Check the changelog, not the keynote.
MakeOS — the agent governance layer sitting on Make and its Celonis parent — markets four pillars: Discover, Build, Govern, Observe. Now read the shipped column instead. Live today: Make Grid, a topology map of agents and automations, plus a searchable execution log. Not live: agent evaluations, AI spend tracking, OpenTelemetry support, Functions, Endpoints, MCP toolboxes. No published price. Closed beta. Waitlist.
That is the entire product surface. One diagram and one log.
I have audited token contracts with more shipped functionality than that. In 2017 I pulled three ERC-20 contracts apart line by line and found a reentrancy hole in one of them before its public sale. The bounty was 15 ETH. The sale never happened. The lesson held: the only specification that matters is the deployed one. A whitepaper is marketing with better typography. A keynote is a whitepaper with a lighting budget.
So treat MakeOS like a contract. Read what executes. Discount what is promised.
What the four pillars actually contain
Celonis acquired Make in 2024. MakeOS is the integration story. Discover reuses Celonis Process Intelligence, a mature product with years of Gartner Leader placement behind it. Build reuses Make's orchestration engine, already validated across a long tail of low-code operators. Govern and Observe are new — and they are the thinnest two of the four.
The named customer is Stellantis & You, an automotive dealership network. Multi-site, multi-system, process-dense. That profile overlaps Celonis's existing book almost perfectly. It is not "every enterprise agent user," which is what the announcement language implies.
One sourcing flag worth recording: of 24 information points in the launch material, roughly 60% trace back to Make's own channel — customer testimonials hosted on Make's site, Gartner assessments relayed by Make. Independent third-party verification is zero. That is a vendor deck with a reporter's caution layered on top. Discount accordingly.
Three claims that don't survive contact with execution
Look at what the four pillars are made of. Discover, Build, Govern, Observe is a recombination of known technology, not a new agent compute paradigm. MakeOS is composition-level innovation — packaging, not architecture. That is not an insult; packaging is how most enterprise value gets created. But it sets a hard ceiling on defensibility.
The one genuine fork is permissions. Make routes agents as proxies of a human owner. Execution validates against the owning user's role and relationships. Microsoft's Entra Agent ID, Okta, and Salesforce Agentforce all chose the opposite — agents receive independent identity and an independent security gate. Make's choice is deliberate, and it is the only real technical divergence in the stack.
Here is what that costs. An agent that inherits its owner's full permission set violates least privilege by construction. Prompt injection or tool misuse hands you a blast radius equal to that user's entire authority. And when an agent is created by A, invoked by B, and serving C, whose role validates? There is no agent registry anywhere in the material. No registry means no delegation chain to trace. I don't care how clean the topology graph looks; a graph is not an access control model.
Then the gap nobody has covered. Process mining cannot see inside the agent. Celonis's engine runs on structured event logs. An agent's planning path, tool selection, retry logic, and prompt context are not event logs unless someone explicitly instruments them. Discover can tell you which system events an agent fired. It cannot tell you why the agent decided to fire them. Accountability lives entirely in that second question, and it is the question every enterprise buyer will eventually ask.
The same discipline applies to the audit log. Searchable is not tamper-evident. Nothing in the disclosure mentions WORM storage, signing chains, or immutability guarantees. A searchable log is an operations tool. A compliance exhibit needs integrity proof. Those are different products sold to different budget holders.
And then the rollback claim. The CEO states that every action is rollbackable. True rollback is technically impossible once side effects leave the boundary. The email is sent. The order is submitted. The CRM record is mutated. The payment is triggered. What you can build is a compensating transaction — and compensation can fail, or spawn new side effects of its own.
I have run this exact play before. In 2025 I reverse-engineered an AI trading bot protocol advertising 40% annual returns. The execution logic was clean. The hidden slippage costs were not. They erased the advertised edge entirely, and the protocol got suspended after the write-up. Every "guaranteed" mechanism I have ever pulled apart has been an accounting convention dressed as an engineering fact. Rollback is the same species of claim.
One more structural note. Task Mining filters data locally on employee devices. That means endpoint software — distribution, version management, EDR conflict review. Make has no history of shipping endpoint agents, and none of that engineering burden appears in the launch narrative. The governance boundary itself is probably narrower than advertised: an agent-as-proxy model logically requires binding to Make's own identity system. TAM shrinks from "all enterprise agents" to "agents Make customers build inside Make."
The governance tax arrives before the value does
The sharpest observation in the coverage was this — a governance tax gets collected before the enterprise has proven agents are worth anything at all.
Governance and observability are second-order spend. Willingness to pay depends on first-order spend already producing measurable ROI. Right now most enterprise agent programs are still pilots. In a sideways market, budgets are frozen and nobody signs a second-order contract to supervise a first-order experiment that has not reported results yet. The constraint isn't product quality. It's timing.
Which brings up the real threat. It isn't a competitor's feature set. It's bundling. Microsoft can zero-price basic agent governance into existing M365 and Azure agreements — a play already run on Intune, Defender, and Purview. When that happens, governance stops being a category and becomes a line item on an invoice the customer already pays. My read: the refusal to publish pricing may be a direct response to that risk, not an oversight. Observability vendors will feel this first; the identity layer is already owned by the incumbents.
And the honest moat here isn't capability. It's lock-in. Once permission models, audit records, and evaluation baselines settle inside MakeOS, migration costs dwarf migrating a workflow tool. The marketing calls that customer value. I call it a switching cost with better PR. Code is law, but human greed is the bug.
Four checkpoints, one deadline
I watch the blockchain, not the ticker. Applied off-chain, the rule holds: watch the commit log, not the keynote.
Four things to verify before treating the four pillars as a product rather than a pitch deck. Does the audit log ship with signing chains and immutability guarantees? Does an agent registry appear, and does it accept MCP or OpenTelemetry ingress from third-party runtimes? Does pricing publish, and is it seat-based or consumption-based? Does the proxy model gain a subset constraint — agent permissions strictly inside owner permissions?
If none of those land within two quarters, the governance layer is a narrative asset for a parent company's capital story, not infrastructure. Smart contracts don't care about your roadmap. Neither does a buyer's security review.