second major platform independently arrived at the same five laws.
• The recommendations: This piece sizes the resulting economy and closes with specific, checklist-form guidance for founders, investors, and CXOs, with each item run through the five laws from Part I.

Market Proof: The Pattern Keeps Repeating

Part I opened with three independent readings converging on trust as the gating variable within ten days of each other:

• Meta shipped Muse’s trust architecture (September 8)
• Menlo Ventures found trust overtaking ease-of-use for the first time (September 16)
• Goldman Sachs’ Eric Sheridan, briefing 42 companies, named “the trust factor, as well as the security factor” as the determining variable (September 18)

“If consumers can get over the trust factor, as well as the security factor, that integration will improve dramatically.”
– Eric Sheridan, Goldman Sachs Research

Goldman’s read adds a market-structure point Part I didn’t cover … agentic commerce marks AI’s move from the “platform layer” to the “application layer,” monetized like the rest of the consumer internet … ads for a free tier, subscriptions for an ad-free one.

That stacks a second trust question on the first: an agent funded by the same advertising business a person may not fully trust with their data. It also adds a capital point. U.S. hyperscalers are on pace to deploy $1.4 trillion in 2027 capex, committed regardless of how fast consumer trust resolves.

September 21: An incumbent draws a line

Two weeks after Muse launched, Amazon began blocking it from shopping on Amazon.com, citing a failure to identify itself as an agent and concerns about credential handling that Meta disputes.

The more telling detail was that Amazon chose a contractual block over a lawsuit this time, a month and a half after the Ninth Circuit vacated its own injunction against Perplexity’s Comet agent, ruling that it’s the user, not the agent-maker, who “accesses” a site when an agent acts on instruction.

With that legal theory weakened, a terms-of-use popup is doing the work a courtroom couldn’t.

September 29: A third platform ships the same architecture

Three weeks after Muse, OpenAI introduced Dots at its DevDay conference … always-on personal agents on a dedicated GPT-6 Astra model, each running on its own cloud computer.

The safeguards OpenAI described read like a checklist from Part I: an auto-review system checks any action against a person’s own instructions before it happens, and a separate monitoring system can pause or stop a Dot if it detects a safety concern. For organizations, specialist Dots arrive with individual identities, credentials, and access, integrated with Microsoft’s Agent 365 governance controls … identity-rooted accountability, arrived at independently by a second major platform in three weeks.

OpenAI also excluded the EEA, Switzerland, and the UK from the initial launch, the same regulatory fault line already visible in Part I. The launch followed, by one day, OpenAI’s own apology for an earlier agent accessing an Australian government website without authorization … a reminder that the case for pre-emptive governance in Part I is not theoretical. Three platforms, three weeks, the same five laws: at this point the pattern is the story.

The Aggregators Get Aggregated

There’s a second fight sitting on top of the trust question from Part I, and Amazon’s move is the clearest evidence it has started. Trust determines whether a person hands a task to an agent. This fight determines whether the agent is allowed to reach the shelf once they do.

Ben Thompson’s Aggregation Theory (Stratechery) explains why: businesses that aggregate demand and own the customer relationship capture most of a market’s value, while suppliers behind them become interchangeable. Amazon built its dominance being exactly that aggregator. A horizontal personal agent threatens to run the identical playbook one layer up … comparing Amazon against Instacart or DoorDash on a single order and routing to whichever wins, turning Amazon into precisely what it made of its own third-party sellers.

The identical dynamic is already playing out a level up the stack, in enterprise software, and a major platform CEO has said so on the record. Microsoft’s Satya Nadella has described business applications as little more than CRUD databases with business logic attached and has said Microsoft intends to move that logic “aggressively” into AI agents that read and write across whichever backend a task touches … a CRM, an ERP system, email, file storage … without discriminating between them.

If that plays out the way he describes, the applications underneath become exactly what this section has just described happening to Amazon … a thin, commoditized surface behind whichever agent tier actually holds the business logic. An enterprise that owns its own data but lets a vendor’s agent hold that logic hasn’t avoided this fight. It has only moved it to a layer most governance conversations don’t look at yet, which is exactly where Part I’s Rent-vs-Own story picks the argument back up.

The same collapse cuts both ways for a second reason worth stating plainly. A multi-repo agent is also a single point of inbound exposure: whatever reaches it through any one channel … a request, a message, a contact claiming authority it doesn’t have … inherits standing access to every system that agent is wired into. The aggregation fight described here is about who gets to act on a person’s behalf. A second, quieter fight is about who gets to even reach the agent that can act at all, and an organization that wins the first without building for the second has built a bigger target, not a safer one.

EXHIBIT 1. How platforms are answering the agent question

Source: Author’s synthesis, based on reporting from Bloomberg, GeekWire, TechCrunch, and TipRanks, September 2026.

Instinct makes the stakes concrete rather than hypothetical. The personal agent that went viral on iMessage in August 2026 is already routing more than $1 billion in annualized transaction volume, by founder-reported figures, roughly half of it travel bookings placed through whichever airline, hotel, or agency’s system the agent reaches on a person’s behalf. That is real demand moving through a channel most incumbents hadn’t built a defense for, because the channel was a text thread, not an app or a website.

DoorDash has answered the way Amazon did by shipping its own iMessage agent for text-to-order rather than opening its ordering flow to Instinct’s. Other platforms have made the opposite bet already. Shopify, Instacart, OpenTable, Expedia, Ticketmaster, and Plaid have all signed official integrations, competing for the demand a horizontal agent routes rather than walling themselves off from it.

The incentive is the same one that decides every aggregation fight: whoever cooperates wins the demand that whoever blocks turns away. Amazon faces the choice every incumbent aggregator faces once a new layer forms above it … keep protecting the relationship it owns, or match the access its more open competitors offer. Blocking buys time. It doesn’t resolve the choice.

Amazon will push its own assistant, but a vertical, single-retailer agent starts at a structural disadvantage against a horizontal agent that already holds a person’s email, calendar, and years of context … the same compounding advantage from Part I’s ownership discussion, now working against the incumbent. OpenAI’s Dots and Meta’s Muse both start closer to that horizontal position already, with ChatGPT alone reporting 1.2 billion weekly users to build specialist, identity-scoped agents on top of. Many companies will want to become the aggregation layer for personal agents. Very few will have the distribution to actually get there.

Sizing the Intelligence Economy

Put the signals together and a market takes shape: $40 billion in consumer AI spend, growing more than 3x in a single year almost entirely through depth rather than reach; two billion global users, with roughly one in seven payers generating over half of all spending; a hyperscale capital commitment measured in the trillions, made independent of how quickly trust resolves; and now, a live fight over whether platforms holding the inventory will let a trusted agent reach it at all.

EXHIBIT 2. Where value concentrates on the AI Agent Delegation Ladder

Source: Author’s synthesis, based on Menlo Ventures (2026) and Goldman Sachs Research (2026) commentary on agentic-commerce monetization.

OpenAI’s own pricing for Dots fits this pattern exactly: a first agent bundled free into an existing Pro or Business Premium subscription, with additional agents or heavier usage pushed behind a separate flat fee … subscription at the recommend rung, usage-based overlay the moment a person wants more draft-and-confirm capacity.

Modeled forward 36 months across four investment scenarios, trust-led investment alone outperforms personalization-led investment alone by roughly eight points in adoption, and that gap holds across every use case tested. Relevance gets people curious about an agent. Confidence in how it handles their data and judgment is what gets them to actually hand over the task.

The Recommended Actions

Three groups have a direct stake in getting this right.

Each item below maps to one or more of the five laws from Part I: verification, identity, context, earned trust, and pre-emptive governance.

For Founders

Run the five-law test on your own product before anyone else does. Can you verify agent behavior continuously, not after the fact? Does every action trace to an accountable identity? Is access revocable without a support ticket? Does trust compound with track record? Are your safeguards pre-emptive, not reactive? Investors and enterprise buyers will ask; answer it first.

Decide early whether you’re building an agent or a feature. Wiring trust into the architecture is a founding decision, not a compliance layer added later.

Sequence the delegation ladder deliberately. Prove the agent at rungs one and two, make the trust-building visible, and let demand for rung three pull itself forward.

Know which side of the rent-vs-own fork you’re on. Being the trusted platform and helping people own their own stack are both legitimate strategies with different economics; pick one deliberately.

If you’re building an enterprise agent, understand exactly what you’re asking for. Multi-repo write access across a customer’s CRM, ERP, and email is the same standing authority Microsoft has described moving aggressively to capture; sophisticated buyers will increasingly ask you to prove you don’t hold it, not just that you use it responsibly.

Build the inbound gate as deliberately as the outbound mandate. A multi-repo agent is a single point of entry to every system it’s wired into; an attacker only needs to reach it once, through any channel, to inherit all of it. Treat verifying what reaches your agent as core product, not an afterthought to what your agent is allowed to do.

Don’t build a strategy on access you don’t actually have. A legal win for agents acting on a user’s instruction doesn’t guarantee a platform’s cooperation; design for the incumbents that block you, not just the ones that welcome you in.

For Investors

Make the five laws a diligence checklist, not a values statement. Ask to see the mandate model, the audit trail, and the revocation mechanism for every law in Part I, not just a demo of what the agent can do.

Re-underwrite unit economics around depth, not reach. Adoption barely moved in 2026 while spend tripled; the compounding metric is usage depth per user, not new sign-ups.

Expect concentration, not democratization. Faster growth and higher per-user monetization for trust-winning platforms favor fewer category leaders; size portfolios accordingly.

Map portfolio exposure across the rent-vs-own fork. Trusted-platform plays and owned-infrastructure plays are not substitutes for each other.

Ask whether a startup’s moat is its data or its logic. A company that hosts a customer’s data while a vendor’s agent tier holds the business logic has outsourced the valuable part of its own product; price that the same way you’d price customer-concentration risk.

Underwrite platform-access risk as its own line item. A horizontal agent’s addressable market depends on which incumbents choose to cooperate … an adversarial variable that has nothing to do with how good the agent is.

For Enterprise CXO Teams

Apply the five-law test to vendor selection, not just your own roadmap. Ask any agent vendor the same five questions your own product should be able to answer.

Start at the low rungs deliberately, inside the organization. Inform-and-recommend use cases build organizational trust before you grant draft-and-confirm or autonomous authority over customer data or money.

Treat the audit trail as a governance requirement. Insist on legible, exportable records of what any agent did, attempted, or was blocked from doing before it touches a regulated process.

Treat build-vs-buy as a real decision. A rented platform agent is faster to deploy; an owned, private stack over your own data costs more upfront but removes a vendor from your trust chain entirely.

Decide now whether you’re an aggregator or a supplier in your own category. If a horizontal agent could plausibly route demand away from you, an open, agent-friendly posture may win more share than a defensive one; the answer depends on whether you can realistically become the aggregation layer yourself.

Refuse to let any vendor’s agent hold standing write authority across your systems. Insist that cross-system actions route through your own identity and permission layer, scoped per task and revocable, rather than a vendor-held credential; owning your data doesn’t give you sovereignty if a vendor’s agent tier holds the logic that decides what gets written where.

Verify every inbound request before it reaches the agent, not just every outbound action it takes. A multi-repo agent wired into your CRM, ERP, and email is a single point of entry to all three; treat the gate in front of it as seriously as the mandate behind it.

None of this requires waiting for a better model. It requires building the parts of the system that let a person see, and control, what they’re agreeing to … and then letting the adoption curve, and the economy forming around it, do the rest.