A2A crossed into production.
Thimble and Bold Penguin describe the first live production-grade external agent-to-agent protocol for insurance placement. Agents can exchange context and execute quoting tasks across enterprise boundaries.
THE SIGNAL THIS WEEK
Agents now negotiate with agents.
The first verified production-grade external agent-to-agent insurance workflow puts autonomous negotiation and execution inside a deliberately bounded control architecture.
Four deployments were announced this week. A fifth, Siemens × Salesforce, is included as a prior-window record captured for completeness.
enterprise deploymentsweek of sep 28
5verified records added
5industries represented
1transacts under bounded authority
4selected signals kept on watch
01 / BRIEF
The control boundary is becoming part of the product.
Five material records were added to this edition: four announced this week and one prior-window catch-up. The strongest signal is not simply more autonomy. It is the appearance of explicit control boundaries inside production architecture: AI agents may reason, discover tools, exchange information, and negotiate, while deterministic systems and licensed humans retain the final authority.
Thimble and Bold Penguin made that pattern concrete in commercial insurance. BNP Paribas described per-agent authentication and least-privilege access. Bumrungrad documented a verify-then-automate rollout with prompt-injection testing and human escalation. Governance is beginning to show up as deployment design—not just policy written after launch.
02 / AUTONOMY
Where the market actually is.
The autonomy ladder separates assistance from authority. Four of the five records added this week reached write, execute, or transact territory.
1
Retrieves + recommends
BNP Paribas × Google Cloud
3
Writes or executes
Jet2 × Adobe · Bumrungrad × Salesforce · Siemens × Salesforce
1
Transacts under bounded authority
Thimble × Bold Penguin
Classification uses only capabilities supported by reviewed sources. Siemens is a prior-window catch-up record; every other item was announced from September 21 through 25.
03 / SIGNALS
What changed this week.
The authority boundary became technical.
Reasoning stays with agents; actuarial rates, exclusions, and statutory tables stay inside Thimble’s deterministic engine; the licensed broker keeps the binding trigger. Policy is expressed in architecture.
Identity is becoming the bank’s control plane.
BNP Paribas says each agent will be authenticated, granted only the resources required for its task, and monitored as it connects to bank systems. Least privilege is moving from principle to agent operating model.
04 / DEPLOYMENTS
Four deployments that matter.
Confirmed facts are separated from analyst judgment. Open questions are not deficiency claims; they identify what public sources do not resolve.
Thimble × Bold Penguin
The first live external A2A insurance workflow
Two enterprise agents autonomously discover tools, communicate, and execute small-business quoting tasks. They structure risk data, resolve missing attributes, calculate rate variables, match carrier appetite, and support straight-through binding for less complex risks.
Why it matters
Agent-to-agent coordination has crossed from protocol discussion into production insurance placement. The deployment also shows how to bound autonomy without removing it.
Controls & open questions
Stated: Rating calculations, exclusions, and statutory tables remain inside Thimble’s deterministic engine; every prompt, deliberation, and data transformation creates an immutable audit trail; a licensed broker retains the binding trigger.
Open: Scope of negotiation authority; evidence presented at the binding trigger; cross-enterprise audit retention; carrier-appetite data governance.
Review sourceBNP Paribas × Google Cloud
A five-year, CIB-first agent program
BNP Paribas will use Gemini Enterprise to build and evaluate agents for corporate credit memos, then expand across sales, trading, research, and structuring. Gemini models will also extend an internal assistant used by more than 65,000 employees.
Why it matters
Europe’s largest bank is making agent identity and least-privilege access part of the deployment language before broad rollout—a control pattern peer banks will be asked to match.
Controls & open questions
Stated: Each agent is authenticated and limited to the resources required for its task; the bank monitors agent connections and interactions; data and workload placement follows existing security and data-governance rules.
Open: Operational cost of identity per agent; which data categories remain off public cloud; control ownership across CIB; audit of agent-connection graphs.
Review sourceBumrungrad × Salesforce
Verify first, then automate
An Agentforce triage agent handles roughly 7,000 patient emails a day: summarizing each message, classifying it, writing the summary to the case record, and routing the case. A second agent answers questions across Salesforce Chat, WhatsApp, and Line.
Why it matters
The hospital documented a practical trust sequence: people checked every classification and routing decision for several weeks before automatic forwarding was enabled.
Controls & open questions
Stated: Guardrails built by the hospital’s AI engineering team; prompt-injection penetration testing; human escalation when uncertain; mandatory business case and measured outcomes for each model or agent request.
Open: Patient-data handling across the email corpus; authority for future draft replies; API scope when medical-record access goes live.
Review sourceJet2 × Adobe
Agents enter the marketing decision layer
Adobe’s CX Enterprise Coworker will determine which destination recommendations, offers, and daily itineraries reach 10 million myJet2 members, using unified customer profiles and custom generative models trained on Jet2 brand assets.
Why it matters
This is not a booking agent. It is an operator-side system making individualized marketing decisions at scale—the kind of deployment where profiling, consent, contestability, and inferred sensitive data become governance questions.
Controls & open questions
Stated: Adobe Brand Intelligence checks generated output against Jet2 brand standards as it moves through production.
Open: Opt-out and human-review mechanics; DPIA posture; use of booking history; controls against inferred special-category data and individualized pricing.
Review source05 / WATCH
Signals below the verification bar.
Not counted as deployments. Each needs a named customer, stronger corroboration, or a concrete production milestone.
Sabre MCP server
Sabre reports roughly 80 travel customers piloting or running agents that book flights and hotels, but names no customers and does not separate pilots from production.
GovCore
An in-app regulatory agent can draft enforcement letters and bulk-update records, including an “Always Approve” mode. No named agency customer has been disclosed.
Walmart Sparky
A governance signal rather than a deployment: Walmart’s CEO said the shopping assistant will not use customer data to set personalized prices.
MortgageMarket
A South African mortgage-origination agent was announced, but the available source is advertorial and lacks the system details needed to verify its authority.
06 / CATCH-UP
One prior-window record.
Siemens × Salesforce was announced September 15 and missed the founding sweep. It is included now for completeness, not presented as a new announcement this week.
R-019Siemens × SalesforceProduction across 132 countries · retrieves · recommends · writes · communicatesSource
Built for evidence, not volume.
The Radar tracks named enterprise deployments in real business workflows. Vendor announcements without named customers, demos, funding news, and ordinary FAQ chatbots do not clear the materiality bar.
- Source hierarchy. Original company, vendor, and regulatory announcements are preferred; publication dates are checked against the source.
- Capability discipline. Retrieves, recommends, writes, executes, communicates, and transacts are marked only where the source supports them.
- Facts versus judgment. “Why it matters” and open questions are analyst interpretation. Stated controls remain separate.
- No deficiency by silence. If a control is not publicly described, the record says “information gap”—never that the organization lacks it.