Agentic AI foundation and MCP: what it means for IAM teams

TL;DR: The Linux Foundation’s new Agentic AI Foundation brings MCP, goose, and AGENTS.md under open governance at a moment when more than 10,000 MCP servers and 60,000+ AGENTS.md projects are already shaping agentic development, according to WorkOS. Open governance lowers fragmentation risk, but it also makes authentication, authorisation, and auditability a core identity problem, not just a developer convenience.

NHIMG editorial — based on content published by WorkOS: The Linux Foundation Launches the Agentic AI Foundation and what it means for MCP

Questions worth separating out

Q: How should security teams govern AI agents that use MCP to reach tools and data?

A: Security teams should govern MCP-connected agents as privileged non-human identities with explicit ownership, scoped permissions, and complete telemetry.

Q: Why does open governance change the risk profile for agentic AI infrastructure?

A: Open governance reduces single-vendor dependency, but it also removes the false comfort that a proprietary platform will solve identity, authorisation, or audit problems for you.

Q: What breaks when agent frameworks and instruction files are not lifecycle-governed?

A: What breaks is accountability.

Practitioner guidance

• Inventory every agent-to-tool path Build a register of all MCP servers, agent frameworks, and project-level instruction files that can influence production systems.
• Assign named identities to agentic workloads Do not let shared API keys or unnamed integrations stand in for agent identity.
• Standardise audit evidence across tools Require logs that preserve agent actions, tool calls, and policy decisions across systems rather than inside isolated products.

What's in the full analysis

WorkOS's full research covers the operational detail this post intentionally leaves for the source:

• The announcement context and membership roster that show how the foundation is being positioned across the ecosystem.
• WorkOS's explanation of how MCP, goose, and AGENTS.md fit together in developer workflows.
• The article's discussion of enterprise confidence, regulated industry concerns, and why neutral governance matters for adoption.
• The security implications WorkOS highlights for authentication, authorisation, and audit trails as agent infrastructure matures.

👉 Read WorkOS's analysis of the Agentic AI Foundation and MCP governance →

Agentic AI foundation and MCP: what it means for IAM teams?

Explore further

View Full Forum →  |  NHI Foundation Course →