Golden Data

Issue #4 · May 31, 2026

Signal — Week of May 31, 2026: The audit log became the moat.

Paul Brown Writes Golden Data from Ogden, Utah 5 min read

Every Sunday I look at the news a vendor had to bury inside a different headline to get past investors. This week three of them buried the same one.

Salesforce reported Q1 FY27 on May 27. Agentforce hit $1.2B ARR, up 205% year over year — accelerated from 169% at Q4’s $800M. Full-year guidance raised to $45.9–46.2B. Two weeks ago I called it: AI revenue was becoming a line item. The print came in larger than I’d predicted. The footnote was the actual news.

Snowflake announced it was acquiring Natoma the same morning. Microsoft made Agent 365 operationally required at five custom agents. Three vendors. One week. Same admission. The AI revenue line is real. The governance plane underneath it is the moat. Whoever owns the audit log owns the seat.

What’s actually shipping this week

1. Salesforce printed Agentforce at $1.2B ARR. May 27, Q1 FY27. Up 205% year over year, accelerating from 169% at Q4’s $800M. Revenue $11.1B beat. Full-year guidance raised to $45.9–46.2B. The buried news sits in the pricing footnote: Flex Credits monetizes every standard agent action at 20 credits — roughly $0.10 each. The new Agentforce 1 Edition at $550 per user per month bundles Flex Credits with Data 360 Credits. Every agent action is now a billing event and an auditable one. The buyer’s procurement team gets a renewal column labeled “AI cost per tool call” by Q4.

2. Snowflake acquired Natoma for the agent badge. Announced May 27 alongside Q1 FY27 — revenue $1.39B up 33%, FY27 outlook raised 27% to 31%, stock +37% after-hours. Natoma is an enterprise MCP gateway enforcing identity, policy, and audit at the tool-call level. Founded 2024, led by Pratyus Patnaik, who sold atSpoke to Okta for $79.3M. Cortex Agents and Snowflake Intelligence will route through it at GA. Snowflake didn’t buy a router. They bought the answer to the question the CISO refuses to skip: who is this agent, and what is it allowed to touch.

3. Microsoft made Agent 365 operationally required at five agents. The governance plane launched May 1. The May Copilot Studio release made computer-using agents GA, redesigned the workflow surface, and shipped voice. The framing got loud: Copilot Studio is no longer a low-code chatbot builder, it is a governed enterprise agent platform. The five-agent threshold is a structural trigger every large Microsoft customer crosses by Q3. Governance got priced as a default, not an upsell.

4. The reliability research caught up to the production gap. Three April–May arxiv papers: “Towards a Science of AI Agent Reliability” (Rabanser et al., Princeton, Feb 24). “Beyond pass@1: A Reliability Science Framework for Long-Horizon LLM Agents” (April 1). The Holistic Agent Leaderboard (Kapoor et al., 2026). Convergent finding: a 37% gap between lab benchmark scores and real-world deployment performance, with 50x cost variation for similar accuracy. The reliability gap is the budget conversation. If your eval doesn’t measure consistency under variance, your model spend doesn’t predict your outcome.

What I’d ship in your app this week

Feature one: the agent audit log, as a first-class admin surface. The CISO will not approve the next AI feature without it. Ship the log before the feature. Five fields per event — timestamp, agent identity with OAuth scope, tool invoked, payload classification, outcome. Searchable by user. Exportable to the tenant’s SIEM. No LLM call to render the log itself; the log is the source of truth.

  • Shape. Append-only event stream from the agent runtime. Static render in the admin surface. SIEM export over webhook or S3 drop.
  • Data shape. Cardinality bound to active agent count, not user count. 90 days hot, two years cold.
  • Latency budget. 800ms for the last-24-hours view. 4 seconds for the 90-day filter.
  • Cost ceiling. $200 per month storage envelope for a 5,000-seat tenant. The log pays for itself the first time it clears a security review.
  • Eval. 100 security-review scenarios written by a senior infosec PM, scored on "would the CISO sign off."
  • Two weeks in. A security admin logs in at 50% of paying enterprise tenants. If you don't see it, the placement is wrong — the security team didn't know it shipped.

Feature two: the per-agent cost meter, on the same admin surface. Every Agentforce buyer is now staring at a Flex Credits dashboard. Your buyer wants the same view of your product. Per agent — tokens in and out, tool calls, dollars at the current model and tool prices, monthly run-rate. The finance team adopts it before the AI team does.

  • Shape. Aggregation query, no LLM call. Table plus one line chart. Auto-refresh every 15 minutes.
  • Data shape. Roll up event-stream costs by agent and by user. Keep the raw event for finance audit.
  • Latency budget. 2 seconds for the per-agent view. 6 seconds for the tenant rollup.
  • Cost ceiling. $0.001 per agent invocation in metering overhead. Hard cap on the rollup query.
  • Eval. 80 finance-team scenarios scored on "is this the number you'd put in the next QBR." Re-graded monthly.
  • Instrumentation. Alert when an agent's run-rate crosses 110% of its rolling 90-day average. The signal finance wants is "which agent suddenly got expensive," not "what's our total AI bill."
  • Two weeks in. Three of your top ten finance contacts have bookmarked the page. Below that, the meter is shaped like an engineering dashboard, not a finance tool.

Both ship in two to three weeks with the team you already have. Both are governance infrastructure your buyer will pay for before they buy the next agent. Build them once. The next AI feature ships with a security review that is a year shorter.

Sources

Send me an email and we will talk. If something here landed close to what you're working on, the door is open. No calendar funnel, no pitch deck — I read every note that comes in.

Doing the work rather than deciding what to build? Crafting is the column for that chair.

Email me Read more Signal

← All Signal issues · Drafted with Claude · Edited by Paul Brown