Collaboration's agent race shifted from capability to control — permissions, metering, and access are the new work.

The week in collaboration

The sector's most important move this week was not a new capability but a new obligation: the products building agents spent the week wrapping them in permissions, metering, and access control. Across the 29 products that shipped, the feed logged 17 sparks against 117 improvements — a roughly seven-to-one ratio that describes a sector hardening what it already built rather than inventing. The clearest expression came from GitHub, which co-published Agent Plugins 1.0 with AWS, Anysphere, Microsoft, OpenAI, and Vercel: a plugin written once now runs in VS Code, Copilot CLI, the Copilot app, and any other compatible client, including ones GitHub does not own. It is a bet on a portable interface rather than a captive one.

Underneath that headline, the same pattern repeats at every layer. Notion turned Custom Agents from something you invoke into something that fires on an event, then spent the rest of its releases on the bill and the permission model that make that safe to run on a team. Teable took Skills from a per-user install to an admin-governed catalog with publish, upgrade, rollback, and access controls. Mattermost pushed attribute-based access control from channels out to team membership. The capability race has mostly resolved; the governance race is where the week's work went.

Leaders

GitHub shipped Agent Plugins 1.0 as a cross-vendor standard and paired it with persistent Copilot memory and local-model support through Ollama in the JetBrains client. The weekly model additions — Grok 4.6, Gemini 3.7 Flash — now read as inventory management; the real bet is the agent surface that carries whichever model a developer wants.

Notion added a meeting-note-summarized trigger to Custom Agents, so post-meeting work — updating a tracker, posting a recap, filing tickets — runs with nobody in the loop. The model picker now exposes speed, intelligence, and cost scorecards with a per-request effort dial, pushing the spend decision down to whoever writes the prompt.

Teable made Skills an administered catalog rather than something each user installs, gave admins a full lifecycle to operate it, and tightened personal access token scopes hard enough to start returning 403 to over-permissive integrations. It is the unglamorous work of making an agent layer governable and survivable under load.

Double extended Ask Double past its own boundary: Connections let the assistant read a Slack thread, a Notion page, or a HubSpot record so a question about a client resolves across systems. Every capability release pairs with an access control — role-based restrictions on client properties this week — the pattern of a vendor that knows the objection is liability, not capability.

Document360 replaced its public API rather than extending it. API v3 adds OAuth 2.0 and keys scoped to portal role, content role, and content scope, giving six months of MCP and AI-discoverability work an authorization model the old endpoints never had. Authorization is becoming the shared spine across its API, AI, and reader access.

Wildcards

Simpplr shipped the one product change in a feed otherwise made of thought leadership: a Rewards Store that turns recognition given inside the platform into something an employee can spend or pass on, closing the handoff to a separate rewards tool. It moves recognition from a gesture to a transaction.

CommaFeed is a self-hosted RSS reader whose release notes now read like a security advisory — four consecutive releases narrowing SSRF, javascript: URLs stripped at parse time, local-address blocking flipped to a secure default. It is positioning as a sync backend other apps talk to, adding the Google Reader API alongside Fever while hardening for the assumption that an instance is publicly exposed to untrusted users.

Komga is doing its frontend rewrite in public: NextUI shipped as a beta served at /next next to the existing UI, with the feature gap tracked in an open issue and users opting in by URL. A deliberately cautious migration that will run across several minor versions before the old interface retires.

Themes that compounded

• Agent infrastructure over agent capability: GitHub, Notion, and Teable all spent the week on triggers, portability, and lifecycle rather than new model tricks.
• Access control as the shared spine: attribute-based policies at Mattermost, scoped API keys at Document360 and Teable, and role restrictions at Double.
• Bring-your-own-key is spreading: AFFiNE added workspace BYOK profiles with provider catalogs and credential rotation, keeping the model layer pluggable.
• Self-hosted security is a treadmill: EGroupware and SOGo shipped back-to-back vulnerability batches, most of the churn in their authentication stacks.
• Write-back turns mirrors into control surfaces: Hive now drives Jira workflow transitions from its own list view, and SiYuan promoted its AI Agent and MCP server to stable.

Watch this week

The next moves are legible from what shipped. Notion's Workers beta ending is the sector's nearest dated event, and metered pricing is the likeliest announcement. Teable gave its Skills catalog publishing and access control but no usage reporting, so admin-facing observability is the natural next increment — the same gap Document360 will face as it re-plumbs its MCP server onto v3's scoped keys. Expect GitHub's opt-in OAuth token expiry to drift toward default once adoption data supports it, and its Agent Plugins ecosystem to live or die on clients GitHub does not control.