Your bank joined the standards body. That is not the same as governance arriving.
On 13 August 2026, at MCP Dev Summit Seoul, the Agentic AI Foundation announced 57 new member organisations over the preceding quarter, taking its total membership to 247. Three joined at Gold level: Alibaba Group, Visa, and Wells Fargo. The foundation, which the announcement describes as "the neutral home where the open standard agentic AI stack is being built", governed four projects at that point: the Model Context Protocol, goose, AGENTS.md and agentgateway. Four days later, on 17 August 2026, Google's Agent2Agent protocol joined as a fifth hosted project. Two of the five protocols in the gap analysis below now sit under the same roof.
Executive Director Mazin Gilbert framed the pattern directly: "Top financial institutions ... recognize that building agents at scale requires neutral infrastructure they can depend on."
That sentence is true and it is worth reading precisely. Infrastructure they can depend on. Not governance they can inherit.
What a protocol actually carries
An interoperability protocol answers a narrow set of questions. How does one system discover what another can do. How is a request framed. What does a response look like. How is identity presented. It is plumbing, and good plumbing is genuinely valuable: it is why an agent built against one vendor's stack can talk to a tool built by someone else without a bespoke integration.
What it does not do is carry the reason an action was permitted.
When your agent asks a counterparty's agent to do something, the protocol conveys the request. It does not convey who authorised it, what mandate it falls under, whether anyone objected, what the objection was, or how a person is reached if the receiving side thinks the request is wrong. Those are not implementation details that got skipped. They are a different category of thing.
The gap analysis
That intuition now has a systematic version. In a paper posted on 30 June 2026, Richard Kang and Yudho Diponegoro assess five agent interoperability protocols, MCP, A2A, ACP, ANP and ERC-8004, against a six-dimension governance requirements taxonomy drawn from organisational theory, multi-agent systems literature and enterprise governance standards. Each protocol's specification is classified against each dimension as Supported, Partial, or Absent.
The result is blunt: "voting and dissent preservation are universally absent across all five protocols, deliberation is absent or at most partial, and no protocol encodes the full set of primitives required for governed agent communities."
Take the six dimensions one at a time, because the pattern is more useful than the headline.
The middle column is the useful one. Every row describes something an organisation already does between humans, with committees, delegations, minutes and escalation paths. The protocols express parts of this. What the assessment found is that none of them expresses the whole set, that voting and dissent preservation appear nowhere at all, and that deliberation is at best partial. The governance layer your organisation actually runs on has no complete counterpart on the wire.
The part that changes the plan
The paper's most consequential move is not the gap matrix. It is the distinction it draws next.
Kang and Diponegoro separate "extensible gaps (addressable through protocol extension mechanisms) from structural gaps (requiring a new architectural layer)", and conclude that "agent community governance constitutes a missing architectural layer above current interoperability standards, not a missing feature within them."
Those two framings produce completely different plans.
If governance is a missing feature, the rational move is to wait. Adopt the protocol now, keep the gap on a register, and pick it up when the specification catches up. Protocol velocity has been high, so a twelve-month wait is not obviously unreasonable.
If governance is a missing layer, waiting is not a plan at all. No version of a transport standard is going to start expressing your delegation model, because that is not what a transport standard is for. The thing you need arrives when you build it, or when a separate category of product emerges to sell it to you, and neither of those is a release note.
This is a familiar shape. It is the same reason approval gates sit inside your own boundary rather than in the tools an agent calls. Gates work because you own both sides of them. The harder problem starts at the edge of what you own.
Why the new members sharpen the point
It matters that August's headline joiners are a payment network and a bank rather than another developer tools vendor.
A regulated adopter cannot treat an agent action as governed simply because it completed. It has to be able to say, afterwards and to someone else, who was permitted to do that, under what mandate, and how the organisation would have known if it were wrong. That is not a feature request about a protocol. It is the ordinary evidentiary burden of operating in a supervised industry, and it does not travel over the wire.
Read the executive quotes with that in mind. Wells Fargo's Chintan Mehta says "We believe open collaboration and interoperability are essential to unlocking the technology's potential while maintaining strong governance, transparency, and accountability." Note the shape of that sentence. Interoperability and governance sit beside one another, joined by "while". One is not folded into the other. Visa's Rubail Birwadker says "the industry needs to create infrastructure that makes these experiences scalable." Neither claims the standards carry an authority model, and it would be a misreading to hear them that way.
The risk is not that anyone at those institutions is confused. It is what happens three layers down, when a delivery team reads "our organisation joined the governing foundation" as an assurance about agent governance rather than about protocol stewardship, and stops asking who authorised anything. The protocol layer consolidating under one roof makes that misreading easier, not harder.
What this is not
Three boundaries, because this argument is easy to overstate.
It is not an argument against the standards. Neutral, widely adopted protocols reduce integration cost and vendor lock-in, and a foundation that reached 247 members in August, including banks, payment networks and cloud providers, is a healthier outcome than five incompatible proprietary stacks. Adopt them.
It is not the connector inventory problem. Knowing which connectors are live in your estate and who owns them is necessary and separate. That question is about what is plugged in. This one is about what the plug can express.
And it is not the audit trail question raised by any single protocol revision. Specifications change, and a change can remove or relocate something you were relying on. That is a maintenance problem with a known shape, and it moves fast: revision 2026-07-28 of the Model Context Protocol, published after the June assessment, made the protocol stateless, removed session identifiers and added trace context conventions. It added neither a voting nor a dissent preservation primitive. The gap analysis is describing primitives that were never there in any version, which is why a diff against last quarter's specification will not find them.
What to build above the wire
Four artefacts, none of which require new technology, all of which have to exist on your side.
- An authorisation record per action class. Not a log line saying an agent called a tool. A record binding the action to the human mandate that permits it: who granted it, over what scope, until when, and where that grant is written down. If an agent takes an action nobody can trace to a mandate, the protocol will still have delivered it flawlessly.
- An objection channel that survives. Somewhere a dissent is recorded and retained, whether it comes from a person, a monitoring rule, or a counterparty. The paper's finding is that dissent preservation is absent from all five protocols, so a raised objection that is only a message in flight is one nobody can produce afterwards.
- A human escalation route, written as a route. Named role, contact path, and the state that person needs to make a decision. An agent stopping is not escalation. It is an absence of activity that somebody has to notice.
- An audit store you own. On your side of the boundary, capturing enough to reconstruct the decision rather than only the traffic. Depending on a counterparty's logs for your own account of what happened is a dependency you will discover the terms of at the worst moment. The same logic applies to where long-running agents actually execute.
TheAICommand works to the Verified Draft Method: de-identify the inputs, ground the model in your own source material, keep a person at the decision point, verify against the primary source, and log what happened. The last two steps are precisely the ones the protocol layer does not carry, which is why they have to be designed rather than assumed.
Do this Monday
- Pick one agent-to-agent interaction you already have. Cross-team counts. Write down who authorised it and where that is recorded.
- Ask what happens to an objection. If a person or a rule objects mid-flow, find out whether the objection is stored anywhere afterwards. In most estates it is not.
- Test the escalation path by using it. Trigger a stop and see how long until a named human knows. Measure it once, honestly.
- Find out whose logs you would rely on. For your most consequential agent interaction, work out whether you could reconstruct it without asking a counterparty. If not, that is a dependency, not an audit trail.
- Take governance off your protocol roadmap. If a register entry says the gap closes with a future protocol version, re-scope it. On this analysis it does not.
Bottom line
Visa and Wells Fargo joining a standards foundation is a real signal about where agent infrastructure is heading, and neutral standards are the right outcome. They are also doing a narrower job than their adopters assume. Across five protocols, voting and dissent preservation are absent everywhere and deliberation is at best partial, and the assessment is that this is a missing layer rather than a missing feature. Authority, objection, escalation and replay are yours to build, above the wire, and no version number is going to deliver them.
References
- Linux Foundation, Agentic AI Foundation Welcomes 57 New Members, Gaining Major Financial Services Players and APAC Leaders, 13 August 2026. https://www.linuxfoundation.org/press/agentic-ai-foundation-welcomes-57-new-members-gaining-major-financial-services-players-and-apac-leaders
- Richard Kang and Yudho Diponegoro, Governance Gaps in Agent Interoperability Protocols: What MCP, A2A, and ACP Cannot Express, arXiv 2606.31498, 30 June 2026. https://arxiv.org/abs/2606.31498
- Agentic AI Foundation, announcement that Agent2Agent is joining the foundation as a hosted project, 17 August 2026. https://aaif.io/blog/a2a-joins-aaif
- Model Context Protocol, specification changelog for revision 2026-07-28. https://modelcontextprotocol.io/specification/2026-07-28/changelog
TheAICommand. Intelligence, At Your Command.
