Dreamforce Pitches Unified Agent Trust — But the Market Is Building Three Separate Layers

Salesforce is arriving at Dreamforce 2026 with a polished story about unified agent governance. The market building the actual infrastructure is looking at three separate, often incompatible problems: governance specification, runtime authority, and runtime enforcement. No single vendor covers all three.

Governance specification — defining what an agent is allowed to do before it runs — is a crowded, early-stage field. Organizations are combining tools from vendors including Okta, IBM, Broadcom, and Dataiku. The OWASP Top 10 for Agentic Applications now includes risks specific to agents such as Agent Goal Hijack and Identity and Privilege Abuse. A UC Berkeley MAST taxonomy study found that 79% of multi-agent failures trace to specification problems rather than model limitations.

Runtime authority — verifying that an agent is who it claims to be while it runs — is moving away from static permissions. Akeyless has introduced intent-based access control. CrowdStrike is pushing SPIFFE-based cryptographic identities for agents. As CrowdStrike CTO Elia Zaitsev noted, "Authorize once and trust indefinitely is not a security model; it's a liability."

Runtime enforcement — where security policy meets live agent traffic — is the domain of bidirectional API security tools. Akamai and MuleSoft have expanded their integration in this area. With 87% of organizations reporting an API security incident in 2025, this layer is critical for preventing the type of escalation seen in the July 2026 Hugging Face breach.

Key Takeaways

• 42% of merchants are testing agentic systems; only 3% of transactions involve agents. Consumer trust drops sharply for purchases above £50, and 81% of shoppers will not return to a brand after a single bad agent experience.
• Governance gaps are a margin risk, not just a security issue. Gartner warns that 40% of autonomous AI efforts will be partly derailed by governance gaps found only after production incidents.
• Consolidation is priced in at the infrastructure layer. Nvidia's reported $12.9 billion acquisition of Hugging Face and Stripe's $7.5 billion acquisition of OpenRouter signal that orchestration infrastructure is where the highest valuations sit.

Read the full article on Forkast