LoginSign Up
← Back to Collab
Weekly · Collab · Week of May 25, 2026

Agents shift from sidekicks to operators while governance and registry controls ship in lockstep.

agents-as-surfacesgovernance-in-lockstepsupply-chain-hardeningcategory-climbarchitecture-preparation
Y
By Yahya Tür
LinkedIn ↗
Generated 1h agoDrawn from 12 products

The week in collaboration

The biggest directional move this week was agents shedding their assistant framing. Linear shipped Project Slack channels that auto-create a Slack room per project and seat Linear Agent inside it, with an Asks Agent that triages free-form requests, files them as issues, and asks follow-up questions when required fields are missing. Mattermost's v11.7 paired user-created agents (Agents v2.0) and custom AI prompts with granular ABAC in the same cut — an AI surface and an access model expanding together for defense and regulated buyers. GitHub continued routing Copilot users away from picking models themselves, with auto model selection in VS Code now factoring task type, model health, and utilization into the decision. The agent is no longer the feature; it is becoming the surface.

The counterweight was governance and registry hygiene shipping at the same cadence. GitHub took npm staged publishing to GA alongside install-time flags (--allow-file, --allow-remote, --allow-directory) that let consumers gate where dependencies are pulled from — a two-phase release flow rather than publish-and-go. Asana put RBAC Create Permissions into Release Preview a week after View Permissions, gating who can create projects, portfolios, goals, public teams, and read-only links ahead of a June 2 broad rollout. Rocket.Chat's 8.5.0-rc.0 moved OAuth fully server-side with PKCE and CSRF defenses while landing dormant flags that preview 9.0's transport switchover and Babel removal. The pattern: every meaningful AI move this week was matched by a permissions, supply-chain, or transport hardening release somewhere else in the sector.

Leaders

  • GitHub — Staged npm publishing went GA with install-source controls, turning the registry into a review-gated flow. Auto model selection in VS Code now routes by task, continuing the steady trim of user-visible model choices. Issue fields hit public preview for all orgs, pulling planning workflows back toward the platform.
  • Asana — Scheduled Triggers V2 introduced an explicit execution scope so a scheduled rule can operate on existing tasks, not just create new ones — the team frames this as the first step in a broader rules rearchitecture. RBAC Create Permissions followed View Permissions into Release Preview, with the full Enterprise+ rollout dated June 2.
  • Linear — Project Slack channels auto-spin a channel per project and put Linear Agent inside it; the Asks Agent ingests free-form Slack requests and turns them into issues with field validation. Combined with Code Intelligence the prior week, the agent now sits between the customer signal and the engineering work.
  • Mattermost — v11.7 shipped granular ABAC for team admins, custom AI prompts, and user-created Agents v2.0 in one release. The new Mission Assurance Service repositioned Mattermost from product vendor to managed mission partner with proactive environmental intelligence — a revenue-model shift aimed at defense customers tired of the open-a-ticket support model.
  • Rocket.Chat — 8.5.0-rc.0 moved OAuth server-side with PKCE, CSRF state validation, and enforced 2FA over social logins, while an experimental SDK-over-DDP transport and a per-integration skipTranspile flag previewed the 9.0 architecture. A patch bump (rc.1) followed a day later as release-engineering plumbing toward 8.5.0 stable.

Smaller moves filled in around the leaders. Slack released CLI v4.1.0 on top of April's agent-scaffolding 4.0.0, continuing the steady cadence of platform tooling. Hive shipped four Friday improvements at once — timesheet reminders in Workflows, a workspace-wide default Home page, nested filters for List and Kanban views, and combinable Workspace Activity filters in Dashboards — all admin-control polish for larger team rollouts, with no AI bet visible. Zoho Sign added a Colombia-specific compliance launch, extending the geographic-expansion thread. Mumble shipped 1.5.901 as the fourth stable of the 1.5 line, with the same long-standing macOS notarization and gaming-overlay issues called out again.

Wildcards

  • Claap — Deal Report and Company Report arrived as net-new report types that aggregate conversation intelligence around deal and account entities rather than individual meetings. The Meeting Report layout was refreshed alongside. This is the first release where Claap stops being a per-meeting tool; the data graph now climbs into the same pipeline-level rollups revenue teams already consume from Gong.
  • Skedda — Visit Types lets admins define visitor categories with required custom fields collected at invite or check-in, edging the product into Envoy-style visitor management rather than pure desk booking. It pairs with the recent Companion App and Check-in Insights work to close the bookings-vs-actual-presence gap.
  • BookStack — v26.03.5 closed a brute-force vector against MFA plus a PHP dependency refresh — the fifth patch on the 26.03 line since March, all responsibly disclosed with the external researcher named. A reminder that the self-hosted wiki segment's competitive surface is increasingly about the disclosure pipeline, not the feature list.

Themes that compounded

  • Agents as first-class surfaces: Linear's Asks Agent, Mattermost's user-created Agents v2.0, and GitHub's task-routed Copilot all push the agent from sidekick to primary entry point.
  • Governance shipped in lockstep with AI: Asana RBAC, Mattermost ABAC, Rocket.Chat server-side OAuth — permissions retreads landing the same week as the AI moves they are meant to contain.
  • Supply-chain hardening as product: npm staged publishing GA with install-source flags treats the registry like a release pipeline, not a CDN.
  • Architecture preparation in plain sight: Rocket.Chat's dormant SDK-over-DDP and skipTranspile flags telegraph the 9.0 transport switchover before it forces a flag day.
  • Revenue-model and category shifts: Mattermost selling Mission Assurance, Claap pivoting reports onto deals and companies, Skedda creeping into visitor management — three different products climbing up the value stack at once.

Watch this week

The Asana RBAC Create Permissions rollout on June 2 is the most concrete near-term signal: it closes the two-pass permissions retread and will tell us whether the Permissions Management Add-On gets follow-on capability immediately or sits idle. Watch Rocket.Chat for the 8.5.0 stable cut and any motion on the dormant SDK transport flag — flipping it from dormant to default-on is the public marker that 9.0 is close. On the agent side, Linear's Asks Agent will be early evidence of whether autonomous triage actually compresses the customer-request-to-issue path, or whether the field-validation loop becomes its own friction. And GitHub's next Copilot move is worth tracking — the auto-routing plus web-side model-choice trimming both point toward a single managed layer, and the Fix-with-Copilot dialog is the most likely place that surface widens next.