Arcade and Convey Address AI Agent Governance Gaps

Arcade.dev and Convey announced a combined $98 million in Series A funding this week to address the governance gap preventing enterprise AI agents from reaching production. Arcade.dev secured $60 million on June 15 to build authorization infrastructure, while Convey raised $38 million on June 17 to deploy outcome-oriented AI teammates.

The current enterprise AI deployment cycle faces a significant hurdle where agents perform well in demonstrations but fail to pass internal security and compliance reviews. A 2026 survey of over 900 executives by Gravitee indicates that while 80% of organizations are actively testing agents, only 14.4% successfully deploy them with full IT authorization. This discrepancy highlights a structural failure in how enterprises manage non-human access to sensitive internal systems.

Research from the MIT NANDA initiative involving 300 deployments confirms that 95% of generative AI pilots yield zero measurable financial return for the enterprise. These projects often stall because security teams cannot verify the specific permissions of an agent at the moment of execution. Without a cryptographically verifiable audit trail, legal and compliance departments maintain a default posture of blocking agent access to production data.

The technical challenge involves the lack of granular, per-action authorization for AI agents operating on behalf of human users. Most existing systems rely on static service accounts that grant excessive privileges, creating significant risk if an agent hallucinates or executes an unauthorized command. Arcade.dev aims to solve this by building an authorization layer that enforces just-in-time consent for every individual request.

Arcade.dev co-authored the Model Context Protocol authorization specification alongside Anthropic, Microsoft, and Okta to standardize these interactions. This framework utilizes OAuth 2.1 to ensure that agents acquire scoped, short-lived tokens for specific actions rather than holding standing permissions. By integrating these controls, the platform provides the immutable audit logs required by CISOs to approve autonomous workflows.

Convey focuses on the operational layer by providing AI teammates that own specific back-office outcomes rather than performing isolated tasks. The platform integrates with legacy applications that lack modern APIs, allowing non-technical teams to automate workflows like invoice reconciliation and data reporting. By centralizing identity management and permissions, Convey enables IT departments to maintain oversight while scaling autonomous operations.

The company reports significant efficiency gains, including 23,000 hours saved annually at a large streaming service and a 40% year-over-year EBITDA increase for the transportation provider Savoya. These outcomes demonstrate that when governance is integrated into the workflow, AI agents can deliver measurable financial impact. Convey has processed over one million hours of automated work since its founding in 2025.

The reliance on legacy API wrappers for agentic operations creates a significant technical bottleneck, as these tools were not designed for the speed and frequency of autonomous agents. Platforms that provide native authorization and audit capabilities represent a necessary evolution in the enterprise stack. This shift mirrors the transition in identity and access management that occurred in the early 2010s as cloud adoption forced a move toward granular, user-centric security.

Architects must prioritize systems that decouple model intelligence from the authorization layer to ensure compliance and security. The ability to prove exactly which agent performed which action on a specific resource is now the primary determinant of production viability. Organizations that fail to implement these controls will likely see their agentic AI projects canceled due to escalating risk and lack of measurable business value.

The maturation of the Model Context Protocol and the adoption of standardized authorization frameworks will likely define the next phase of enterprise AI development. Leaders should monitor how these infrastructure layers integrate with existing identity providers to ensure governance. Future success in this space depends on the ability to provide the transparency required for legal and compliance teams to authorize autonomous action at scale.