A 2026 enterprise contracting for a third-party AI agent platform is, in almost every case, accepting a vendor-issued non-human identity into its environment with the authority to read, write, transact, and call further agents. Standard 2026 agentic AI master service agreements govern data classes, SLAs, pricing, and exit terms but do not govern the identity primitive the vendor uses for the agent's credentials, the rotation cadence, the customer's right to inventory and audit them, or the vendor's disclosure obligations if a credential class is compromised on the vendor side. The four procurement clauses that close the gap (identity primitive disclosure, rotation cadence and audit right, vendor-side breach disclosure, customer-side revocation control) are absent from the standard MSA templates of every major agentic AI platform reviewed in early 2026 and are present only in customer-redlined versions used by procurement-mature enterprises.
Claim is scoped to the procurement-side instrument for the vendor-issued NHI problem in 2026 agentic AI MSAs. Does not assert that vendors are negligent — most have technically defensible identity practices documented outside the contract. Asserts that the contract layer does not formalise the customer's rights. 60-day review cadence calibrated to procurement cycles. Trigger conditions: (1) any major agentic AI platform publishes a default MSA covering all four clauses — would move toward Partial because the procurement gap is closing structurally rather than per-contract; (2) the OWASP NHI Top 10 or NIST CSF 2.0 publish a vendor-NHI-specific control set — would harden the operational argument and pressure standard MSAs to follow; (3) a published 2026 enterprise breach traceable to a vendor-issued AI agent credential — would either confirm the structural risk or, if the post-mortem points elsewhere, would scope the claim more narrowly; (4) emergence of an enterprise IAM vendor offering that brokers vendor-issued AI agent credentials with the four-clause control set as defaults — would change the operational shape of the customer-side fix.
/holding/AM-167/Embed this claimiframe + oEmbed
The card auto-updates when the claim's status, last-reviewed date, or correction log changes. Embedders never need to refresh — the card is rendered live from the canonical record.
Email-me when AM-167's status, next review date, or correction log changes. One email per change. No newsletter subscription, no other mail.
The claim: A 2026 enterprise contracting for a third-party AI agent platform is, in almost every case, accepting a vendor-issued non-human identity into its environment with the authority to read, write, transact, and call further agents. Standard 2026 agentic AI master service agreements govern data classes, SLAs, pricing, and exit terms but do not govern the identity primitive the vendor uses for the agent's credentials, the rotation cadence, the customer's right to inventory and audit them, or the vendor's disclosure obligations if a credential class is compromised on the vendor side. The four procurement clauses that close the gap (identity primitive disclosure, rotation cadence and audit right, vendor-side breach disclosure, customer-side revocation control) are absent from the standard MSA templates of every major agentic AI platform reviewed in early 2026 and are present only in customer-redlined versions used by procurement-mature enterprises.
About this register
The Reporting register tracks claims published from articles addressed to senior enterprise IT leaders — CIOs, IT directors, heads of platform. Claims are reviewed on a 30–90 day cadence; each review either reaffirms the claim, marks one substantive part as Partial, or marks it Not holding once the underlying evidence has been overtaken.
Recent corrections in Reporting
- AM-008 · Partial · 17 Jun 2026
Source-text figure re-review: Google's 2024 Environmental Report reports a 28% year-over-year increase to 8.1 billion gallons, not the 33% (from a 6.1 billion 2023 base) asserted at publish. The 8.1B 2024 figure and the Microsoft WUE 0.30 L/kWh / 39%-improvement figure are unchanged and verified. Article corrected to 28% and the unsupported 6.1B base removed; the claim text retains the original figure with this correction per the Holding-up protocol.
- AM-132 · Partial · 10 Jun 2026
One of four legs unanchored on re-review. The claim text attributes '12% of deployments clearing 300%+ ROI with 88% at or below break-even at 12-18 months' to the Stanford DEL 2026 Enterprise AI Playbook. Full-text verification on 10 Jun 2026 found no such figure in that source: the playbook (Pereira, Graylin, Brynjolfsson, Apr 2026) studies 51 successful deployments by design and contains no ROI distribution, no 300%-plus cohort, and no break-even measurement point (full finding at AM-029, correction of 10 Jun 2026). The only verified figure carrying the same 12/88 numerals is IDC research with Lenovo (via CIO.com, Mar 2025): roughly 88% of AI proof-of-concepts never reach production and roughly 12% graduate — a pilot-to-production graduation metric, not an ROI distribution. The Gartner 28%, McKinsey 23%/17%, and MIT NANDA 95% legs verify; they support a small high-performing tail and a large struggling body, but none documents the two-peak bimodal shape the claim asserts. Status Up -> Partial.
- AM-129 · Partial · 10 Jun 2026
One of three read-against anchors unanchored on re-review. The claim text cites 'Stanford Digital Economy Lab Enterprise AI Playbook (12/88 bimodal ROI distribution at 12-18 months)' and frames the realistic ROI band around 'the highest-discipline 12% cohort'. Full-text verification on 10 Jun 2026 found the playbook contains no 12/88 distribution, no bimodal ROI shape, and no 12-18-month ROI measurement point (full finding at AM-029, correction of 10 Jun 2026). The claim's core negative finding — no mid-market enterprise has produced a documented +240% ROI in 90 days under audited conditions — is unaffected; the McKinsey State of AI 2025 and MIT NANDA legs verify and continue to support it. The '12% cohort' framing has no verifiable referent. The only verified figure carrying the 12/88 numerals is IDC's pilot-graduation finding (roughly 88% of AI proof-of-concepts never reach production; via CIO.com, Mar 2025), a different metric. Status Up -> Partial.
Reviews coming up in Reporting
- AM-063 · Holding · next +9d (27 Jun 2026)
AI agents executing financial transactions need a four-control bundle (action-approval gates by blast radius, kill-swit…
- AM-061 · Holding · next +9d (27 Jun 2026)
Production agentic-AI costs at scale routinely run multiples of POC projections, and a layered optimisation programme c…
- AM-003 · Partial · next +9d (27 Jun 2026)
GPT-5 Pro's tiered-subscription model forces enterprises to classify problems by computational difficulty — $200/month…