Three things builders should know
- Two deals, one signal. On 28 May 2026 Asana closed its $75M acquisition of StackAI, a no-code agent-builder. A day later, on 29 May, Palo Alto Networks completed its purchase of AI-gateway company Portkey. The price for Portkey was undisclosed.
- The stack is splitting. Orchestration and execution (StackAI) and the gateway and security control plane (Portkey) are now treated as separate, independently valuable layers — alongside the model layer and observability. That is the part worth internalising.
- Build-vs-buy just got easier to reason about. When each layer is its own product category, you can decide layer by layer rather than committing to one platform. For most Indian and UK teams the answer is: buy the gateway, buy or assemble observability, and only consider building the orchestration layer.
Before you evaluate a single vendor, draw your own four-layer diagram on a whiteboard — models, gateway and security, orchestration and execution, observability — and mark which layers you already half-own. Most teams discover they have accidentally built a thin gateway inside application code and have no observability at all. That map, not a vendor demo, is where the real build-vs-buy decision starts.
What actually changed at the end of May
Asana acquired StackAI for $75 million, with the deal completing on 28 May 2026. StackAI is a no-code, workflow-oriented agent-builder: it lets companies design, test, deploy and govern AI agents that reach across enterprise systems — ERP, CRM, ITSM and the rest. The typical use cases are the unglamorous but valuable ones: customer support triage, IT service requests, and compliance workflows that previously needed a human to copy data between three systems. Asana's framing is that StackAI becomes the cross-system execution layer of a wider "human-agent OS" — agents and people working the same queues, with Asana as the connective tissue.
The day after, on 29 May 2026, Palo Alto Networks completed its acquisition of Portkey, which it had announced earlier. Portkey is an AI gateway — a centralised control plane that sits in front of the models and tools your agents call, and manages and secures autonomous AI agents. Portkey says it is already processing trillions of tokens per month, which tells you the gateway pattern is not a future bet but a load-bearing piece of plumbing today. Crucially, Palo Alto did not disclose what it paid. Some press coverage put the figure at reportedly around $120–140M, though neither company disclosed terms, so treat that number as a rumour rather than a data point.
Two acquisitions in two days is a coincidence of timing. What is not coincidental is what they have in common: both buyers are betting that a specific layer of the agent stack is now valuable enough to own outright rather than partner for. A productivity company bought the execution layer. A security company bought the control plane. Neither bought a model.
The consolidation wave this sits inside
Zoom out a week and the pattern sharpens. In the week of 18–24 May, the dealmaking ran hot across every layer of the stack. Anthropic acquired Stainless, an SDK-infrastructure company — the layer that makes APIs easy to call. Mistral acquired Emmi AI, which builds physics-aware models. Google DeepMind licensed technology from and hired the Contextual AI team. Meta acqui-hired the Dreamer team. Read alongside the Asana and Palo Alto deals, the message is that no single layer is being consolidated — the entire stack is being bought up, layer by layer, by whoever is strongest in the adjacent business.
For builders this is the useful read: the days of one vendor credibly selling you "the whole agent platform" are ending. The market itself is voting for a layered architecture, because that is how the buyers are organising their acquisitions. If the largest players in the industry think these layers are separable enough to buy individually, your own architecture should treat them as separable too. That is a gift — it means you are no longer locked into one platform's view of the world, and you can swap a model or a gateway without re-platforming.
Acquisitions change roadmaps and pricing. When a security giant buys your AI gateway, expect the gateway to grow enterprise features you may not need — and an enterprise price tag to match. When a productivity suite buys your agent-builder, expect tighter integration with that suite and looser support for anything outside it. If you adopt a newly acquired tool, write down your exit plan before you sign, not after the renewal quote lands.
The agent stack, layer by layer
Here is the stack as the market is now pricing it, with our build-vs-buy call for a typical Indian or UK team shipping agents into production. "Buy" does not mean a single named product — it means do not write this layer from scratch.
| Layer | What it does | Buy or build | Example vendors / patterns |
|---|---|---|---|
| Model layer | The frontier and open-weight models your agents reason with. | Always buy | Anthropic, OpenAI, Google, plus open-weight via a hosted endpoint. |
| Gateway & security control plane | Routing, rate limits, secrets, policy, audit logging, agent identity. | Buy | Portkey (now Palo Alto), other AI-gateway products, model-routing layers. |
| Orchestration & execution | Designing, testing and running multi-step agents across ERP, CRM, ITSM. | Buy for standard flows; build only if your workflows are genuinely unusual | StackAI (now Asana), agent-builder platforms, open frameworks if building. |
| Observability & evaluation | Tracing, cost tracking, eval harnesses, regression detection in production. | Buy or assemble — never skip | Tracing and eval tooling; tie it to your gateway's logs. |
The single most common mistake we see is teams pouring engineering effort into the orchestration layer — because it is the fun, visible one — while leaving the gateway and observability layers as an afterthought. That is backwards. Orchestration logic is where your business differentiation lives, yes, but the gateway and observability layers are where production incidents, runaway costs and compliance failures actually originate. For more on why the gap between a benchmark-passing agent and a production-ready one is so wide, our piece on the 37% benchmark-to-production gap in enterprise agents is worth a read before you green-light any agent project.
A build-vs-buy decision framework
Run each layer through four questions, in order. Stop at the first one that says "buy".
- Is it a commodity? If a dozen vendors sell roughly the same thing — models, gateways — buy. You will never out-engineer a company whose entire business is that layer.
- Is it load-bearing for compliance or security? If getting it wrong means a regulator fine or a breach — the gateway, audit logging, agent identity — buy from someone who indemnifies you and ships the certifications. Retrofitting governance after an incident costs an order of magnitude more.
- Does it encode your differentiation? If the layer is where your specific business logic lives — the precise way your support or claims workflow branches — then building can pay off. This is usually only true of orchestration, and only for unusual workflows.
- Can you staff it for three years? Anything you build, you maintain. If you cannot commit two engineers to a layer for the long haul, buy it and redeploy them onto product.
For an Indian SaaS team deciding whether to stand up an internal agent gateway, this framework usually resolves quickly. The temptation is real — a thin proxy in front of the model API feels like a weekend's work, and it keeps token spend visible. But the moment you need per-agent rate limits, secret rotation, fallback routing when a provider has an outage, and an audit trail that survives a security review, that weekend project becomes a permanent team. Buy the gateway, keep your two engineers on the product that actually wins customers. The same logic that makes self-hosting attractive only at scale applies here; our analysis of Nvidia Rubin's effect on inference unit economics shows how quickly "we'll just run it ourselves" stops pencilling out once you cost in the people.
For a UK enterprise security lead evaluating a Portkey-style governance layer, the calculus runs through the regulatory calendar. EU AI Act transparency obligations and the staggered timelines around general-purpose and high-risk systems mean that auditable logging of what each agent did, with which model, on whose data, is no longer optional — it is the artefact a regulator will ask for. A centralised control plane that records every agent call in one place is the cheapest path to producing that evidence on demand. Building it in-house means you also own the burden of proving it is complete and tamper-evident. For most UK security teams under EU AI Act exposure, that burden alone tips the decision firmly towards buy.
"We built our own gateway because we thought routing was simple. Eighteen months later it had grown a policy engine, a secrets vault and an audit log, and two of us did nothing else. When our auditor asked for a tamper-evident trail of every agent action, we realised we had quietly become a security-software company by accident. We are migrating to a bought gateway this quarter — it should have been the first thing we bought, not the last thing we built."
— Anjali, Verified Builder · Bengaluru, INWant to discuss this with other verified Builders?
Every article on AI Tech Connect is written by or for Verified Builders. Browse profiles, shortlist who you want to hire or collaborate with.
Browse Builders →So — what should you actually do this quarter?
Three concrete moves, in priority order.
- Put a gateway in front of your agents now, before you scale agent count. The Portkey deal is a signal that this layer is maturing into security-grade infrastructure; adopting the pattern early is far cheaper than retrofitting it across forty agents later.
- Buy or assemble observability in the same sprint. If you cannot trace an agent's full call chain and attribute cost per workflow, you are flying blind. Wire it to your gateway's logs so you have one source of truth.
- Be honest about your orchestration layer. If your workflows are standard support, IT and compliance flows, a bought agent-builder like StackAI ships faster and you should not build. Only build orchestration if your business logic is genuinely unusual — and even then, build on an open framework rather than from zero.
The broader pattern here echoes what we have seen in delivery and middleware too: enterprises are increasingly paying for the layer rather than the platform, whether that is OpenAI's forward-deployed-engineering bet on the delivery layer or the new browser-agent plumbing standardising in WebMCP's open browser-agent protocol. The agent stack is becoming modular, and modular stacks reward teams that decide deliberately, layer by layer, rather than buying one vendor's whole story.
Primary sources: Palo Alto Networks' announcement at paloaltonetworks.com, Asana's release via Businesswire, and ongoing coverage at TechCrunch. Terms for the Portkey deal were not disclosed.