The Real AI Moat Isn’t the Model. It’s the Permission Slip.

At a Future Science Prize dialogue on November 8, Zhang Ya-qin put a blunt commercial question to Yao Shunyu, Tencent’s chief AI scientist: where is the moat for a model company?

Yao moved the question. The moat, he said, sits mostly in the product layer, not the model layer. The model that is hardest to replace may not be the smartest one. It may be the one that understands a user’s background, draws on proprietary data and context, and has earned enough trust to act. He pointed to WeChat. An AI inside WeChat does not need the strongest model if it knows a user’s calendar, friend relationships, and activity history. A competitor can ship a smarter model and still fail to provide the same service, because it does not know who the user is.

Zhang joked that under this logic Anthropic might not be worth one trillion or two trillion dollars, since models may eventually become commodities. He then told the students not to buy stocks on his advice.

The answer is clean inside Tencent’s walls. It also shows where the wall ends. Yao described who gets to own the user’s context. He did not describe what happens when that ownership becomes a refusal to interoperate.

Xiaowei is the best footnote to Yao’s argument, and its most honest counterexample

WeChat’s Xiaowei began grey testing in June 2026. It sits deep inside WeChat, connects to Mini Programs and payment, and has been treated by brokerage research as Tencent’s best-positioned card in consumer agents: 1.3 billion monthly users, a full service landscape, and context data. It can pull reading records, Moments, location, and saved addresses. In limited entry points it can read chat records. That is a rare deep data opening in WeChat’s history.

The test also showed the other side. A user asked Xiaowei to order two cups of coffee. The exchange ran to fifteen sentences. Xiaowei announced “done” twice. The first time, it had not even selected a delivery address. It runs on WeLM-80B, activating 3 billion parameters per call. Its content understanding and multimodal ability are not first tier. The coffee order did not go through Manner’s official Mini Program. It was routed through JD Delivery or Taobao Flash Sale because the brand had not opened operational permission to Xiaowei.

That detail is more precise than any theory. The product-layer moat is exclusive permission to let an AI touch certain data. A better AI is not the moat. Xiaowei’s model is not strong, and its task execution is not smooth. But as long as WeChat does not open its social graph and payment rails to outside agents, Xiaowei has no real substitute for handling affairs inside WeChat. The moat is permission. Intelligence is not the moat.

The Doubao phone case proved the moat exists, and showed its price

The refusal list after Doubao’s phone assistant ended its 30-day SAEP public notice in October 2026 was a large-scale stress test of Yao’s logic. A total of 155 apps refused Doubao’s screen-automation access. Tencent properties accounted for 66; Alibaba properties, 23. Together they were close to 60 percent. WeChat, Taobao, Alipay, Meituan, Pinduoduo, Didi, and Xiaohongshu all stayed shut. Even DeepSeek, Kimi, and other AI products in the same lane did not open the door.

The reasons were not technical. Pan Helin, an expert at the Ministry of Industry and Information Technology, put it plainly: super apps fear security risk; AI apps fear user loss. Each company is guarding its existing users. In the future, even if permissions open, they will go to in-house AI first. The deeper logic is the traffic loop. In the old model, ad exposure, algorithm recommendation, and transaction conversion all depend on a user opening the app and spending time there. Once an outside agent reads the screen and simulates clicks to compare prices, place orders, and send messages, the platform’s front-end touchpoint is bypassed. Decision rights and service distribution move to the agent.

That makes data closure a dominant strategy for any platform with valuable context. It is not a moral failing or a short-term blunder. Yao is right that the product layer has a moat. What he left out is that the moat is maintained by refusing interoperability. The deeper it gets, the higher the friction coefficient for everyone outside.

DeepSeek Harness is digging a different ditch

Putting Harness and WeChat on the same moat chart hides a basic fact: they accumulate different kinds of context.

WeChat defends relationship and identity context: who you know, where you live, how you pay. That context is expensive to migrate and naturally exclusive. Harness accumulates task and toolchain context. “Everything is a plugin” was its design premise before the first line of code. About 60 percent of users have used third-party plugins; the community has produced thousands of plugins. Harness does not ask users to socialize or pay inside it. It asks them to run daily work—code, documents, research, translation—through its frame, so plugin configurations and long-term memory gradually create switching costs. In under three months it reached 1.54 million daily active users.

For now, the two ditches can run parallel. The conflict appears in one concrete scene: a user wants an agent inside Harness to do something in WeChat. Will WeChat allow it? The Doubao phone case already ran the preview. The answer is likely no. If a “WeChat plugin” demand appears in the Harness community and WeChat refuses on security or commercial grounds, Yao’s product-layer moat turns from competitive advantage into a roadblock between systems.

Tencent is not alone. SAP updated its API policy in 2026 to bar external AI agents from independently calling its APIs; all agent traffic must pass through its own Joule assistant. Salesforce and ServiceNow chose the opposite direction, opening APIs and MCP so outside agents can call deterministic operations. Closure and openness are a strategic fork. Players with the strongest data assets have the strongest incentive to close. Closure is not the only rational endpoint.

So which way do users go?

The answer splits by dimension. One side does not swallow the other.

On relationship and identity, users will keep following apps. Social graphs, payment identity, and fulfillment context are too expensive to migrate, and super apps lock them behind security and commercial reasoning. A third-party personal AI bot that cannot plug into WeChat’s social graph and payment chain will have limited depth in ordinary daily life. “If it cannot connect to products, the personal AI bot is blank” holds on this dimension.

On task and toolchain, an agent can make apps attach to it. If an Agent OS like Harness sinks a user’s work environment deep into its plugin ecosystem, apps will adapt to be called efficiently, the way developers adapt to an operating system today. Alibaba has connected Qwen across Taobao, Fliggy, and Amap. ByteDance has merged Feishu, TRAE, and Coze into Doubao as a unified entry. Both are bets that the demand entry may move. Better to be an efficient execution layer in an agent’s call chain than to guard one plot and wait for the agent to knock.

The tension sits with players who want both relationship context and task context. Tencent will not stop at a social agent. Harness will not stay a local plugin forever. Yao’s judgment does not need to be overturned. It needs a longer time scale. A permission moat can hold one generation of entry. It cannot hold every entry. Super apps are strong when they make decisions for users. They are weaker when users need work completed, because users keep demanding efficiency and control, and that demand keeps producing open agent environments. The route for a third-party bot is not to break down WeChat’s door head-on. It is to build, in a dimension a super app cannot easily close—workflow, professional toolchains, cross-platform task orchestration—an agent environment users cannot route around. Then use that as leverage to negotiate access.

The sequence matters. Build a work environment someone cannot route around first. Then ask for the door. Reverse the order, and you are just another rejected Doubao. Otherwise the next assistant gets the same list: 155 apps, 66 from Tencent, 23 from Alibaba, and a coffee order that never reaches the address.