MCP, Auth for Agents, and the Standards War Enterprises Can’t Sit Out

Every automation roadmap enterprises are building for 2027 rests on decisions being made about agent standards right now, in 2026. But “the standards war” is really two separate fights, and leaders who treat them as one tend to place the wrong bet at the wrong layer.

The protocol layer, how an agent talks to tools, data, and other agents, is converging fast under neutral, cross-vendor governance. The identity and authorization layer, who is allowed to be an agent and what it can actually touch, is still wide open. That second layer is where the real vendor competition is happening, and where a wrong early commitment is expensive to unwind.

The protocol layer: settled faster than anyone expected

Anthropic open-sourced the Model Context Protocol (MCP) in November 2024 as a standard way for AI systems to connect to external tools and data. A year in, by Anthropic’s own account, MCP had more than 10,000 active public servers and native support inside ChatGPT, Gemini, Microsoft Copilot, Cursor, and Visual Studio Code. On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with Block and OpenAI, and backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg. That single move took the protocol out of any one vendor’s hands.

Google’s Agent2Agent protocol, A2A, covers a different problem: how agents talk to other agents, not tools. Launched in April 2025 with roughly 50 partners, its partner base had roughly tripled a year later according to the Linux Foundation, and version 1.0 added cryptographically signed “agent cards” so one agent can verify who it’s actually talking to, plus a payments protocol backed by more than 60 organizations. Microsoft has built A2A into Azure AI Foundry and Copilot Studio; AWS supports it through Bedrock AgentCore.

MCP and A2A are complementary rather than competing: one connects an agent to its tools and data, the other connects agents to each other. In July 2026, MCP’s most significant spec revision to date became final, a move to a stateless architecture designed to scale on ordinary web infrastructure, alongside authorization tightened to align with OAuth 2.0 and OpenID Connect.

The actual fight: who governs the agent’s identity

If the protocol layer is largely settled, the identity and authorization layer is anything but. This is where platform vendors are competing hardest, because whoever becomes the system of record for which agents exist, what they’re allowed to touch, and on whose authority, effectively owns the governance layer of a customer’s entire automation program.

Microsoft reached general availability for Entra Agent ID in April 2026, extending its existing Zero Trust stack, Conditional Access, Identity Protection, Privileged Identity Management, to agents as first-class, non-human identities. Architecturally, an agent identity in Entra is a specialized service principal with no standing credentials of its own; it draws short-lived tokens through an “agent blueprint” once a human or tenant admin has consented to the relevant scopes. Full coverage, however, requires a Microsoft 365 E7 license, or E5 paired with a separate Agent 365 add-on, a real procurement decision rather than a checkbox.

Okta and Auth0 are pursuing a more protocol-native path. Auth0 shipped “Auth for MCP” in May 2026, and Okta released its own MCP server that enforces least-privilege access at every individual tool call rather than once at session start. Meanwhile, non-human identity specialists, including SailPoint, CyberArk, One Identity, and Veza, are building lifecycle and discovery layers on top of whichever platform an enterprise already runs, arguing that agent governance is really a subset of a much bigger identity problem: non-human identities already outnumber human users across most enterprise environments, by some industry estimates averaging around 45 to 1, and considerably higher in cloud-native environments.

Across all of these platforms, one design question keeps resurfacing. Does an agent act on behalf of a specific human, inheriting that person’s permissions for the duration of a task? Or does it hold its own standing, autonomous identity, independent of any single user session? The first pattern fits copilots and assistants well. The second fits the background, scheduled, and agent-to-agent workflows that most enterprise automation programs are actually racing toward, and it’s the pattern regulators and security teams are watching most closely, because no human is in the loop at the moment of action.

What this means for the roadmap

• 1

  Build on MCP and A2A with confidence. Vendor-neutral governance under the Linux Foundation and near-universal platform support mean this bet is largely de-risked. This is no longer a wait-and-see decision.

• 2

  Don’t hard-wire governance to one vendor’s identity model yet. Entra Agent ID, Okta, and Auth0 are converging on similar concepts, blueprints, scoped tokens, delegation, but licensing, coverage, and default assumptions about on-behalf-of versus autonomous identity still differ enough to matter.

• 3

  Put agent identity on this year’s architecture review, not next year’s. Every new automation touching finance, HR, or customer systems is creating a non-human identity somewhere. The organizations getting this right are inventorying and owning that sprawl before an incident forces the conversation.

Neither contest is really about the technology winning. It’s about who ends up holding the control plane for your agents once both layers settle, and how much of your architecture you’ll need to rebuild if you guessed wrong on the layer that’s still moving.