Appendix K: Market and incumbent update (2026-09-04)
Scope: changes since the 2026-09-03 pass. CONFIRMED = read on the page; UNCONFIRMED = search snippet only. Quotes are verbatim.
What changed since 2026-09-03
- Claude Code and Codex both already emit a per-tool-call permission-decision event over OpenTelemetry recording whether the decision came from config or a human. Neither ties it to a commit or a failing check, but "nobody records the approval decision" is no longer true as stated.
- GitHub Copilot code review can now approve PRs and count toward required approvals (2026-09-01, off by default). Agents now sit on both sides of the merge gate.
- GitHub added resolution reasons ("Addressed", "Won't fix", "Incorrect") when a human dismisses a Copilot review comment (2026-08-27) — an override record, but it feeds GitHub's product team, not the customer's audit trail.
- Arnica announced a PR-layer product generating "a digitally signed review record for every PR as built-in compliance evidence" (2026-06-22). Closest positioning to Panout found.
- Google Antigravity (08-20), GitLab 19.2 (07-16), Kiro Crew (08-04) all shipped enterprise audit logging of agent sessions. All are session logs; none is a commit-time override ledger.
- Regulatory pull weakened: Digital Omnibus (Reg. 2026/1744, in force 07-27) pushed Annex III duties to 2027-12-02; OCC's April guidance excludes generative and agentic AI; no AICPA/Vanta/Drata/Secureframe guidance on evidencing review of AI-written code found.
- Incidents: PocketOS (04-25, Cursor + Claude Opus 4.6 wiped prod DB and backups) and GPT-5.6 Sol reports (July) join Amazon, which publicly denied introducing "new approval requirements for engineers working with AI tools".
- Pricing: Bugbot $1.00–1.50/run (05-11); Greptile $1/review after 50; GitLab $0.25/review; CodeRabbit est. $50M ARR (July). Per-evaluation metering is now the norm.
1. Incumbent moves since ~2026-06-01
GitHub
- 2026-03-20 (pre-window context) — CONFIRMED. https://github.blog/changelog/2026-03-20-trace-any-copilot-coding-agent-commit-to-its-session-logs/ — "the agent's commits link back to the agent session logs by including an
Agent-Logs-Urltrailer in the commit message." "Every commit from Copilot coding agent...is authored by Copilot, with the human who gave Copilot the task marked as the co-author." Only incumbent commit-trailer attribution found. - 2026-07-02 — CONFIRMED. https://github.blog/changelog/2026-07-02-copilot-agent-session-streaming-is-now-in-public-preview/ — streams "prompts, responses, and tool calls"; REST returns "the last 48 hours of session data on demand." No mention of approval/override decisions.
- 2026-07-27 — CONFIRMED. https://github.blog/changelog/2026-07-27-enterprise-managed-settings-now-apply-to-the-github-copilot-app/ — policy for "Whether developers can bypass approval prompts before Copilot runs commands, accesses files, or fetches URLs." No logging language.
- 2026-08-07 — CONFIRMED. https://github.blog/changelog/2026-08-07-copilot-usage-metrics-api-adds-agent-app-activity/ —
totals_by_3rd_party_agentcounts "user-initiated agent app job starts", not commits or PRs. - 2026-08-27 — CONFIRMED. https://github.blog/changelog/2026-08-27-copilot-code-review-resolution-reasons-and-expanded-capabilities/ — dismissing a Copilot comment records "Addressed", "Won't fix", or "Incorrect"; "Selecting one of these options provides valuable feedback to the product team and helps improve the product."
- 2026-09-01 — CONFIRMED. https://github.blog/changelog/2026-09-01-copilot-code-review-can-now-approve-pull-requests/ — "Copilot can submit an approval that counts toward the repository's required-approvals rule." "By default, Copilot will not approve pull requests." No audit mention.
- Agentic audit log events (public preview) — CONFIRMED. https://docs.github.com/en/copilot/reference/agentic-audit-log-events —
actor_is_agent"will always betruefor agentic audit log events";useris "The person who initiated the agentic event.";agent_session_id"only appears when the event is the result of an agent session." EMU/data-residency only. Retention "the last 180 days" (https://docs.github.com/en/copilot/how-tos/administer-copilot/manage-for-enterprise/review-audit-logs, CONFIRMED). No event for a human overriding an agent action or failing check. - AI-authored commit attribute in the API: not found.
Assisted-by:proposal open: https://github.com/microsoft/vscode/issues/313962 (2026-05-03, CONFIRMED) — "Commit authors have certain benefits and responsibilities towards their commits which cannot be enjoyed nor fulfilled by AI agents." - Per-agent branch protection: not found. Existing behaviour (CONFIRMED, https://github.com/orgs/community/discussions/183848, 2026-01-08): "Approvals from users that collaborated with Copilot on changes will not satisfy review requirements."
Cursor
- v3.4, 2026-05-13 — CONFIRMED. https://cursor.com/changelog/05-13-26 — "An audit log captures every action team members take on environments, giving security teams full visibility into who changed what." Environment admin actions only.
- Cursor Blame (Enterprise) — CONFIRMED. https://cursor.com/docs/integrations/cursor-blame — lines attributed "Tab", "Agent: Code generated by Agent, with model attribution", "Human". https://cursor.com/help/integrations/git — "When Agent creates commits or pull requests, Cursor can add a
Made with Cursortrailer automatically." "Attribution is on by default." Enterprise admins can disable it. - AI Code Tracking API — CONFIRMED. https://cursor.com/docs/account/teams/ai-code-tracking-api — per-commit TAB/Composer line counts; "Enterprise only"; Alpha. No per-action approval record.
Anthropic (Claude Code)
- Auto mode default 2026-08-14 — CONFIRMED. https://claude.com/blog/auto-mode-default-in-claude-code — "users approve 97% of permission prompts in Claude Code"; "human review caught just 13.6% of dangerous commands, while auto mode caught 89%." Enterprise/API opt-in for now. Docs (CONFIRMED, https://code.claude.com/docs/en/permission-modes): "Auto mode reduces permission prompts but does not guarantee safety."
- OpenTelemetry — CONFIRMED. https://code.claude.com/docs/en/monitoring-usage —
claude_code.tool_decision, "Logged when a tool permission decision is made (accept/reject)",source∈ {config,hook,user_permanent,user_temporary,user_abort,user_reject}.configcovers settings rules, "the active permission mode ... or because the tool is inherently safe. The event doesn't indicate which of these sources matched." Onlytool_resultcarriesgit_commit_id"when agit commitcommand succeeds." Decision is per tool call; auto-mode approvals are indistinguishable from allow-rules; nothing links to a failing check. - https://github.com/anthropics/claude-code/issues/40634 (2026-03-29) asking to capture approval method: Closed as not planned, 0 comments (CONFIRMED).
OpenAI (Codex)
- rust-v0.147.0, 2026-08-07 — CONFIRMED. https://github.com/openai/codex/releases/tag/rust-v0.147.0 — "Enable automatically reviewed approvals with the new
--approve-for-meCLI flag." - OpenTelemetry — CONFIRMED. https://learn.chatgpt.com/docs/config-file/config-advanced —
codex.tool_decisionrecords "approved/denied and whether the decision came from config vs user";codex.approval.requestedresults "(approved, approved_with_amendment, approved_for_session, denied, abort)". Per tool call, not per commit.
Google — Antigravity 2026-08-20, CONFIRMED. https://cloud.google.com/blog/products/ai-machine-learning/expanding-google-antigravity-for-enterprise-customers — "Enable comprehensive audit logging with a single toggle, capturing prompts, agent responses, and metadata for compliance reporting." Jules: nothing found.
Amazon — Kiro Crew open-sourced 2026-08-04, CONFIRMED via InfoQ 2026-08-30 https://www.infoq.com/news/2026/08/kiro-crew-coding-agents/ — ships "an OS-level sandbox, denied-by-default commands ... and a signed audit log of every action."
GitLab — 19.2, 2026-07-16, CONFIRMED. https://docs.gitlab.com/releases/19/gitlab-19-2-released/ — AI audit event report (beta) captures "Inputs", "Model and configuration context", "The chronological event timeline", "Outputs"; "download the underlying session artifact."
Net: every incumbent logs agent sessions; GitHub alone stamps the commit; none records a human committing past a failing check.
2. New entrants
- Arnica — CONFIRMED. https://www.einpresswire.com/article/920538899/arnica-to-showcase-agentic-software-development-governance-vision-at-owasp-global-appsec-eu-2026 (2026-06-22): Arnica Code Review is "classifying pull requests before a human reviewer ever sees them, automatically surfacing security-relevant changes, and generating a digitally signed review record for every PR as built-in compliance evidence." PR-layer, security-scoped. No public pricing/funding.
- Endor Labs — CONFIRMED. https://www.prnewswire.com/news-releases/endor-labs-expands-auri-from-securing-code-to-securing-agents-that-produce-code-302768646.html (2026-05-12): Agent Governance, "creating a system of record for how agents operate", "available in private preview." Hooks blog (2026-05-12) https://www.endorlabs.com/learn/introducing-agent-governance-using-hooks-to-bring-visibility-to-ai-coding-agents — "Centralized audit. Every PreToolUse, every shell exec, every file read can stream to a SIEM." "29 default AI governance policies". No pricing. $163M raised — UNCONFIRMED.
- Snyk Evo ADS — CONFIRMED. https://www.globenewswire.com/news-release/2026/06/23/3315918/0/en/ (2026-06-23, GA 06-29): supply chain, "Agent behavior governance", "Output validation". No pricing.
- Semgrep Guardian — CONFIRMED. https://semgrep.dev/blog/2026/introducing-semgrep-guardian-real-time-security-for-ai-written-code/ (2026-06-23): "MCP server, Hooks integrations, and Skills"; "Install Guardian now for free." No audit-record language.
- Cycode — CONFIRMED. https://cycode.com/blog/ai-code-security/ (2026-06-07): "Most organizations can't distinguish human-written from AI-generated code once it's in the repo." "81% of organizations lack visibility into how and where AI is used across the SDLC."
- Macroscope Approvability — CONFIRMED. https://macroscope.com/content/what-is-approvability-auto-approve-safe-pull-requests (2026-05-01): "auto-approves low-risk pull requests on GitHub" by posting a GitHub APPROVE review; usage-based pricing. $0.95/review — UNCONFIRMED.
- Lasso Security — CONFIRMED. https://siliconangle.com/2026/09/02/lasso-security-launches-cpu-only-ai-guardrail-raises-30m/ (2026-09-02): $30M led by ClearSky; "Revenue has grown more than 500% in the past 12 months." Not coding-specific.
- Microsoft Agent Governance Toolkit — CONFIRMED. https://opensource.microsoft.com/blog/2026/04/02/introducing-the-agent-governance-toolkit-open-source-runtime-security-for-ai-agents/ (2026-04-02), MIT.
- Corridor docs (https://docs.corridor.dev/) contain no audit or pricing language (CONFIRMED absence). UNCONFIRMED: Legit VibeGuard; Apiiro Guardian Agent (2026-01-28); Kusari Inspector free for CNCF/OpenSSF (2026-03-23). Tessl, Entelligence, Kilo: nothing relevant. YC W26/S26: no match; nearest Oximy ("system of record for enterprise AI usage", UNCONFIRMED).
3. Compliance drivers
(a) EU AI Act. CONFIRMED. https://www.cooley.com/news/insight/2026/2026-08-03-eu-ai-act-transparency-obligations-take-effect-2-august-2026 (2026-08-03): Article 50 applies to "providers (those who develop and place an AI system on the market) and deployers (those who use an AI system under their own authority)"; fines "up to €15 million or 3% of worldwide annual turnover, whichever is higher"; guidelines adopted "20 July 2026". Stibbe (UNCONFIRMED): companies "using coding assistants ... will inevitably be confronted with these obligations" — but Art. 50 is content labelling, not change control. Omnibus — CONFIRMED. https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force (2026-07-28): in force 2026-07-27; Annex III to 2027-12-02; Annex I to 2028-08-02. No Art. 26 logging duty reaches a company merely using coding agents in 2026.
(b) SOC 2 / ISO 27001. No AICPA, Vanta, Drata, Secureframe or Big 4 guidance on evidencing review of AI-generated changes found. Snippets (UNCONFIRMED) say the AICPA "hasn't issued AI-specific criteria". Only consultancy blogs address the CC8.1 gap.
(c) ISO/IEC 42001. CONFIRMED (secondary, no registry): "more than 350 organisations globally hold ISO 42001 certificates" through April 2026 (https://aicompliancevendors.com/blog/iso-42001-certified-companies-list, 2026-05-17); same figure "as of mid-2026" (https://www.dsalta.com/resources/ai-compliance/iso-42001-certification-cost-timeline-requirements-2026, 2026-08-03).
(d) Regulators. OCC Bulletin 2026-13, 2026-04-17 — CONFIRMED. https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html — "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." RFI on "generative AI and agentic AI" promised "in the near future." FCA — CONFIRMED secondary (2025-12-18) https://www.bclplaw.com/en-US/events-insights-news/ai-regulation-in-financial-services-turning-principles-into-practice.html — "guidance on audit trails, and human-in-the-loop protocols is likely in 2026." No FCA publication found. SEC, PRA, EBA, FFIEC: nothing in 2026 on AI-generated code controls. APRA 2026-04-30 letter — UNCONFIRMED.
4. Incidents (2026)
- AWS Kiro / Cost Explorer (Dec 2025, reported 2026-02-20). CONFIRMED. https://incidentdatabase.ai/cite/1442/ — "approximately 13-hour interruption after Amazon engineers allegedly allowed Kiro ... to make changes and it reportedly deleted and recreated part of the working environment." Amazon (https://www.aboutamazon.com/news/aws/aws-service-outage-ai-bot-kiro): "misconfigured access controls—not AI as the story claims"; "mandatory peer review for production access."
- Amazon retail, March — follow-up. CONFIRMED. https://www.aboutamazon.com/news/company-news/amazon-outage-ai-financial-times-correction — "Only one of the incidents involved AI-assisted tooling, which related to an engineer following inaccurate advice that an AI tool inferred from an outdated internal wiki"; "Amazon introduced new approval requirements for engineers working with AI tools. That is false." https://www.thesafetymag.com/ca/news/general/amazon-imposes-90-day-code-safety-reset-after-outages/547354 (CONFIRMED): 335 systems, "controlled friction". No June–August reporting on the reset's outcome found.
- PocketOS, 2026-04-25. CONFIRMED. https://zenity.io/blog/current-events/ai-agent-database-deletion-pocketos (2026-04-28): Cursor running Claude Opus 4.6 deleted a Railway production volume in 9 seconds; backups were in the same volume; "the only thing standing between those rules and a production database was a system prompt."
- GPT-5.6 Sol / Codex, July. CONFIRMED. https://techcrunch.com/2026/07/14/openais-new-flagship-model-deletes-files-on-its-own-people-keep-warning/ — "GPT-5.6 Sol just deleted my whole production database." OpenAI attributing it to full-access mode without sandbox/auto-review — UNCONFIRMED.
5. Pricing signals
- Bugbot — CONFIRMED. https://cursor.com/blog/may-2026-bugbot-changes (2026-05-11): "switching from a $40 per seat per month subscription to usage-based billing"; "The average Bugbot run costs $1.00-$1.50, depending on PR size and complexity." June "22% lower cost per run" — UNCONFIRMED.
- Greptile — CONFIRMED. https://www.greptile.com/pricing — Pro "$30/seat/month", "50 credits included per seat", "$1 per additional credit", "3 credits = 1 trex review". March switch per https://www.agent-wars.com/news/2026-05-01-greptile-per-review-pricing (CONFIRMED as that article's claim).
- CodeRabbit — CONFIRMED. https://sacra.com/c/coderabbit/ — "Sacra estimates that CodeRabbit hit $50M in annual recurring revenue in July 2026, up from $25M at the end of 2025."
- Copilot — CONFIRMED. https://github.blog/news-insights/company-news/github-copilot-is-moving-to-usage-based-billing/ — from 2026-06-01 "premium request units (PRUs) will be replaced by GitHub AI Credits"; "Copilot code review will also consume GitHub Actions minutes, in addition to GitHub AI Credits."
- GitLab — CONFIRMED. https://ir.gitlab.com/news/news-details/2026/GitLab-Enables-Broader-and-More-Affordable-Access-to-Agentic-AI-Across-the-Software-Lifecycle/default.aspx (2026-03-19): "At a flat cost of $0.25 per review (4 code reviews per GitLab Credit today)".
- Codex code review — CONFIRMED. https://learn.chatgpt.com/docs/pricing — "Code Review usage applies only when Codex runs reviews through GitHub"; no per-review figure.
- Graphite Diamond folded into Graphite Agent; $40 Team unlimited reviews — UNCONFIRMED.
6. Demand signals
- Claude Code #40634 (2026-03-29): "the final approval method — whether it was auto-approved by a matching rule ... or manually approved by the user — is not captured anywhere in the audit log." "A session with 266 permission requests has no way to distinguish '20 needed human review' from '266 needed human review'". Closed not planned, 0 comments. CONFIRMED.
- Claude Code #21794 (2026-01-29): "Cannot deploy Claude Code in regulated environments ... where audit trails are mandatory. No compliance story." Closed not planned. CONFIRMED. Transcript 30-day deletion cluster (#38440, #62476, #59248, #64999) — UNCONFIRMED.
- Codex #4792 (2025-10-05): "Once the session closes, there is no forensic record of any shell commands, patches, or tool calls executed during the review." Closed. CONFIRMED. Discussion #27766 (2026-06-12, 3 👍): "a billing summary is not an audit trail — and the workaround of parsing local .jsonl files is not governance". CONFIRMED.
- VS Code #302362 (2026-03-17): extensions to "log all tool calls and permission decisions for compliance". Closed not planned. CONFIRMED.
- Cursor forum https://forum.cursor.com/t/platform-level-audit-trail-for-agent-tool-call-proposals-and-user-approval-decisions/156247 (2026-03-30, 1 like): wants "User decision: accepted / rejected / auto-approved (via allowlist)"; "None of these proposals or decisions are persisted in any queryable, exportable form." CONFIRMED.
- GitHub community #197170 (2026-05-28, 6 votes): "We must have 2 human reviewers involved in all production changes"; "AI agents cannot count as human reviewers." CONFIRMED.
- OpenCode #19118 (closed not planned) — UNCONFIRMED. Gemini CLI: none found.
Reaction counts are 0–6 everywhere. Demand is articulate but thin, and vendors keep closing it "not planned".
Claims that would change the Panout memo
- Weakens (precision): Claude Code (
claude_code.tool_decision) and Codex (codex.tool_decision) already record approval decisions per tool call with a config-vs-user source. The memo must narrow to: nobody records the decision at the commit boundary against a named failing contract; and Claude'sconfigbucket "doesn't indicate which of these sources matched", so auto-mode approvals are unrecoverable from the stream. - Weakens (competitor): Arnica's "digitally signed review record for every PR as built-in compliance evidence" is a signed per-change record sold as audit evidence. PR-layer and security-scoped; Panout must show why commit-time, contract-level, human-override capture differs.
- Strengthens: GitHub's resolution reasons prove the override moment is capturable and valuable, yet GitHub routes it to "the product team", not the customer. The customer-owned override record is unclaimed.
- Strengthens: Copilot approvals now count toward required approvals, Macroscope auto-approves routine PRs, and Claude auto mode is default with a 97% human approve rate. The merge gate is going agent-on-agent; the override is the last human signal left.
- Weakens (buyer pull): No regulator or SOC 2 body compels this in 2026 (Omnibus deferral, OCC carve-out, no AICPA guidance, FCA guidance still "likely"). The buyer is internal risk (Amazon, PocketOS, Sol), not compliance.