The strongest zero-human company signals entering September 3, 2026 are about state that cannot be left implicit. EMVCo has proposed durable consumer intent for card-based agent payments, Google has opened a security harness that separates findings from verified fixes, and a new Agentic AI Foundation reference architecture makes sessionless MCP state and replay explicit.
1. Payments: Delegated Intent Becomes A Lifecycle
On September 1, EMVCo published a draft framework for card-based agentic payments. It focuses on cases where authority persists over time, including recurring purchases, cumulative budgets, and post-transaction activity.
The proposed Intent Services layer would let payment participants register, reference, retrieve, and update consumer-authorised intent before, during, and after a transaction. EMVCo also says later work may address Know Your Agent capabilities and indicators that a transaction involved an agent.
This is a public-review draft, not an adopted specification or proof that issuers and merchants have implemented it. Its useful signal is narrower: a payment standards body is treating delegated authority as shared, durable state rather than a one-time checkout attribute.
2. Security: Discovery Is Not Verification
Google's September 2 Mantis release packages security review as a staged agent workflow: build context, model threats, discover and deduplicate findings, review them, reproduce viable issues, patch them, and produce a report.
The open-source repository is unusually direct about its limits. It says findings and patches can be wrong, requires expert verification before reporting, and warns that generated reproducers and patches belong in isolated environments without production access or networking.
The operational lesson is not that an autonomous scanner can replace security review. It is that a finding should move through explicit evidence states, and that code execution needs a containment boundary independent of the agent's instructions.
3. Infrastructure: Stateless Transport Moves State Elsewhere
The Agentic AI Foundation published a September 2 serverless reference architecture for MCP 2026-07-28. The current MCP specification defines stateless, self-contained requests, but that does not remove application state or make a side effect safe to retry.
The companion implementation uses Cognito and API Gateway at ingress, verifies the token again in Lambda, binds short-lived handles to a verified client ID, and stores handle transitions and replay responses transactionally in DynamoDB. It separates local and CI checks from credentialed deployment evidence.
The authors constrain the claim: the supplied deployment has one pre-registered machine client, and it does not solve prompt injection, interactive consent, dynamic client registration, multi-region concurrency, or production approval design. It is a checkable baseline, not a complete operating model.
4. The Operating Pattern
These systems manage three different kinds of state: what a buyer authorised, what a security pipeline has actually proved, and what a tool call already changed. A reliable autonomous company needs explicit records for all three.
Put intent, evidence state, ownership, expiry, and replay semantics in infrastructure that the agent cannot reinterpret. Then separate pre-deployment checks from live operational proof. An agent's successful response is not authority, verification, or deployment evidence by itself.
Related: Read the field notes on EMVCo's durable intent proposal, Google Mantis, and sessionless MCP state on AWS.