Every vendor’s product map is a map of their org chart. Your risk surface is not organized that way.
Why the Embedded-Agent Seam Matters Now
Run the experiment on your next vendor call. Ask about the Copilot agent drafting summaries against SharePoint, the Einstein agent reasoning over your opportunity records, the Box agent indexing a contracts folder, the Power Platform flow a finance analyst published last Tuesday. Then ask the same vendor about the Cursor instance on an engineer’s laptop opening the same contract file from disk.
You will almost never get one answer. You will get two SKUs, and usually one of them is on a roadmap.
This is not vendor bad faith. It is architecture leaking into a price sheet. The tool that watches embedded SaaS agents is an API-and-log product; the tool that watches local agents is an endpoint product. Different data planes, different engineering teams, different renewal dates. The problem is that the exposure does not divide along the same line. An embedded agent and a local agent can touch the same file, under the same user identity, in the same hour — and the control plane that sees both does not exist inside either SKU.
| Signal | Figure | Source |
|---|---|---|
| CIOs with AI agents already deployed | 17% | Gartner CIO survey |
| CIOs expecting deployment within one year | 42% | Gartner CIO survey |
| Unauthorized agent transactions traceable to internal violations, through 2028 | at least 80% | Gartner |
| Enterprise environments where Ospiri scans surface at least one unsanctioned agent | 88% | Ospiri field data |
Read those together. Adoption is compounding, most of the damage is endogenous rather than adversarial, and nearly every estate we scan is already running something nobody registered. A governance model that covers half the estate on each side of a SKU boundary is not half-covered. It is uncovered at exactly the point where the two halves meet.
The SKU Map Versus the Estate Map
Vendors segment by where the agent executes. Enterprises are exposed by what the agent touches. Those two taxonomies do not commute.
| Agent surface | Who claims coverage | What they actually see | What they miss |
|---|---|---|---|
| Embedded SaaS agents (M365 Copilot, Einstein, Slack AI, Box AI, Notion AI) | CASB, SSPM, the SaaS vendor’s own admin console | API calls, tenant audit logs, OAuth grants | Anything the agent’s output does after it leaves the tenant |
| Standalone desktop agents (Cursor, Claude Desktop, Cline, Aider, Goose) | EDR, endpoint AI modules | Process trees, some file events | Intent, data classification, MCP-spawned children |
| Local MCP servers over stdio | Nobody, in most estates | Nothing — no TLS to intercept | The entire integration surface |
| Low-code / citizen-built flows (Power Automate, Zapier, internal scripts) | Platform admin center | Flow definitions and run history | Runtime data touched on the executing machine |
| Browser-resident AI | Browser DLP extensions | Typed prompts, pasted text | Every action taken after the prompt resolves |
| Model-vendor-native governance | Anthropic, OpenAI, Microsoft, Google | Their own platform, thoroughly | Every competitor’s agent in the same estate |
Each row is legitimate coverage of a real surface. Stack them and you do not get a control plane — you get five partial inventories with no shared identity graph and five separate answers to “did this agent open the payroll folder.”
Let’s step back. In markets terms, this is basis risk. Each hedge is well-constructed against its own reference instrument. The residual — the part nobody’s hedge is written against — is the seam. And basis risk is the kind that shows up all at once.
Anatomy of a Seam Failure
The failures we see in the signature pipeline rarely start with a compromised agent. They start with an authorized one crossing a boundary no single tool was scoped to watch. The pattern is consistent enough to enumerate:
- A user grants an embedded agent broad OAuth scope. Rational — it inherits the user’s existing permissions, so no new access is technically created. The SSPM logs the grant and marks it sanctioned.
- The agent produces a derivative artifact. A summary, an export, a generated CSV. Classification does not survive the transformation; the Purview label on the source does not attach to the output.
- The artifact lands on local disk. Downloads folder, synced drive, a repo working directory. The SaaS audit log ends here. It has no visibility past the tenant border.
- A local agent picks it up. A coding assistant indexes the working directory, or an MCP server with filesystem scope reads it as context. The EDR sees a known-good binary reading a file — nothing anomalous by its model.
- Egress happens under a legitimate process. The local agent calls its model provider. To the proxy this is normal traffic from an approved application to an approved domain.
- Reconstruction is impossible after the fact. Three tools each hold one-fifth of the chain, correlated by nothing stronger than a timestamp and a username.
No step in that sequence is a violation of any individual policy. The exposure is created entirely by the transitions between steps — the places where the SKU boundaries sit.
Pricing the Seam
If you want the seam on a risk register rather than in a slide, it has to be measurable. The frame we use borrows directly from operational risk: exposure is frequency times severity, adjusted for how much of the path you can actually see.
Seam Exposure = (Crossing Frequency × Data Sensitivity) × (1 − Correlation Coverage)
| Factor | What it measures | How to source it |
|---|---|---|
| Crossing Frequency | How often artifacts move between an embedded agent and a local one, per user per week | Endpoint file-provenance events; download-then-open sequences |
| Data Sensitivity | Classification weight of the artifacts crossing (public → regulated) | Existing MIP/Purview taxonomy, applied at the kernel rather than the tenant |
| Correlation Coverage | Fraction of the chain reconstructable under one identity graph | Count the tools required to answer one question end-to-end; the reciprocal is your coverage |
The third factor is the one most programs never compute, and it is the one that dominates. If Correlation Coverage is 0.2 because five tools each own a fifth of the chain, you are carrying 80% of your gross seam exposure unhedged regardless of how good any individual tool is. Buying a sixth partial tool moves that number very little. Resolving the five to a single identity graph moves it a lot.
What Closing the Seam Actually Requires
The layer that spans every row of the earlier table is not a SaaS API and not a network egress point. It is the operating system, because that is the only place where an embedded agent’s output and a local agent’s input become the same object.
| Control point | Embedded SaaS agent | Local / desktop agent | Shared at the kernel? |
|---|---|---|---|
| Identity resolution | Tenant user ID | OS user + process token | Yes — resolvable to one principal |
| File access | Invisible past tenant border | Visible per-handle | Yes — every read hits the same syscall path |
| Data classification | MIP label in metadata | Label often stripped | Yes — label can be enforced on the handle, not the header |
| Egress | Vendor-to-vendor, invisible | Process-attributable | Yes — socket ownership is a kernel fact |
| Intervention | Revoke grant, after the fact | Terminate or contain, in-line | Only at the kernel |
Two distinctions worth being precise about, because they get collapsed in vendor language:
- Attestation versus assertion. A tenant audit log asserts that an agent was invoked. Kernel evidence attests that a specific process opened a specific labeled file and what verdict was applied. Auditors under the EU AI Act, NIST AI RMF, and SOC 2 are converging on the second.
- Copy-on-write versus block-on-deny. Blocking the local agent from the derivative artifact stops the work and gets the control ripped out within two quarters. Redirecting it to a sandboxed copy lets the work proceed while the original stays where policy says it stays. Enablement survives political review; prohibition does not.
To be clear about scope: this does not replace your SSPM, your CASB, or the SaaS vendor’s own admin controls. Those govern their surface better than anything sitting below them can. The argument is that the correlation and enforcement layer has to be neutral and has to sit lower than any of them — because no vendor whose product map is their org chart will ever own the seam between two of their own SKUs, let alone between theirs and a competitor’s.
What CISOs Should Do This Quarter
| Step | Action | Output | Effort |
|---|---|---|---|
| 1 | Inventory embedded agents by tenant, then desktop agents by endpoint — separately, on purpose | Two lists, and a visible count of users appearing on both | ~1 week, zero install |
| 2 | Trace one artifact end to end: SaaS agent output → download → local agent read → egress | A measured Correlation Coverage number for your estate | 2–3 days |
| 3 | Ask every incumbent vendor, in writing, which SKU covers the crossing — and when | A documented gap you can take to procurement instead of a verbal assurance | 1 call each |
| 4 | Pilot kernel-level enforcement on the highest-crossing team, in copy-on-write mode | Attestable evidence for the crossings, no workflow breakage | 2 weeks |
Step 2 is the one that changes the budget conversation. A director who has been told the estate is covered reacts differently to a Correlation Coverage of 0.2 than to any slide about agent risk in the abstract.
The Bottom Line
Your governance coverage is not the sum of your vendors’ coverage — it is the weakest transition between them, and every vendor prices that transition as somebody else’s module. The embedded agent and the local agent are not two problems; they are one artifact moving across a boundary that exists only on a price sheet. Vendors will keep segmenting by execution surface because that is how they are organized, and enterprises will keep being exposed by data surface because that is how work actually happens. The layer that reconciles the two has to be neutral, has to be lower in the stack than any of them, and has to enforce in-line rather than report after the fact. Until you can answer “which agents touched this file today” from one identity graph, you are carrying the seam unhedged and calling it covered.
If your team is sizing this for the next budget cycle, request a working session. We will walk through your environment, measure Correlation Coverage across your embedded and local agent surfaces, and scope a deployment. 90 minutes.
Related: agent firewall · enterprise deployment