Agents Will Need Permission

SCALABLE WEEKLY

Agents Will Need Permission

October 25, 2026

Scalable Weekly · October 19–24, 2026

An agent can find a product, fill in a form and prepare a purchase. Completing it means passing through systems that recognize identities, enforce rules and assign responsibility.

Some of this week's capital is flowing towards those systems. Blackwall raised $100 million for web traffic management. Daytona raised $60 million for agent execution environments. Legora and Pigment are funding AI's expansion into professional workflows. Musixmatch bought infrastructure connecting works, owners and rights.

Our reading: as software becomes more capable of acting, the mechanisms that make its actions acceptable become more valuable.

For startups, that creates a practical market: helping customers delegate work while retaining boundaries, traceability and intervention rights. Answer quality still matters. The product must also know when to stop.

IN ONE SENTENCE

When software acts, identities, permissions and rights become infrastructure.

What matters this week

Blackwall — A position in front of the website

Blackwall raised $100 million at a $2.2 billion valuation, led by AVP. The Estonian company, formerly BotGuard, distributes security and traffic management through hosting and cloud providers.

That position matters: requests crossing the layer can be examined before reaching a website. As useful automation grows, the filter must become better at distinguishing legitimate access from abuse.

This is the basis of the agentic-web opportunity. To realize it, Blackwall must show that traffic classification can support additional services providers and their customers will pay for, with benefits that extend beyond its current security offering.

Daytona — An environment for each agent

Daytona announced a $60 million Series B at a $1 billion valuation, led by FirstMark Growth. It is headquartered in San Francisco with Croatian founders: a company with European roots rather than a Croatian headquarters.

Its product provides isolated environments where agents can execute code and use tools. Application builders must consider startup time, persistence, resource separation and costs.

Isolation limits the reach of an error. Authorization for external actions remains a separate problem: a secure environment still needs to work with credentials, operating limits and application controls.

Legora and Pigment — Autonomy enters the budget

Legora raised $550 million at an $8.8 billion post-money valuation; Pigment announced $250 million at $2.3 billion. Pigment's announcement still describes Nvidia's investment as planned.

Legal work and business planning share a constraint: output must enter a process for which someone is accountable. Documents, assumptions and changes need sources, versions and approvals.

Our interpretation is that these products can gain ground by absorbing part of the verification cost. The test is how much supervised work they complete, and how much checking they leave to users, alongside the speed of producing an initial result.

Musixmatch — Rights become operational data

Musixmatch acquired Music Reports, bringing together its data, the Songdex registry and Blokur's licensing platform. The deal was announced on October 19; financial terms were not disclosed.

For the Bologna-based company, the move broadens the product: identify a recording, connect it to a composition and establish ownership and usage conditions.

AI increases the value of those connections because producing or identifying content does not settle the right to use it. The commercial advantage will depend on matching quality and the ability to reduce reconciliation, delays and disputes along the royalty-payment process.

Cognitive Credit — The source must survive the answer

Cognitive Credit completed a $40 million growth investment, led by Summit Partners. Its product combines credit data, models and AI tools; the company describes outputs traceable to their sources. Agentic analysis is among its forthcoming developments.

An analyst can use a number when its origin, reporting period and transformations can be reconstructed. A conversational interface on unreliable data leaves the verification burden intact.

The strategic opportunity lies in lowering the cost of producing dependable evidence. Preserving data provenance can help AI enter institutional workflows without making the user responsible for checking everything from scratch.

Under the Hood

Blackwall — Can a filter become an authorization point?

Blackwall already has a product for a concrete problem: helping website hosts manage requests, bots and attacks. Agents add an opportunity to distinguish valuable automation and apply conditions to its access.

The distance between those functions is the heart of the case. The round funds an existing platform; becoming authorization infrastructure for the agentic web remains a thesis to test. Assessing it starts with what customers install today.

Workflow: deciding before the request arrives

GateKeeper's documentation describes a reverse proxy: a system between the web and a website's server that examines requests and applies controls. Documented capabilities include filtering, rate limits, application-layer attack protection and caching.

A provider can run it within its own infrastructure while using management connected to Blackwall's dashboard. For a small merchant, the service can therefore arrive through an established commercial relationship.

Operating results must be measured in both directions: reducing harmful requests and allowing useful ones through. Blocking an attack and blocking a prospective customer have opposite economic effects.

From recognition to permission

Recognizing that a request comes from software is a first step. Authenticating that software establishes an identity. Verifying delegation determines what a person has allowed it to do.

Consider an agent booking a hotel. Reading availability, creating a reservation and charging a card require different conditions. A verified identity does not, on its own, authorize all three actions.

In the sources reviewed, we did not verify a complete Blackwall chain for agent delegation, authorization and payment. Sitting in front of a website provides a place from which to build one; integration with application systems would determine its usefulness.

Distribution: selling to those who host many customers

The channel model can lower the cost of reaching small websites. A provider integrates technology and offers modules to its customer base using infrastructure, support and billing relationships already in place.

Blackwall can therefore expand distribution through a relatively limited number of relationships. The economic trade-off is dependence on each partner's ability to activate services and support them over time.

The decisive metrics would include conversion from reachable websites to paid services, revenue per partner and partner concentration. Integrations measure a route to market. Commercial quality appears in usage and renewals.

Execution: evidence a provider can buy

A credible commercial evaluation would compare integration costs with three outcomes: reduced server load, avoided incidents and additional service revenue. It should also track legitimate requests lost after controls are applied.

The comparison needs similar periods and conditions, particularly when campaigns and seasonality change traffic. Making that benefit measurable may matter more to sales than adding another feature: it helps providers decide how much to invest and which customers should receive an expanded offering.

Moat and data: learning from the right errors

Observed traffic can improve recognition of attacks and recurring behaviors. Building an advantage requires reliable signals about the outcomes of those decisions.

Was a blocked agent genuinely abusive? Did an allowed request produce a purchase, a cost or fraud? Connecting outcomes to rules may be more valuable than accumulating undifferentiated requests.

The competitive test includes latency, false positives and server load. A stricter model can improve a security metric while damaging a website's business. Defensibility grows when customers obtain a better balance and can verify it.

Economics: protected websites are not all customers

Blackwall's March 2025 announcement already reported more than 2.3 million protected websites and applications and over 100 partners. These are company-reported distribution thresholds, rather than a current count of paying websites.

Understanding the economics would require paid-module conversion, retained revenue share, analysis costs and support costs. We do not have updated consolidated figures for those measures.

The agentic opportunity adds a potential revenue source only when someone purchases the service: identification, condition enforcement or access management. Traffic passing through infrastructure does not automatically confer an economic right to monetize it.

Strategic Positioning: where control will sit

Cloudflare already documents Web Bot Auth, using cryptographic signatures to verify bot and agent identities. Identity can therefore become an interoperable capability available to multiple suppliers.

For Blackwall, a defensible position could involve translating that information into useful rules for providers' customers. Some decisions may instead migrate to APIs, applications or payment systems.

Its product must find the point where it can enforce a decision and demonstrate value. If agent traffic brings economically significant requests, that point becomes more important. Agreements, integrations and paid usage will show who can occupy it.

Key Lessons

WHAT TO LISTEN / READ

Europe's most interesting startup stories. Every week.

No spam. Unsubscribe anytime.

← All issues
🎙️ Scalable Podcast — European startup stories · 🇮🇹 in Italian
Spotify 🎧 Apple