Inteltech
2025 Moved the Constraint From Capability to Authority
Three artifacts from 2025 tell one story. The binding limit stopped being what the model could do and became who was allowed to let it.
Three artifacts from 2025 explain the year better than any trend report. A contract clause that took effect on November 10. A model release in January that reset the price of reasoning. And a credential format that let a software process hold an identity.
None of them is a technology breakthrough. All three are documents. That is the story of the year: the binding constraint moved from what the tool can do to who is allowed to let it do it.
The clause that changed who can bid
On November 10, the DFARS rule that puts CMMC into contracts took effect. I wrote about the mechanics when it landed: the effective date is not the deadline. Nothing switched on that day, and no contractor needed a certificate the next morning. What changed is that a contracting officer can now put a CMMC level in a solicitation and decline to award without it.
The Federal Register notice (opens in a new tab) is short and unremarkable, which is the point. It reads like paperwork. It functions as a gate.
The practical effect landed on the same people it always lands on: the ones who treat a compliance date as a project start. Contractors read November 10 as a deadline and asked what to build. The better reading is that the requirement became possible, and your exposure is set by the programs you sell into, not by the calendar.
A compliance date does not tell you when you must be ready. It tells you when someone can ask.
The price of reasoning collapsed
In January, DeepSeek released R1 and the market repriced the entire question. Nvidia lost roughly $590 billion in market value in a single session, the largest one-day loss in US market history.
The number is the spectacle. The useful part is what it did to budgets. When a capable reasoning model costs a fraction of what the frontier cost the month before, the model stops being the expensive line item in a project. The integration, the data work, and the authorization take that slot.
That repricing did not make adoption easy. It made the argument honest. A project that could not justify itself at the old price could suddenly justify itself at the new one, and then the team discovered what the old price had been hiding: the model was never the hard part. The hard part was the pipeline, the access, and the person who had to sign.
The agent got an identity
Somewhere in the year, an agent stopped being a feature inside an application and started being a principal with its own credential. The federal version of that is the non-person entity identity, which I wrote about here: an agent with a CAC of its own.
That change is bigger than it sounds. An agent with its own identity can be authorized, logged, and revoked. An agent borrowing a human's identity cannot be any of those things, because every action traces back to a person who may not have been awake.
Once an agent holds a credential, the governance question is no longer philosophical. It is the same question you ask about a service account: what can it reach, who approved that scope, and what proves it stayed inside the scope. I have argued elsewhere that the record is the deployable artifact, not the prompt. 2025 is the year that stopped being a niche opinion.
What did not change
The failure modes were the same ones that have been in the field for a decade, and 2025 gave them better cover stories.
Data quality was underestimated by an order of magnitude on nearly every consolidation I saw described publicly. Migrations were scoped as technical projects and then run as organizational change programs, which they always were. Vendors promised simpler exits than they could deliver. Decision authority stayed unassigned until the first conflict, and then the conflict decided it.
The platform migration postmortems are worth reading for the pattern rather than the particulars. The technology is rarely what breaks. What breaks is the assumption that somebody else owns the data model.
The other thing that did not change: an agent that is supervised by reviewing every action is not autonomous, it is a very fast intern. The teams that got value out of agents in 2025 invested in the boundary before they invested in the capability. Circuit breakers, scoped credentials, and an audit trail that a second party can read. Boring work, done early.
What I would watch in 2026
Not predictions. Three things I expect to be load-bearing.
The assessment backlog. CMMC created a certification market that did not exist at scale, and the number of assessors is finite. A backlog becomes a competitive advantage for contractors who certified early and a bidding problem for everyone else.
Agent identity at the directory layer. Once agents have identities, they need lifecycle management: onboarding, scope review, revocation on termination. That is directory work, and most organizations have not extended their directory processes to non-human principals.
The price of a defensible record. If every agent action needs a record that survives an audit, then storage, retention, and review become a real budget line. The teams that price it now will be the ones that can scale.
2025 did not reward the best model. It rewarded the organization that could answer a question about authority in one sentence and produce the evidence for it.
The tooling got better and cheaper. That part was never in doubt. What the year settled is that the ceiling on adoption is set by the paperwork, the identity, and the record. Those are unglamorous things to build, and they are the things that decide whether anything ships.
The engineers who had a hard year were not the ones who could not learn a new framework. They were the ones whose organizations could not decide who was allowed to say yes.