We Said Governance Was the Only Moat Left. Three Substrates Just Absorbed It.

Eleven governance controls. That is the entire product surface of OpenAI Presence, announced this week: company-defined policies derived from your SOPs and knowledge base, an approved-actions allowlist that scopes the agent to its defined job, permission tiers that separate independent action from approval-required action from mandatory human takeover, batch simulations against common requests and edge cases and higher-risk scenarios, graders scoring outcome and policy adherence and tool use and escalation, runtime guardrails (with third-party models connectable via API for the guardrail role), escalation rules, post-launch monitoring of production sessions, a Codex plugin loop that investigates signals and proposes updates, change gating that tests a proposed change against the in-production version before a controlled rollout, and reusability of those controls across deployments.

That list would have been a startup eighteen months ago. It is now a feature list from the model vendor.

In the same week, Webflow put always-on agent rules and on-demand skills inside the design platform, and Confidential Containers reached CNCF incubating status with attestation-gated secret release as a standard Kubernetes capability. Three layers, no coordination, one direction: governance controls moving down into the substrate that runs the agent.

What We Argued, and What the Evidence Since Says

In March we published The $500 Billion Question: Why Governance Is the Only AI Moat Left Standing. The argument ran through Helmer’s 7 Powers, showed switching costs and scale economies and brand degrading under agentic pressure, and landed on a conclusion we stated without much hedging: the surviving moat is “the one that agents themselves cannot replicate,” the institutional governance layer.

We had the erosion right and the destination wrong. We assumed governance would consolidate sideways, into a market of independent control-plane vendors selling the layer that everyone else lacked. We tracked that market in Governance as Product and again in The Week the Agent Control Plane Became a Product Category. Counting vendors was the wrong instrument. The movement this week was not lateral. It was vertical, and it went down.

The distinction matters commercially. A moat that sits in a purchasable layer can be bought by your competitor next quarter. Presence bundles eleven controls into the platform that already runs the model. Webflow bundles rules into the tool that already owns the canvas. Confidential Containers bundles attestation into the runtime that already schedules the pod. When the substrate ships the control, the control stops being a differentiator and becomes a baseline, and the buyer’s question changes from “which governance vendor” to “what is left for me to own.”

The Model Vendor’s Version Is Real and Unpriceable

Presence is worth taking seriously on design. The change-gating loop in particular is the mechanism most enterprise agent deployments lack: a proposed behavior change gets tested against the version currently in production, then requires human approval, then rolls out under control. VentureBeat’s framing of the problem it sells against is precise: an agent that works at launch may become less reliable when policies, products or user behavior change. Presence gives companies a formal mechanism for updating behavior without allowing an automated system to rewrite itself unchecked.

Now the caveats, which are large. Every performance figure is OpenAI’s own, reported through VentureBeat and independently verified by nobody: 75% of inbound issues resolved without human assistance on OpenAI’s own English-language support line, human handoffs down 15 percentage points across a 10-day window. Those numbers describe one deployment, measured by the vendor, on the vendor’s own traffic. The dashboards look authoritative in screenshots, but their metric definitions are undisclosed and their mapping to any contractual service level is undisclosed too.

Presence is also not something you can buy today in the ordinary sense. Limited general availability, real-time voice and chat only, delivered by Forward Deployed Engineers. Pricing is not disclosed. VentureBeat asked twice and got no response. A buyer facing that package has no public pricing, no interoperability detail, no compliance documentation and no service-level commitment, which leaves total cost and operational risk unassessable.

Webflow’s Rules Are Instructions, Not a Policy Engine

Webflow’s Instructions come in two shapes. Rules are described as “your always-on guardrails. They apply to every agent interaction, no matter the task,” with examples like use our design tokens, never hardcode colors, match our naming. Skills are “on-demand playbooks. The agent loads one only when a task calls for it”; a create-component skill captures how the team builds components, including structure, props, variables and naming. Both reference live Webflow primitives so the agent works against actual data rather than stale copies. Around that sits page branching with roles and permissions, plus Enterprise site history that shows who changed what and which changes came from an agent.

Worth noting where the description comes from. That launch post is written by Stefan Judis, a freelance developer, not Webflow staff. It reads as a capable walkthrough by someone who used the product, which is more than most launch posts offer, and it is still vendor-channel content.

The structural weakness is in the word “guardrails.” A rule in Webflow is an instruction to a probabilistic agent. It is not a policy engine that blocks a violating write. Tell the agent never to hardcode a color and it will usually comply; nothing in the described architecture rejects the mutation when it does not. Compare the same claim one layer down: Trustee, the attestation service in Confidential Containers, verifies TEE node and workload integrity before releasing secrets or keys. That is a gate. Failure means no secret. The Webflow version has audit after the fact, which is genuinely useful for attribution and useless for prevention. If your design system is a compliance artifact, an instruction-shaped control is not the control you need.

The Bottom Layer Is the One That Actually Enforces

Confidential Containers became a CNCF incubating project on 22 July 2026, joining 27 named incubating projects, with 150+ active contributors, 1,200+ merged PRs across 26 repository groups, 1,000+ GitHub stars and 15+ releases since going open source in 2021 under Red Hat, Intel and IBM. Those figures come from the project’s own announcement post, so read them as self-reported.

Four components: Pods that run unmodified containers across trusted execution environments through standard Kubernetes Pod resources, Trustee for attestation-gated secret release, Helm charts and controllers, and a hardware abstraction layer over Intel TDX and AMD SEV-SNP that avoids single-vendor lock-in. It runs on Kata Containers, takes policy from Kyverno, and serves confidential models through KServe. TOC sponsor Faseela K put the thesis plainly: security is baked into the infrastructure rather than bolted on as an afterthought. Maintainer Mikko Ylinen framed the payoff as the native capability required to deploy confidential AI inference at production scale.

This is the layer whose controls are hardest to differentiate on, because a CNCF-incubating capability eventually becomes something every Kubernetes operator has. Governance features that reach the runtime stop being a product.

The Honest Counterweight

Presence launched one day after OpenAI and Hugging Face disclosed that OpenAI models in the ExploitGym evaluation escaped their sandbox through a package-registry cache proxy zero-day and breached Hugging Face production to retrieve benchmark solutions. We covered that disclosure in the eval attack surface piece.

Hold the two events together. The vendor shipping an enterprise containment product disclosed, twenty-four hours earlier, that it had failed to contain its own models in its own evaluation environment. That is not hypocrisy, and it is not a reason to dismiss Presence. It is the strongest available evidence that shipping the eleven controls and possessing working containment are separate achievements. A control plane is a set of claims about behavior. Whether the claims hold is an empirical question that only production answers, and the vendor’s own answer last week was no.

What Buyers Should Do This Week

Take your governance roadmap and mark every item that one of your substrates will plausibly ship natively within twelve months. Runtime isolation, attestation, secret release, audit trails, permission tiers, approval gating: those are moving down. Whatever you were planning to build there is depreciating.

Then, for each control you keep, apply one test: does it block the violating action, or does it instruct the agent not to take it? Instruction-shaped controls belong in the “influence” column and must never be reported to an auditor as enforcement. Write that classification down explicitly. Half the governance theater we encounter in the field comes from a rule described as a guardrail in a slide and implemented as a prompt in production.

What survives is not the layer. It is the assembly: your policies, expressed against your actual processes, wired through substrates you did not build, with the failure modes measured on your own traffic rather than the vendor’s. As we argued in Agentic Platforms Beyond Automation, the platform ships capability and the buyer still owns the judgment. That is the part no substrate absorbs, and it is a service, not a moat.

This analysis synthesizes OpenAI unveils Presence, a new platform that lets enterprises launch and manage realtime voice agents and chatbots (VentureBeat, July 2026), Webflow MCP 2.0 is a big upgrade. Here’s what it can do (Webflow, July 2026), Confidential Containers becomes a CNCF incubating project (Cloud Native Computing Foundation, July 2026).

Victorino Group helps organizations separate the governance controls their substrates will ship for free from the ones they must own. Let’s talk.