The Agent Trust-and-Governance Layer Keeps Raising: Reco Adds $55M, Palma.ai Seeds at $1.8M
The infrastructure layer that verifies, constrains, and audits AI agents — the trust layer between frontier labs and financial institutions identified in the prior revision (Baselayer, Outerlimit, Island, Cyera raising $650M+) — kept institutionalizing this week. FinTech Global's Oct 2 roundup covers two more rounds:
- Reco — $55M additional funding, total raised $140M. "Reco, an agentic security company that protects AI agents and the environments they operate in, has closed an additional $55m in funding." AT&T Ventures participated as a strategic investor; Forestay and Quadrille Capital joined as new backers. Reco connects to "hundreds of major AI providers and enterprise applications, among them OpenAI, Anthropic, Microsoft Copilot, Salesforce, ServiceNow and Workday, allowing customers to govern agents inside the tools where they already function" — its "Reco Graph" links agents, identities, applications, permissions, data, and workflows so security teams can trim excessive permissions and kill risky integrations without halting adoption.
- Palma.ai — $1.8M pre-seed (D11Z led; Plug and Play, Deel participated; both investors are also customers). A central control layer for agents across "Claude, Gemini, Microsoft Copilot and custom workflows": administrators set policies through a central console, the platform "checks tool calls against configured policies, blocks unauthorised actions and records activity through an audit trail."
Read for the landscape map: as deployments go write/execute — Robinhood Agents at consumer scale (Robinhood Puts OpenAI and Anthropic Trading Agents in Front of 29 Million Retail Investors), Barclays routing 120,000 emails/day (Anthropic's Finance Footprint Scales Again: Barclays Puts Claude in Front of 16,000 Staff and 120,000 Daily Emails) — every financial institution needs an answer to "who watches the agents?" The capital answer is consolidating fast: identity/authorization (Baselayer, Outerlimit), device/workspace control (Island), data governance (Cyera), and now agent security posture management (Reco) plus lightweight cross-platform policy layers (Palma.ai). Expect the banks' vendor stacks for agent governance to standardize here before regulators mandate one — and expect M&A as the hyperscalers and custodians fill the gap by acquisition.