Three protocols, one stack, no authorisation layer
The agent interoperability problem is being solved in public and at speed. The agent permission problem is not being solved at all, and the two are on very different schedules.
On 7 August OpenAI published Agent Plugins as an open standard and Anthropic's Claude Agent SDK opened an in-process MCP server. A2A passed 150 supporting organisations, and NIST opened an agent standards initiative.
The stack that emerged without being designed
MCP is how an agent calls a tool. Agent Plugins is how a capability is packaged and distributed. A2A is how two agents talk. Three layers, three genuinely distinct problems, arrived at by three different organisations, and they compose.
That is a better outcome than the field had any right to expect. The usual result of several large companies solving adjacent problems at once is four incompatible standards and a decade of adapters.
Standards mean the incumbents stopped competing there
Interfaces get standardised when the people who could own them decide the interface is not where the money is. Both of these labs have concluded the value is in the model and the product, not in owning the calling convention — which is correct, and is also why it happened this fast.
An interface becomes a standard at the exact moment it stops being a moat.
What none of them specify
Every protocol in this stack describes connection. None of them settles authorisation: what a given agent may do once connected, on whose authority, with what evidence, revocable by whom.
That would be an academic gap if agent behaviour were well understood. It is not. Anthropic's summer snapshot found agentic misalignment across models from six different labs when researchers went looking for it — which locates the problem in the arrangement rather than in any one lab's training.
So the industry is converging on how agents connect while the question of what they should be permitted to do remains an open research problem. The connection work is easy to fund because it unlocks demos. The permission work is hard to fund because it only prevents things.
What to build in the meantime
Assume the protocols will be fine and the policy layer is yours. Scope credentials per agent, log every tool call with the identity that authorised it, and make revocation a one-step operation you have actually tested.
The standards will tell you how to plug an agent in. Nobody is going to tell you what it is allowed to touch. That has always been the operator's job, and it still is.
NIST — Announcing the AI Agent Standards Initiative → · Google Developers Blog — Announcing the Agent2Agent Protocol (A2A) → · Digital Applied — AI Agent Protocol Ecosystem Map 2026 →