Thesis
The market moved from building agents to harnessing them.
Models are good enough. Frameworks are a commodity. Clouds will host a generic agent for you. The unpaid bill is the control plane that lets an enterprise actually let an agent act.
01 / the numbers that matter
79%
have adopted agents
Some pilot in production somewhere.
2%
have scaled them
Beyond a single team or workflow.
4
vendors in the way
Plus the glue nobody owns.
0
neutral boundaries
Nobody sells all four as one.
The distance between the first two numbers is the entire opportunity. It is not a capability gap — the agents in those pilots already work. It is a governance gap.
02 / four eras
Where this has been going.
2024
Write an agent
LangChain, CrewAI, AutoGen. The question was whether a loop could hold a task together at all. Almost everything shipped was a demo.
2025
Give it a computer
E2B, Daytona, Modal, Temporal. Agents got a place to execute and a way to survive a restart. The first real coding agents reached production.
2026
Prove it is safe
Adoption is near universal and scale is almost nonexistent. The blocker is identity, isolation, policy, and audit — and every hyperscaler is racing to close it inside their own estate.
2027
Run a fleet
Agents stop being a feature and become headcount. The winning infrastructure looks like an operating system: per-agent identity, just-in-time privilege, egress control, and a record an auditor accepts.
03 / three settled questions
Three things are already decided, and none of them are yours to win.
The brain is not yours
Claude, GPT, Gemini, and open weights will keep leapfrogging. Locking to one is a feature, not a company.
The loop is not yours
The OpenAI and Claude SDKs, LangGraph, ADK, and MAF are converging on the same shape. Orchestration margin goes to zero.
Generic hosting is not yours
AgentCore, Foundry, and Gemini Agent Platform will be the CloudWatch of this category: good enough, bundled, and close to free if you already pay the cloud bill.
04 / what is left
The deep, neutral layer that accumulates state.
The test a buyer now applies is simple: does this get harder to remove the longer we use it? Authorisation history, execution policy, and an audit chain do. A connector and a Python wrapper do not.
| Build this? | Why | Verdict |
|---|---|---|
| Another agent framework | Commoditising now | dead |
| Hosted 'deploy your LangGraph' | Hyperscalers and LangChain own it | dead |
| MCP connector catalogue | The protocol won; wrappers lose | dead |
| Another eval or tracing tool | Braintrust, LangSmith, Datadog | dead |
| Another durable workflow engine | Temporal is a $5B incumbent | dead |
| Pure sandbox API | Real market, crowded, capital-heavy | hard |
| Memory-only product | Sticky, but narrow and contested | hard |
| Governed execution control plane | Demand is loud, product is missing | build it |
05 / the hole
Five vendors and a pile of YAML.
The gap is not “a place to run Python” — E2B and Daytona sell that, and sell it well. The gap is that an agent can think in any framework on any model, but every action it takes has to pass through one enforced boundary: identity, isolation, egress, secrets, approval, and audit.
Today that is four vendors plus config, which is precisely why ninety-eight percent of companies are stuck in pilot. CISOs, IAM vendors, and even Microsoft’s own agent-hypervisor proposals all point at the same missing product. None of it is a sandbox API, and none of it is LangGraph.
06 / why the clouds will not close it
The Datadog pattern, again.
They cannot be cloud-neutral
AgentCore is AWS-shaped, Foundry is Azure-shaped. Enterprises mix clouds and mix models, and residency rules are not negotiable.
They cannot be model-neutral
A lab's runtime exists to make that lab's model the default. Neutrality is against the business model.
They optimise for breadth
Platforms ship many features one layer deep. JIT credentials, egress pinning, kill switches, and replay are depth on the scary path.
They cannot be audited against themselves
A record the platform owner can rewrite is awkward for the platform owner to sell as evidence.
07 / the wedge
Coding agents first, control plane second.
Shipping an operating system on day one is how good theses die. We start where untrusted code already runs and security is already nervous.
now
- SDK that wraps tool execution in twenty lines
- MicroVM isolation, never shared-kernel
- Default-deny egress
- Secrets in the control plane, tokens per call
- Policy file with allow, deny, and escalate
- Sessions that pause and resume
- An evidence chain you can verify yourself
next
- BYOC in your own cloud account
- MCP proxy with per-call permission
- Approvals on every irreversible action
- Budgets for tokens, spend, time, blast radius
- Parent and child identity for multi-agent fleets
- Adapters for every major harness
08 / the one decision
If a sentence does not contain isolation, policy, identity, and evidence, it is not the company.
Velone’s category is the agent hypervisor: a governed execution runtime. Not an agent builder, not a sandbox SaaS, not a workflow engine, not a memory company. The market is heading toward fleets that enterprises will only switch on if they can constrain and prove them. We are building the kernel those fleets run inside.
keep reading
Ring 0
Tell us where this is wrong.
We would rather find the hole in the argument now than after you have deployed it.