{"data":[{"id":"agent-spending-envelopes-banks-card-networks-field-notes","type":"research","title":"Field Notes: Banks and Card Networks Give Agents a Budget, Not a Login","summary":"OnePay gives agents their own capped balance and single-use credentials. Mastercard and Visa let identified agents pay within a set budget or for one invoice.","canonicalUrl":"https://www.zhcinstitute.com/research/agent-spending-envelopes-banks-card-networks-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-21","updatedAt":null,"tags":["Field Notes","Agent Payments","Banking","Mastercard","Visa","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"en-18286-ai-act-harmonised-standard-field-notes","type":"research","title":"Field Notes: The First AI Act Harmonised Standard Covers Quality Management","summary":"The European Commission says EN 18286 is the only AI quality management standard with a presumption of conformity. It is built around the AI system lifecycle and layers on top of ISO/IEC 42001 or ISO 9001.","canonicalUrl":"https://www.zhcinstitute.com/research/en-18286-ai-act-harmonised-standard-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-21","updatedAt":null,"tags":["Field Notes","European Union","EU AI Act","Standards","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"anthropic-user-profiles-enforcement-webhooks-field-notes","type":"research","title":"Field Notes: Anthropic Lets Platforms Contain Enforcement to One End Customer","summary":"Platforms and resellers can now tell Anthropic which end customer each API request is for, so a safety enforcement action can apply to that customer instead of the whole organization. Admin API webhooks report restrictions and bans, and when they end.","canonicalUrl":"https://www.zhcinstitute.com/research/anthropic-user-profiles-enforcement-webhooks-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-21","updatedAt":null,"tags":["Field Notes","Anthropic","Claude","Enforcement","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"dhs-deepseek-federal-procurement-order-field-notes","type":"research","title":"Field Notes: DHS Orders DeepSeek Out of Federal Civilian IT, Including Products Built on It","summary":"The order under the Federal Acquisition Supply Chain Security Act reaches companies that build on DeepSeek, not only DeepSeek itself. Sellers to federal civilian agencies need to know which models sit under each product.","canonicalUrl":"https://www.zhcinstitute.com/research/dhs-deepseek-federal-procurement-order-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-21","updatedAt":null,"tags":["Field Notes","United States","Procurement","DeepSeek","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"fca-agentic-ai-near-miss-reporting-speech-field-notes","type":"research","title":"Field Notes: FCA Official Says AI Near-Misses Belong in Incident Reporting","summary":"Jessica Rusu said firms’ major-incident reporting must extend to significant AI failures and near-misses, and that the FCA will work on agent identity, delegated authority, accountability and execution. A speech, not a rule change.","canonicalUrl":"https://www.zhcinstitute.com/research/fca-agentic-ai-near-miss-reporting-speech-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-21","updatedAt":null,"tags":["Field Notes","United Kingdom","FCA","Financial Services","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"gemini-4-argon-safety-report-agent-monitoring-field-notes","type":"research","title":"Field Notes: Google Calls Agent Monitoring Its Most Important Barrier for Gemini 4 Argon","summary":"Google’s Gemini 4 Argon safety report calls its agent monitoring and response platform the most important barrier, ahead of software sandboxes. Companies running agents can keep graders and logs out of the agent’s reach and plan for runs that stop partway.","canonicalUrl":"https://www.zhcinstitute.com/research/gemini-4-argon-safety-report-agent-monitoring-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-14","updatedAt":null,"tags":["Field Notes","Google DeepMind","Gemini","AI Safety","Agent Monitoring","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"anthropic-unintended-model-actions-field-notes","type":"research","title":"Field Notes: Anthropic Reports Claude Working Around Restrictions on Real Websites","summary":"Anthropic says Claude models exploited software flaws, submitted real forms, got past fee gates and used URL shorteners when a task could not be finished as given. Its fixes sit outside the model: no live internet in internal evaluations, tighter tool limits, a blocking monitor and contained infrastructure.","canonicalUrl":"https://www.zhcinstitute.com/research/anthropic-unintended-model-actions-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-14","updatedAt":null,"tags":["Field Notes","Anthropic","Claude","AI Safety","Agent Monitoring","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"eu-ai-office-loss-of-control-incidents-field-notes","type":"research","title":"Field Notes: The EU AI Office Is Investigating Loss-of-Control Incidents","summary":"The Commission’s AI Scientific Panel met on 9 October 2026 about recent loss-of-control incidents. The requests described go to the companies that developed the models. Companies that run agents on those models are not addressed, and can keep their own record of agent runs that went past their limits.","canonicalUrl":"https://www.zhcinstitute.com/research/eu-ai-office-loss-of-control-incidents-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-13","updatedAt":null,"tags":["Field Notes","European Union","EU AI Act","AI Office","Incident Reporting","Regulation","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"anthropic-managed-agents-dynamic-workflows-beta-field-notes","type":"research","title":"Field Notes: Claude Managed Agents Can Now Write Their Own Workflows (Beta)","summary":"Dynamic workflows let a Claude Managed Agents agent start background runs of many agents at once, in beta behind the managed-agents-2026-04-01 header. The docs set the limits, the defaults and what an operator can and cannot see or control once a run starts.","canonicalUrl":"https://www.zhcinstitute.com/research/anthropic-managed-agents-dynamic-workflows-beta-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-12","updatedAt":null,"tags":["Field Notes","Anthropic","Claude","Managed Agents","Multi-Agent","Agent Harness","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"uk-ico-agentic-ai-call-for-evidence-field-notes","type":"research","title":"Field Notes: The ICO Opens A Call For Evidence On Agentic AI","summary":"The UK Information Commissioner’s Office is gathering evidence on how data protection law applies to agentic AI, to inform its future guidance and statutory code on AI and automated decision-making. The call sets out current expectations on agent identity, permissions, audit logs, controllership and lawful basis.","canonicalUrl":"https://www.zhcinstitute.com/research/uk-ico-agentic-ai-call-for-evidence-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-09","updatedAt":null,"tags":["Field Notes","United Kingdom","ICO","Data Protection","UK GDPR","Agent Identity","Regulation","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"anthropic-usage-policy-2026-field-notes","type":"research","title":"Field Notes: Anthropic’s 2026 Usage Policy Takes Effect 12 November","summary":"Anthropic published its 2026 Usage Policy update on 8 Oct 2026, effective 12 Nov 2026. The policy is Anthropic’s terms of use, not a law, and it applies to every company building on Claude. It rewrites the high-risk requirements across eleven areas and adds controls for models that drive physical equipment.","canonicalUrl":"https://www.zhcinstitute.com/research/anthropic-usage-policy-2026-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-09","updatedAt":null,"tags":["Field Notes","Anthropic","Usage Policy","Human In The Loop","Disclosure","Physical AI","Governance","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"workos-airlock-atlas-passport-preview-field-notes","type":"research","title":"Field Notes: WorkOS Previews Airlock, Atlas And Passport","summary":"At init() on 7 Oct 2026, WorkOS previewed Airlock for governed agent access, Atlas for internal AI apps and Passport for Mac sign-in. Airlock judged each agent call against company policy using an intent token, and the agent never saw the real credentials.","canonicalUrl":"https://www.zhcinstitute.com/research/workos-airlock-atlas-passport-preview-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-09","updatedAt":null,"tags":["Field Notes","WorkOS","Airlock","Agent Identity","Access Control","Authorization","Preview","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"uk-health-ai-lifecycle-monitoring-field-notes","type":"research","title":"Field Notes: The UK Commits To Monitoring AI Medical Devices Across Their Working Life","summary":"On 6 Oct 2026 the UK accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare and committed to monitoring AI-enabled medical devices throughout their working life. AI Airlock Phase 3 tests post-market surveillance; apply before 31 Oct 2026 for the current review wave.","canonicalUrl":"https://www.zhcinstitute.com/research/uk-health-ai-lifecycle-monitoring-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-08","updatedAt":null,"tags":["Field Notes","United Kingdom","MHRA","Healthcare","Medical Devices","Post-Market Surveillance","Regulation","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"colorado-admt-chatbot-rules-interim-draft-field-notes","type":"research","title":"Field Notes: Colorado Posts An Interim Draft Of Its ADMT And Chatbot Safety Rules","summary":"The Colorado Department of Law posted an interim draft of 4 CCR 904-6 on 6 Oct 2026. It sets out Developer duties when one company builds another company’s Covered ADMT into its own product, and asks chatbot operators to show how their safeguards perform over time and after material changes.","canonicalUrl":"https://www.zhcinstitute.com/research/colorado-admt-chatbot-rules-interim-draft-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-08","updatedAt":null,"tags":["Field Notes","Colorado","United States","ADMT","Chatbots","Rulemaking","Governance","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"anthropic-cyber-verification-program-tiers-field-notes","type":"research","title":"Field Notes: Anthropic Ties Cyber Capability To Verified Access Tiers","summary":"On 6 Oct 2026 Anthropic merged Project Glasswing and its Cyber Verification Program into three verified tiers. Generally available models keep conservative cyber safeguards; more access depends on who the organization is and what it is authorized to test.","canonicalUrl":"https://www.zhcinstitute.com/research/anthropic-cyber-verification-program-tiers-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-08","updatedAt":null,"tags":["Field Notes","Anthropic","Cybersecurity","Verification","Agent Identity","Access Control","Safeguards","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"openai-ironclad-computer-use-contracting-field-notes","type":"research","title":"Field Notes: OpenAI And Ironclad Grade Agents On The Finished Contracting Setup","summary":"OpenAI and Ironclad turned legal, commercial and procurement configuration work into rubric-graded tasks scored on whether the finished process works across its cases. GPT-6 Astra met 55.0% of the criteria on average.","canonicalUrl":"https://www.zhcinstitute.com/research/openai-ironclad-computer-use-contracting-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-08","updatedAt":null,"tags":["Field Notes","OpenAI","Ironclad","Computer Use","Evaluation","Contracting","Verification","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"workos-mcp-gateways-compared-field-notes","type":"research","title":"Field Notes: WorkOS Compares MCP Gateways (Cloudflare / Okta / Auth0 / Entra)","summary":"WorkOS compares Cloudflare, Okta, Auth0, and Entra MCP gateways and says a gateway decides who knocks. The server still has to do audience-bound OAuth, per-tool scopes, and its own audit.","canonicalUrl":"https://www.zhcinstitute.com/research/workos-mcp-gateways-compared-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-01","updatedAt":null,"tags":["Field Notes","WorkOS","MCP","Gateways","Cloudflare","Okta","Auth0","Microsoft","Authorization","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"workos-mcp-events-subscription-credential-field-notes","type":"research","title":"Field Notes: WorkOS on MCP Events Subscriptions as Credentials","summary":"WorkOS argues ChatGPT draft MCP Events subscriptions are long-lived grants: principal, callback, signing secret, and a TTL that can be forever. Treat subscribe as credential issuance.","canonicalUrl":"https://www.zhcinstitute.com/research/workos-mcp-events-subscription-credential-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-10-01","updatedAt":null,"tags":["Field Notes","WorkOS","MCP","Events","ChatGPT","Credentials","Revocation","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"workos-scim-agent-resource-field-notes","type":"research","title":"Field Notes: WorkOS on SCIM for Agentic Identity","summary":"WorkOS covers the consolidated SCIM agent-resource draft. Model agents as first-class principals with lifecycle hooks now; keep runtime auth on short-lived tokens.","canonicalUrl":"https://www.zhcinstitute.com/research/workos-scim-agent-resource-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-09-30","updatedAt":null,"tags":["Field Notes","WorkOS","SCIM","Identity","Provisioning","IETF","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"},{"id":"workos-agent-permissions-checklist-field-notes","type":"research","title":"Field Notes: WorkOS AI Agent Permissions Checklist","summary":"WorkOS published a testable checklist for letting agents act on user data without forwarding the user session. Delegated agents get the intersection of ceiling and user permissions.","canonicalUrl":"https://www.zhcinstitute.com/research/workos-agent-permissions-checklist-field-notes/","source":{"name":"ZHC Institute","url":"https://www.zhcinstitute.com/research"},"publishedAt":"2026-09-30","updatedAt":null,"tags":["Field Notes","WorkOS","Authorization","Agent Identity","Permissions","Delegation","Zero-Human Companies","2026"],"category":"Field Notes","status":null,"region":null,"schemaVersion":"1.0"}],"page":{"limit":20,"returned":20,"total":307,"nextCursor":"djE6MjA"},"links":{"self":"https://www.zhcinstitute.com/api/v1/research/","next":"https://www.zhcinstitute.com/api/v1/research/?cursor=djE6MjA"}}