The Runtime Arrived. The Mandate Did Not.

On 29 September, the day after the reach chapter closed, OpenAI shipped dots: always-on agents on GPT-6 Astra, each with its own cloud computer and browser, connected through plugins to more than 4,000 apps, able to keep working after the user has left. xAI's Grok Bot had already put the same shape in market. Its enterprise controls — network policy, an independent Auto-review model, Action Recording — opened on 3 September, and Team Bots, shared across a team, followed on 28 September. The model is the rented layer. The computer is what this piece scores.

Always-On Is Not the Architecture already separated what these launches demonstrate from what they market. Persistent state — identity, permissions, unfinished work — is the layer an autonomous business requires; persistent compute is a vendor's flat-rate choice. This piece does not reopen that distinction. It reads the controls that arrived with the computer against the four terms the reach chapter put on the record, and it ends on the one thing both launches built that no chapter has yet specified.

The reviewer is still being asked to hold the boundary

Some of what shipped is a wall. The principal control on consequential action, in both products, is a review: a check that runs before the action rather than an architecture in which the action cannot be made.

A dot starts with built-in rules for when to act and when to ask. Custom Rules let the user allow an action, require approval, or block it. Auto-review checks "actions that could affect your accounts or share information" against those rules and against safety requirements that always apply, and determines "what work can proceed, what needs approval, and what you must do yourself." A monitoring system can pause or stop the work. Certain tasks, a password change among them, "always stay with you." OpenAI's own instruction is that dots "can still make mistakes, so always review consequential work."

Grok Bot runs the same pattern under the same name. Auto Review is "an independent review model that evaluates risky Bot actions before they run," covering shell commands, plugin calls, computer use, automation writes and delegation to subagents; it "can let an action proceed, require approval, or deny it." The security documentation defines its standing more exactly than any marketing copy. It "does not review every side effect; memory writes and most settings changes are examples." The vendor's own guidance is to treat it "as a complement to explicit boundaries and least privilege, working alongside controls that do not depend on a model's judgment." An Enterprise administrator can enforce it so that members cannot switch it off.

That is a backstop, described as one by the party that built it. The Model Stopping Is Not the System Holding named the scoring error: a system judged contained because something declined to proceed, rather than because the architecture made the class of reach unavailable. Nominal Containment is that condition. Auto-review strengthens the decline. It does not change the condition. For the actions governed only by Auto-review — which covers the general assigned-work action space — the action remains reachable and a second model is asked to notice. An administrator can force the backstop on. Forcing a backstop on does not make it a wall. A review model is the carefulness lever Slowing the Agent Is the Wrong Lever already refused, productised and running at agent tempo.

The Encoded Mandate is the other object: scope held in the layer that mediates the call, so that the call the business refused cannot be made whether or not either model reads the rule correctly. Grok Bot ships three kinds of control, and the corpus sorts them even where the vendor does not. Team rules apply to every Bot and members cannot turn them off; a rule is still something the agent reads, and The Mandate Was a Sentence said what a boundary held that way is. Auto Review is the reviewer. The network policy — "which destinations team computers can reach" — is enforced by the architecture, and it is the one of the three that is a wall, with two limits that belong in the same sentence: it is Enterprise-only, and a team without a policy "defaults to allow-all." A wall that ships unbuilt is an option, not a boundary, until an administrator sets it.

One restriction on a dot is a wall as shipped, and it is the exception that shows what the rule would look like. When a dot is not on an assigned task, its proactive-research tools "are restricted to be read-only, which means that they can't send messages, change app content, or control your browser or computer." That is a class of reach made unavailable, not a class of reach submitted for review, and a reader who says OpenAI already has an Encoded Mandate is right for exactly one bounded state. It covers the idle state. It does not cover the work the user assigned, which is the general action space and where the commitment sits — and there the control is the reviewer.

The record is optional

Reach Is State argued that enforcement and recording are the same act: a layer can refuse an out-of-scope call only if it resolves what the call reaches at the moment of the call, so the Reach Record is whatever that layer writes as it enforces. Both products have telemetry. The question is not whether actions are logged but whether the log is produced by the layer that enforces scope and resolved against the mandate in force at the call.

Grok Bot's Action Recording is the nearer artefact. It is Enterprise-only and off by default; when a team enables it, the vendor "records Bot actions, including scrubbed shell commands, in an internal store with a 90-day retention." It runs on a separate pipeline from the audit log and its events "do not appear on the Audit Log page." The audit log covers "admin, security, and authentication events" — bot creation, access changes — and not the footprint. A control-plane log can show that a bot exists. It cannot show what the bot touched. And the record of what it touched is a setting an administrator has to turn on.

A dot exposes Activity View, so the user can "follow progress, including background work," and can "open your dot's computer at any time to inspect its work." That is a window for the person who owns the dot. It is not a record written by the mediating layer and held against the mandate in force. Neither product's cited documentation establishes that its telemetry is generated by the enforcement layer or resolved against scope per call, and that is the criticism, not the absence of logging. NVIDIA's reference design, published on 28 September and scored the day after, was closer, and even that record was not the Reach Record. These two are further away: one optional operator log, one user window.

Identity stops at the firm

The Mandate Has to Cross the Boundary defined the Counterparty Mandate as the portion of an Encoded Mandate an agent carries across an organisational boundary and presents to another business, so the receiver can enforce a limit the sender declared — enquire, quote, reserve, commit, spend, to what limits, on whose authority.

Specialist dots are the first vendor language that points at the problem. OpenAI describes them as taking "dedicated responsibilities within your organization," each set up "with its own identity, credentials, and access to the systems it needs," in focused pilots, with an integration into Microsoft Agent 365's governance controls described as work in progress. Own identity is the precondition: a counterparty cannot enforce a mandate it cannot tell from a person's login. The preview does not describe the object that travels, or a receiving system that refuses a commitment the mandate did not authorise. It describes a better-scoped employee.

Grok Bot does not make that move, and its documentation is explicit about what a Bot is not. "A Bot has no identity or credentials of its own": Bots "act as the signed-in member," can "never hold more access than the person," and there is "no separate machine identity outside your identity provider." All of a member's Bots "share one cloud computer," and the instruction that follows is "do not use separate Bots as a security boundary." Team Bots share skills — and plugins where an admin configures them for the team — while each person's context and memories stay separate. That is composition inside one operator's runtime. Downstream, the credential is the person's by design, and the vendor says the Bot is not a boundary.

The window the person comes back to

Every control above has a surface, and the surface is the thing the two launches built that no published chapter has specified. A dot works while its owner is away and "can message you with progress, questions, or decisions that need you"; the owner comes back to Activity View and to the dot's computer, open for inspection. When a Grok Bot needs approval, "the conversation shows the proposed operation and its inputs." Each Bot "gets its own screen" on the shared computer.

Read those against the corpus and they are the Steward's verification route, built by two vendors, for a person who returns to a system that ran without them. The Steward-interface chapter said which channel that route runs on and why. The reach chapter said what the system on the far end may touch. Neither said what the window must look like for a person checking, at a glance, what ran overnight — what has to be where, what a signal is allowed to mean, what may move between one look and the next. Both launches have answered that question by default, with a window and a card, and neither has stated the answer. This piece records the question. The Log takes it up next.

What Arco takes from it

The agent computer is now a shipped default from both labs. That dates the substrate. It does not date the mandate. Score the read-only idle restriction as a class of reach removed, score the network policy the same way once it is set, and do not score Auto-review as a wall — the vendor that built it does not.

The specialist-dot identity is the unmatched term admitting it is unmatched. Own identity inside the firm is not a Counterparty Mandate. It is the absence of one, stated as a pilot.

And neither launch is evidence about a portfolio. A cloud computer that executes work under reviewer-mediated reach is supervised execution with a persistent runtime; it is not yet evidence of autonomous business authority. That claim starts where the refused reach is unavailable at call time, the footprint is the enforcement record, and the counterparty can refuse what the mandate did not authorise. None of that is in either launch, and none of it exists in an Arco venture.

Technology changes what is possible. A computer for the agent determines where the work runs, not what it may commit.