The Runtime Went Free. The Control Plane Is the Product

Status: Market Shift / Category Validation

Microsoft Scout, Built on OpenClaw (Build 2026)

---

CISO Perspective: At Build 2026, Microsoft put its first always-on work agent on a free open-source runtime, then built its whole business on the layers around it. Identity, containment, policy, all kept proprietary. The runtime is now the cheap part. The question of whether an action is correct at the moment it is fired remains unresolved, and that is the part that matters most.

The Structural Shift

Microsoft has the engineers to build its own agent runtime. At Build 2026, it chose not to. Scout, its first always-on Autopilot agent, runs on OpenClaw, the open-source project that went from a weekend build in January 2026 to one of the year’s fastest-growing repositories. Microsoft wrapped it, gave it a governed identity, and is contributing its policy conformance work back to the open project.

The pattern is the one the phone industry has already run. Android shipped as a free common base, and the money moved to the layers around it: the managed identity, the device-management console, the app store, the silicon underneath. The base made handset makers ubiquitous without ever becoming a business on its own. Agent runtimes are now on the same path. OpenClaw is the common base. Microsoft, Nvidia, and Nous Research are all building on it, and Nous Research’s Hermes is integrating both OpenClaw and Nvidia’s OpenShell.

What Microsoft Solved, And What It Did Not

• Identity, solved. Every Scout agent runs under its own governed Entra identity, not a shared service account, so each action traces back to a known actor. This is a real answer to the agent identity problem.
• Containment, solved. Microsoft Execution Containers push agent sandboxing into the Windows kernel, hardware-rooted, declaring up front what an agent is allowed to touch across files, network, and applications. This is a real answer to isolation.
• Configuration, validated. In Microsoft’s own words, its conformance work lets organizations validate whether their environment is configured in accordance with security and compliance requirements and obtain an audit-ready answer. That is verifying the setup is correct. It is not evaluating whether a specific action is correct in the moment.
• The gap that remains. Identity says who the agent is. Containment says what it is allowed to touch. Neither one looks at a specific action, in context, at the instant it fires, and decides whether it is the right call. That judgment does not live in identity, containment, or a runtime. It lives at execution.

Broader AI Security Context: Acceptable Is Not Correct

Containment makes an agent acceptable. It sets, in advance, the categories of things the agent may and may not touch. That is a posture decided before the agent ever runs. But an autonomous agent operating inside its allowed boundaries can still take a catastrophic action. Deleting the right category of file at the wrong moment. Approving a vendor, it was only supposed to review. Acting on the memory of a task it has already completed. All of that is inside the permissions and still wrong.

Correct is a judgment made in real time, against policy, at the moment the action fires. An agent like Hermes, which remembers across sessions and rewrites its own skills, will not behave on day ninety the way it behaved on day one. Containment cannot catch that drift, because the action is still inside the boundary it was granted. Someone has to evaluate the action itself.

Where Mountain Theory Fits

Mountain Theory operates as a real-time circuit breaker between inference and execution. The architecture is three components working in concert, sitting at the execution layer, underneath identity and alongside containment, not competing with either.

Policy AI defines the boundary in plain language. For an autonomous agent, the rules are written once in natural language and enforced wherever the agent runs. When an agent moves to take an action, Guardian AI evaluates it against that policy in under 200ms and returns allow, hold, or block before the action executes. Adjudicator AI captures the event with a full audit trail and feeds the learning back so the same pattern is recognized everywhere Mountain Theory deploys.

These are complementary controls. Microsoft makes the agent acceptable to run. Mountain Theory makes each action correct at the moment it fires. Identity, containment, and execution control are three different layers, and a regulated buyer needs all three. The platforms just spent Build proving the first two are worth building. The third is still open.

Sources. Microsoft 365 Blog, “Introducing Microsoft Scout” (microsoft.com, June 2, 2026). Microsoft Build 2026 Windows Developer blog on Microsoft Execution Containers. Press: Computerworld, Decrypt, The New Stack. Runtime integration: Nous Research (Hermes), Nvidia (OpenShell).