What Compounds
A major vendor just open-sourced the agent governance layer. When your differentiator ships as a free download, you find out what your moat actually was.
Earlier this year Databricks open-sourced an agent “meta-harness” — a project called omnigent, Apache-2.0, up on GitHub. Not a demo. The whole spine.
One interface in front of about fifteen different coding agents, so you can swap the model underneath without rewriting anything above it. A policy engine that evaluates every tool call and returns allow, deny, or ask. A split-plane execution model — a control plane that holds no keys and can’t reach into your network, and a worker inside your network that dials out to it, so the cloud never opens a hole in your firewall. A human approval gate. An event stream you can read.
If you have been paying a vendor for “AI governance,” look closely, because that paragraph is most of what you were paying for. It is now a free download with a permissive license. You can git clone your vendor’s architecture diagram.
This is not a bad thing. It is a clarifying thing. When the layer you thought was your differentiator ships as open source, you get an honest answer to a question that is otherwise very hard to answer about your own product: what was the moat, actually?
The way to find that answer is not to read what the open-source version does. It’s to read what it does not do. And when you do that with this one, two absences jump out. Both of them are about time.
The first absence: a record you can append to is not a record you can prove
The open harness logs. It writes an event stream; you can watch the agent work. That feels like an audit trail, and in a demo it is indistinguishable from one.
It isn’t one. Its own design docs are honest about this: the durable, tamper-evident event log is described as proposed — not built. What exists is append-only by convention. Rows in a database, spans in a tracing tool. A database administrator with ordinary access can alter what the agent “did” on March 17 at 2:14pm and nothing in the system would show the edit.
I’ve written before that the audit log is the tell — that the real question is not does it log but can you believe the log. The open-source harness is now the cleanest possible illustration of the gap. It logs beautifully. It cannot prove the log wasn’t changed after the fact. Those are different products, and only one of them survives a regulator, a carrier, or a plaintiff’s attorney asking the second question. “Append-only” is a design intention. Tamper-evidence — hash-chained, externally anchored, so even the person holding the keys can’t quietly re-seal a forged history — is a guarantee. Convention is not guarantee.
Now the part that cuts against me, because it’s the honest one: building that guarantee is not hard. Hash-chaining a log is a weekend project — it’s what git does, it’s what Certificate Transparency does. There is no secret sauce in tamper-evidence; any competent team that decided it mattered could ship it in a sprint. So don’t mistake it for the moat. The audit is the price of admission — the thing that earns you the right to be trusted to act. Cheap to build, non-negotiable to have, and, on its own, no more defensible than the harness it sits beside. Hold that thought. In a minute it does something more interesting than sit there being provable.
The second absence: it starts from zero every morning
This is the one almost nobody is pricing, and it’s the one I want to spend the rest of this essay on.
The open harness has no memory. It compacts a session — summarize, then forget — and the next session begins from nothing. It ships a key-value store labeled “memory” that isn’t even wired to a tool. There is no place where the system gets better at your operation over time.
Think about what that means in production. It never learns that when this particular client asks to “reset a user’s password,” the ticket almost always also needs the user re-added to a VPN security group, because that’s how this client’s environment is wired. It never learns that this vendor puts the PO number in the footer in six-point type. It never learns that this technician’s edits to the closing note always tighten the same loose phrase, and starts writing it tight. Every one of those is a lesson a competent human employee learns in their first month. The harness re-learns none of them, ever. Every morning it is brand new to the job.
So here is the buyer’s question, and it is a devastatingly simple one to ask on a vendor call:
Is your system measurably better at my operation in month twelve than it was in month one — and can you show me the mechanism?
Watch what happens. A vendor selling you a wrapper around the open harness cannot answer this cleanly, because the honest answer is “it’s the same in month twelve; you’ll re-approve the same exceptions every week forever.” A vendor who has built the thing the harness is missing will answer with a mechanism, and the mechanism is always the same shape: the accept, edit, and reject history is the asset.
Every time a human approves an AI action untouched, that’s a vote of confidence. Every time a human edits it before approving, that edit is a gradient — a labeled correction, the single richest training signal an operation produces, and the one most systems throw on the floor. Every reject is a boundary. A system that captures that stream can do something the harness structurally cannot: it can graduate. It can earn more autonomy on the specific classes of work it has proven itself on — the reversible, low-blast-radius ones — while staying gated, or tightening, on the consequential ones the moment it regresses. The trust isn’t a slider an admin drags. It’s earned, per class, from evidence, and it’s revoked automatically the first time the evidence turns.
That is what compounding looks like in this domain. Not a bigger model. Not a cleverer prompt. A record of every human judgment, structured so the system’s autonomy is a function of its proven track record on your work. The harness runs the work. Memory is what makes the work yours.
And now the weekend-project audit earns its keep. Learning that changes what an agent is allowed to do is dangerous — a system that quietly grants itself more power is precisely what no regulated buyer will ever sign off on. What makes earned autonomy bankable instead of alarming is that every graduation is itself an entry in that provable record: this class of work earned supervised-auto on this evidence, on this date; here is the single reject that demoted it again. The tamper-evident log isn’t a second moat standing next to the memory. It’s the substrate that makes the memory safe to act on. The cheap leg is what makes the expensive one bankable — which is exactly why the audit is worth building even though it isn’t the prize.
And be precise about the expensive leg, because it isn’t a secret algorithm a rival couldn’t build. A competitor who watches it work can rebuild the mechanism in a quarter or two. What they cannot clone is the two years of your team’s corrections on your operation — and the standing to act on them. That makes memory a compounding relationship moat: it accrues inside an account, to whoever has operated it the longest. A cold new sale starts everyone back at zero memory. That isn’t a weakness in the argument; it’s the whole shape of it. It’s the same flywheel that made every durable data business durable — value that can only be earned by time in the seat.
We’ve seen this movie
The shape is not new. Open-source databases commoditized the storage engine, and the moat moved up — to the data you’d accumulated and the operations you’d tuned on top of it. Open-source models commoditized raw inference, and the moat moved up — to the context, the retrieval, the evaluation harness, the last-mile fit. Every time a layer is commoditized, the value doesn’t evaporate. It relocates to whatever sits on top and accumulates.
The agent harness is the storage engine of AI operations. It was always going to commoditize; a major vendor just proved it by giving it away. Now watch how the remaining legs sort by how fast a serious competitor could erase them. The audit primitive: a sprint — table stakes, not a wall. The learning mechanism: a couple of quarters — a head start, not a moat. The accumulated corrections and the governed loop that makes them safe to act on: years, and only inside the accounts you already run. And slowest of all to copy, because it isn’t code at all: who actually operates the thing, on your regulated data, every day. The uncomfortable truth is that the moats sort inversely to how technical they are. The parts that look like the product — the harness, the cryptography — commoditize first. What’s left is data, trust, and the operating relationship. I’ve written a whole essay on that last leg; here it’s enough to say the platforms all agree on the spine now, and now the spine is free, the only argument left is who runs it.
The buyer’s move
If you are evaluating AI-operations vendors this year, price the harness at zero. It’s a commodity; act like it. Then spend your diligence budget on the three things the commodity can’t do, and make each one a live question, not a checkbox:
Show me you can prove this record wasn’t altered — not “we have an audit log,” but the cryptographic mechanism and the external anchor.
Show me the system gets better at my operation over time — the accept/edit/reject loop, and how autonomy is earned from it rather than dialed by an admin.
Tell me exactly who operates this on my data, and who at your company could ever act as me — the operating model and the access model, in names and roles.
A vendor whose differentiator was the harness will get quieter with each question. A vendor built for the world where the harness is free will get more specific.
I run a company built on exactly that bet. That’s my bias and I’ll declare it: we treat the harness as commodity substrate, treat the tamper-evident record as the price of admission rather than the prize, and put the product where the durable value actually went — a memory that earns autonomy from your team’s own corrections, made safe to act on by a record you can hand a regulator, run by a specialist who operates the last mile so your team doesn’t. I would hold that view even if I were selling nothing, because a downloadable meta-harness from a major vendor is the clearest evidence I could ask for that this is where the durable value went.
When your differentiator ships as open source, that isn’t the end of the moat. It’s the moment the moat becomes legible. It tells you, precisely and for free, what you were actually selling — and what you’d better start compounding.