If you read one line: In a single quarter — April to July 2026 — three serious products shipped to do the same job: sit between an AI agent and the world, inspect every action before it runs, and kill the agent if it crosses a line. Microsoft open-sourced the pattern (Agent Governance Toolkit, April 2), Netzilo made it cross-platform (runtime governance + kill switches, ~July 1), and Alterion productized it for the enterprise (Draco, July 16). The category has a name now — runtime control plane — and one shared primitive: the kill switch.
For two years the safety conversation about agents lived inside the model: better system prompts, refusal training, "please don't do anything dangerous." That conversation quietly lost. The winning answer in 2026 is architectural — you don't ask the agent to behave, you put a layer in front of its hands.
The three launches, in order#
Microsoft Agent Governance Toolkit (April 2, 2026) established the shape. It's open-source under the MIT license — seven packages across Python, TypeScript, Rust, Go, and .NET — and its centerpiece, "Agent OS," is a stateless policy engine that intercepts every agent action before execution at a reported p99 latency under 0.1 milliseconds. A companion runtime borrows CPU privilege levels ("execution rings"), adds saga-style orchestration for multi-step transactions, and — the part that matters here — a kill switch for emergency agent termination. Microsoft claims it's the first toolkit to address all ten of OWASP's agentic-AI risks, from goal hijacking to rogue agents, and it ships 20+ adapters for LangChain, CrewAI, Google ADK, and Microsoft's own Agent Framework.
Netzilo (around July 1, 2026) proved the pattern travels. Its AI Detection & Response (AIDR) platform extends runtime governance across the harnesses founders actually use — Amazon Bedrock AgentCore, Microsoft Foundry, Copilot Studio, CrewAI, LangGraph, Google Vertex AI, even agents on user devices — and builds a runtime graph of each agent's behavior: tool calls, file reads, network requests, skill acquisitions, multi-stage sequences. The point of the graph is to catch actions that look harmless alone but dangerous together: prompt injection, tool poisoning, capability hijacking, privilege escalation, multi-stage data exfiltration. When it sees one, it can isolate or terminate the compromised agent in real time using deterministic "Governance-as-Code" rules — which Netzilo also released to the community.
Alterion's Draco (July 16, 2026) is the enterprise turn. Founded by an ex-McKinsey partner (Alharith Hussin) and a former Google engineering VP (Asim Husain), Alterion sells Draco as a runtime control plane that gives security and compliance leaders "real-time visibility, governance, and enforced control" over agents across clouds and vendors — explicitly without code changes or vendor lock-in. Draco observes every prompt and action, models the agent's behavior, and applies programmable guardrails to enforce policy before a high-risk action runs, with the compliance story (SOC 2, ISO 42001, EU AI Act) aimed squarely at regulated buyers.
Why this is a category, not three products#
Three independent teams — an open-source giant, a security startup, and an ex-Big-Tech founder duo — converged on the same architecture within fifteen weeks. That's the signal. When the incumbents, the challengers, and the community all ship the same primitive at once, the primitive is the category. And the primitive is small: an interception point (something every action passes through) plus a decision (allow, block, or kill) plus enforcement that doesn't depend on the model's cooperation.
This is the same lesson we drew when we asked who actually stops a runaway subagent: the tools that can stop an agent are the ones that put the stop outside the agent. The runtime-control category is that idea, generalized and sold.
The founder call#
If you run agents in a regulated business across multiple vendors, a commercial plane like Draco or Netzilo is a real buy — you're paying for the audit trail and the cross-harness coverage, not just the kill switch. If you're a solo founder or a small team running one or two agents, don't buy the plane. Buy — or rather build — the primitive.
Because here's the uncomfortable part: the enterprise version is expensive and heavy, but the 20% that actually saves you is cheap. An interception point around your agent's tool calls, a policy check, and a hard kill switch is an afternoon of work, not a procurement cycle. We wrote the companion how-to for exactly that: build a runtime kill switch for your agent in about forty lines. Study Microsoft's open-source toolkit for the production-grade shape, then ship the minimal version this week. The category exists because the risk is real — but the control is not something you have to rent.
