In the autumn of 2017, I refused to sign off on a smart contract. The startup called itself TruthChain and promised immutable data provenance. The team wanted a mainnet launch in eleven days to catch the ICO window; I had found five vulnerabilities in the encryption layer that exposed user metadata. I wrote the report, submitted it, and was gone within the month. The token launched anyway. The metadata leaked the following spring.
I mention this not to relitigate an old quarrel but because the same refusal is now being asked of a slower, quieter industry. Reporting this week indicates that Microsoft will offer corporate discounts of up to 50% on Copilot, effective as early as October, timed to a redesigned "super app" that folds AI coding tools and autonomous agent capabilities into a single surface. Certain functions will carry usage-based surcharges.
The story landed during a sideways crypto market, when everyone is hunting for a signal. I am not hunting. I am auditing. What I see is not a discount. What I see is a migration, and the first question any auditor asks of a migration is what is being moved and who is left carrying it.
For context, Microsoft 365 Copilot has carried a list price of $30 per user per month since its enterprise launch. GitHub Copilot Business sits at $19; Enterprise at $39. These are seat prices, the model enterprise software has used for two decades. You pay for a name on a license whether or not that person uses the tool and whether or not the tool returns value. It is a rent on possibility.
That model is now bending. The reported discounts attach to enterprises that commit to large seat volumes and agree to pay extra for specific high-consumption functions. The condition matters more than the number. A 50% discount offered unconditionally is a price cut. A 50% discount offered in exchange for a multi-year volume commitment plus metered overage is a different instrument entirely. It is a migration from rented seats to metered inference, and it should be read the way we read the shift from flat-rate data plans to usage-capped cellular plans: as an admission that the underlying cost is volatile and the supplier would like the customer to share that volatility.
The comparison any analyst will draw is direct. OpenAI sells ChatGPT Enterprise on custom quote. Google bundles Gemini into Workspace at roughly $20 per user per month. Anthropic sells Claude Enterprise on custom quote. Salesforce Agentforce charges per conversation, starting near $2. Everyone is converging on the same insight: the seat is a fiction, and the real unit of account is the task.
The pressure is not imaginary. Google bundles Gemini into the workspace millions already use, which removes the procurement friction Microsoft must overcome. OpenAI owns the developer mindshare and increasingly the consumer one. Anthropic has quietly become the enterprise safe choice for regulated industries. Microsoft's advantage is distribution, and distribution only converts if the price of entry drops far enough to make the decision obvious. Fifty percent is that number.
For those of us who came up through crypto, this is not a novel motion. It is gas. When Ethereum introduced metered execution, it solved a real problem and created a new one: users could no longer predict their monthly cost, and builders could no longer ignore the cost of computation. Microsoft is importing that trade without the philosophical cover. There is no validator set, no block explorer, and no protocol governance to which a customer can appeal when a task runs long and the bill runs high.
The phrase "integrates AI coding tools and OpenClaw-style agent capabilities" is doing heavy lifting, and the term OpenClaw is doing almost none. It appears nowhere in the common AI lexicon as a proper noun, which strongly suggests an approximation of OpenAI Operator or Claude Computer Use — a class of systems that operate a computer rather than merely answer about one. A system that operates is a system that can be operated upon. That is precisely where my audit instincts wake up.
The moment an assistant gains the ability to read your files, send your mail, and transact inside your systems, it stops being a text generator with a pleasant interface. It becomes a principal with delegated authority. Delegated authority is the problem smart contract engineers have been solving — and failing to solve — for a decade.
Consider the properties every agent runtime must have before an enterprise should let it near production data. It needs identity, so the system can distinguish the agent from a malicious process wearing its credentials. It needs a least-privilege model, so that a coding agent cannot quietly read the compensation database. It needs an audit log the agent itself cannot forge or delete. It needs a sandbox whose escape hatches are known and tested rather than hypothetical. It needs a kill switch that a human can reach faster than the agent can retry.
Every one of those requirements belongs to the security chapter of a framework I helped draft in 2024 on ethical staking governance. We were writing about validators, not agents, but the discipline transfers cleanly. The question is never whether the automation is clever. The question is whether the blast radius is bounded.
Here is where the reporting goes quiet. It does not describe the sandbox. It does not say who holds the keys, whether the agent can transact without a human approval step, whether operation traces feed back into training, or what data-residency options exist for European and other regulated customers. Silence in a security review is not a neutral finding. It is a missing control.
I have learned to distrust the calm of a demo. In 2017, the most confident engineer in the room was the one who had never read the encryption layer. In 2026, the most confident vendor is the one whose sandbox has never been red-teamed in public. Solitude is the only auditor that never sleeps.
I have been thinking about how prompt injection deserves a place in the same mental cabinet as reentrancy. Both are attacks that arise not from a broken primitive but from a missing separation between data and instruction. In 2016, the DAO lost roughly $60 million because a function could be called in a way its authors did not anticipate. In 2026, an agent can be instructed — by a webpage it summarizes, a document it reads, an email it processes — to do something its authors did not anticipate. The parallel is not rhetorical. It is structural.
When an agent executes on your behalf and reads untrusted content, the boundary between "content" and "command" is a suggestion. A calendar invite can carry an instruction. A PDF can carry a payload. The agent, trained to be helpful, has no moral or architectural reason to refuse what looks like a task. This is why I keep insisting that the agent runtime is a security product first and an efficiency product second. It is also why the market's breathless coverage of agent capability misses the point. The loudest voice is rarely the most aligned.
Compare this to a proper smart contract audit. When I review a contract, I do not spend most of my time admiring the happy path. I spend it enumerating the external calls, because each one is a trust boundary. An agent is nothing but trust boundaries stitched together with a language model. Every tool it can invoke is an external call. Every document it can read is untrusted input. Every API it holds is an allowance granted to a signer you cannot fully inspect.
There is a reason our industry developed a specific vocabulary for this. We say approve, and we say allowance, and we have learned — painfully — that an unlimited approval is a loaded gun left on a kitchen table. Microsoft's agent will arrive with an interface that makes granting authority look like a settings toggle. That asymmetry — between how casually authority is granted and how consequentially it is exercised — is the central risk of the coming year, and it is barely mentioned in the coverage.
There is a quieter parallel worth drawing. Microsoft's Copilot line has grown fragmented in exactly the way the crypto industry's Layer 2 ecosystem has grown fragmented. There is Windows Copilot, Microsoft 365 Copilot, Security Copilot, GitHub Copilot, and a scattering of preview features wearing different names. Each launched as a bold bet. Together they resemble a crowded subway platform where the announcements are too loud to be useful. The "super app" is an admission that the proliferation confused customers and duplicated effort inside the company.
I have written repeatedly that dozens of Layer 2s competing over the same small base of users is not scaling — it is slicing scarce liquidity into fragments. The same logic applies here. Multiple Copilot surfaces competing for the same enterprise attention is not a portfolio; it is a fragmentation of trust. A buyer who cannot tell which Copilot does what will delay the purchase, and delays compound into renewal risk. The super app is Microsoft's attempt to consolidate the surface before the confusion hardens into a category problem it cannot control.
Consolidation carries its own cost. When every capability funnels through one surface, that surface becomes a single point of failure with a single set of credentials, a single update cadence, and a single security posture. The crypto system that routes everything through one bridge has a name: it is a target. The super app is a bridge between the enterprise and the agent economy, and bridges are historically where the losses concentrate.
Here is where I diverge from the enthusiastic coverage, and where a hard-won lesson from decentralized finance applies. Orderbook-based decentralized exchanges have never displaced centralized ones, and they will not, because market makers will not leave resting quotes on-chain where they can be front-run. Latency is everything, and whoever controls the match controls the market. The same asymmetry governs agent inference.
An agent that must propose, await human approval, and then execute is safe but slow. An agent that runs at machine speed in competitive workflows is fast but unsupervised. Microsoft, by metering usage and discounting seats, is signaling which of these it believes enterprises will choose. It is betting on speed, because speed is where the value and the pricing power live. But speed is also where custody lives. Whoever holds the execution path holds the assets, and an enterprise that outsources its execution path to a third party has outsourced a piece of its sovereignty. That trade may be worth making. It should at least be named.
Liability is the question nobody wants to write into the contract. The Tornado Cash sanctions established a precedent I have argued against since they landed: that writing code can be treated as an act of crime, and that developers of neutral infrastructure can be held responsible for how others use it. The logic has not aged well, and it will not age well when applied to agents. If an autonomous agent, acting inside a corporate super app, moves funds it was not authorized to move or discloses records it was not authorized to disclose, who is liable? The user who clicked a toggle? The model provider? The platform that metered the transaction?
The honest answer is that no one knows, because the frameworks do not yet exist. The EU AI Act imposes transparency and human-oversight duties on high-risk systems. Multiple jurisdictions require model registration and algorithm disclosure. Those regimes assume a clear chain of custody from data to decision. An agent with delegated authority and opaque tool access breaks that chain in ways the current rules do not anticipate. This is not a reason to refuse the technology. It is a reason to make the delegation visible, auditable, and revocable — which is exactly what we learned to demand of smart contracts after the first billion dollars evaporated.
This is the thread that connects the Copilot story to work I have been doing under the name Verifiable Humanhood. If agents are about to act on our behalf at scale, then the first question is no longer "is this content real" but "is this actor human and authorized." We have spent years proving data provenance and hardly any time proving actor provenance. Zero-knowledge proofs let us verify that an actor meets a threshold — that they are a unique human, that they hold a valid credential, that they are permitted to execute a given action — without exposing who they are. That is the infrastructure the agent economy will need and does not yet have.
Without it, the discount and the super app are just a faster way to scale an unresolved identity problem. With it, delegation becomes legible. The difference between those two futures is not model quality. It is whether we build the audit layer before the incident, or after.
There is an economics reading that the coverage has underplayed. A 50% discount is not a marketing decision; it is a distress signal dressed as generosity. When a vendor with a near-monopoly on enterprise distribution drops the price of its flagship AI product by half within the product's first years, the most likely explanation is that adoption is behind internal targets. Seat counts may be growing; active usage may not be. The renewal conversation is where the truth surfaces, and Microsoft is trying to get ahead of it.
The metered surcharge is the escape hatch. If enterprises embrace agents, the usage revenue compensates for the discount. If they do not, Microsoft has still locked multi-year commitments at a price it can defend. It is a hedge, and a clever one, but a hedge nonetheless. I have watched too many protocols announce a fee switch and call it growth to mistake a hedge for a victory.
For institutional readers, the signal to track is not the headline discount. It is the disclosure that follows — seat penetration, active usage, and the share of revenue that comes from metered consumption rather than seats. When those numbers appear in a quarterly filing, the migration will be legible. Until then, it is a rumor with a pricing page.
I keep returning to the winter of 2022, when the collapse of trusted institutions drained me past the point of public conversation. I withdrew for three months and read the classical arguments about trust and decentralization by lamplight, not as theory but as convalescence. What I took from that solitude was not a prediction but a discipline: that resilience is built in the quiet periods, and that the systems worth trusting are the ones that assume the operator will eventually fail.
That discipline is the right lens for this story. The Copilot super app is a bet that a single trusted operator, inside a single trusted platform, will behave. History is not kind to that bet — not in crypto, not in banking, not in software. The systems that survived the last decade of failures were the ones that distributed authority rather than concentrating it and called the concentration a feature until it wasn't.
The contrarian reading, and the one I find most plausible, is that the discount is not primarily about winning customers from Google. It is a defensive moat against OpenAI. Microsoft's partner has become a competitor with an enterprise offering and a consumer brand of its own. Locking enterprises into multi-year Copilot commitments, complete with consumption rails, makes it expensive for them to migrate to the very partner that supplies the intelligence underneath. It is the oldest move in platform strategy: commoditize your complement, then wall the garden while the gate is still cheap. The 50% discount is the price of the wall.
That reframes the entire story. The "super app" is not a product launch. It is a boundary. And boundaries, in both crypto and enterprise software, are where the interesting governance questions get decided — usually by the party with the leverage, usually in passing, usually without a vote. The obvious risk is that the moat hardens into lock-in faster than the security catches up. The less obvious risk is that the same consolidation that makes the agent economy legible also makes it brittle.
The question is not whether Microsoft can build an agent super app. It can. The question is whether the institutions buying it will audit the delegation of authority as rigorously as they audit their cloud contracts, or whether they will sign because the discount was large and the demo was smooth. I will be watching three things in the coming quarters: whether the metering is disclosed with a cost model customers can forecast, whether the agent runtime ships with an auditable permission layer, and whether the discount terms are published rather than whispered to the largest accounts. Those three signals will tell us more about the ethics of a platform than any launch event. Code is law, but conscience is the interpreter. In a market that chops sideways while the hype runs loud, the interpreter is the only position worth holding.