Agent protocols: what governance gap are teams missing?

TL;DR: MCP, A2A and ACP solve different transport problems, but none of them can express delegated authority, constraint, revocation or approval, and a six-dimension gap analysis scores every protocol at 2 out of 12 or worse, according to Agentic Fabriq. The practical lesson is that protocol maturity is not governance maturity, and the missing layer must sit above the standards themselves.

Editorial analysis by NHI Mgmt Group, based on content published by Agentic Fabriq: “The Agent Protocol Stack in 2026: What MCP, A2A, and ACP Each Solve”.

By the numbers:

• A six-dimension governance taxonomy scores five agent protocols at 2 out of 12 or worse, with voting, dissent preservation and human escalation absent from all five.

Key questions

Q: What breaks when delegated agent authority is not tied to an authenticated device?

A: The trust chain loses its anchor.

Q: Why does protocol adoption not prove governance readiness for AI agents?

A: Adoption shows that teams are installing the standards, not that those standards can enforce policy.

Q: Where should approval for agent actions be enforced?

A: Approval should be enforced in the control plane that every hop must pass through, not inside the protocol itself.

Practitioner guidance

• Define a delegation control plane Centralise who may authorise agent actions, what constraints apply, and when that authority expires, instead of scattering those decisions across protocols and tools.
• Preserve principal correlation across hops Require every agent-to-tool and agent-to-agent transaction to carry a durable link between the human requester and the acting identity, even when the protocol does not standardise it.
• Enforce approval outside the protocol Treat approval as a control-plane state that must be checked before any cross-boundary action executes, because the wire protocol will not do that validation for you.

Bottom line: Agent interoperability is advancing faster than governance semantics, leaving delegated authority and revocation outside the protocol layer.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →