Protocols, Data Access, Identity, and Coordination | AI Wars of 2026
Connection, authority, and portability. Source-backed analysis from AI Wars of 2026.
Part III — Technologies That Turn AI Into Action
Protocols, Data Access, Identity, and Coordination
In research
A shared connection protocol does not decide who may act, which data they may use, or whether a workflow can move to another host. Those are separate questions, and the evidence answers them at different levels.
Connection standards can reduce integration friction. They do not automatically make authorization, data access, policy, evaluation, identity, or workflow accountability portable.
Big Idea
Shared standards and governed data access can extend an agent's reach. But identity and governance decide whether it can use that access safely in real work.
What a shared protocol establishes
MCP specifies how hosts, clients, and servers connect AI applications to external data and tools. Its July 2026 specification uses self-contained, stateless requests and opt-in extensions. Common message rules can make integration more consistent; they do not make prompts, memory, permissions, or entire workflows portable between hosts. Source 1
Institutional governance is another layer. The Linux Foundation's Agentic AI Foundation announcement identifies founding contributions including MCP, AGENTS.md, and goose. NIST's AI Agent Standards Initiative describes work on industry-led standards, open protocols, security, and identity. The former establishes a foundation and its projects; the latter establishes an initiative. Neither establishes universal adoption or a completed security standard. Source 2 Source 3
Connection does not settle authority
An identity can identify an actor without proving that a particular action is authorized. MLCommons' Agent Reliability Profile prototype illustrates the next question: does actual behavior stay within an asserted policy? Its open-banking demonstration concerns a customer's data-sharing consent. The prototype does not establish production effectiveness or portable consent enforcement. The behavioral-testing distinction is developed in Controlled Action. Source 4
MCP authorization is a transport boundary, not a portable downstream identity. For HTTP transport, its token is issued for the MCP server and must not be accepted or passed through to another resource. A downstream data surface needs its own authorization path Source 1.
Microsoft Graph external connections and Bedrock Managed Knowledge Base both attach access rules to indexed documents, but they document different principal models. Graph requires an ACL on each external item and uses Microsoft Entra identities or external groups. Bedrock can check an application-supplied user ID and optional groups against an ingested document ACL, then expose that ACL to an authorized caller Source 5 Source 6 Source 7 Source 8. The sources do not show a shared identity mapping, consent chain, or runtime proof that one person's document authority survives across both systems.
Provenance answers a different question again. CNIL's Genmod demonstrator maps the lineage of openly published models to help investigate where memorized personal data may persist. It is a regulator's experimental traceability tool, not an access-control mechanism, an enforcement finding, or proof that a derived model carries a particular legal duty. Source 9
The portability test
A convincing portability claim would show a defined workflow moving between hosts while preserving required identity checks, data permissions, consent, and audit records. It would measure the changes and costs needed to do so. The sources here identify parts of that problem; they do not supply that comparison. A common protocol may coexist with substantial host-specific work.
Research outline
- Compare the roles of Model Context Protocol (MCP) and Agent2Agent (A2A) without treating them as interchangeable.
- Map the layers between a protocol connection and a governed action: identity, permissions, policy, evaluation, audit, and recovery.
- Compare governed data-access surfaces — including Microsoft Work IQ and Microsoft Graph — with comparable Google, Amazon, Apple, and Meta ecosystem surfaces without assuming that a connector, API, or permission model is equivalent.
- Test how permission scope, data freshness, retrieval limits, consent, and administrative control affect an agent's practical context.
- Identify named, documented contender implementations and preserve unsupported adoption claims as open questions.
- Test whether a shared standard lowers switching costs or moves strategic control to the host, workflow, or identity layer.
Evidence boundary
This chapter will rely on specifications, primary launch material, API and permission documentation, and explicit implementation records. Partner lists and compatibility claims will not be treated as evidence of production use, workflow portability, equivalent data access, or a settled industry standard.
What will make this chapter publishable
The final chapter needs a source-linked comparison of protocol scope and governed data access, a documented implementation matrix, a security and governance counterargument, and a clear test for any claimed reduction in switching cost.
Sources
Source references
Source 1: Model Context Protocol Specification
Model Context Protocol
Published: 2026-07-28
Current specification for a protocol connecting LLM applications with external data sources and tools through hosts, clients, and servers. The 2026 revision uses stateless, self-contained requests and adds opt-in extensions; standardized integration does not make prompts, memory, identity, authorization, or workflows fully portable.
Source 2: Linux Foundation Announces the Formation of the Agentic AI Foundation
Linux Foundation
Published: 2025-12-09
The Linux Foundation announces the Agentic AI Foundation with founding project contributions including Model Context Protocol, AGENTS.md, and goose. Foundation formation does not establish universal adoption, secure interoperability, or vendor-neutral outcomes.
Source 3: Announcing the AI Agent Standards Initiative for Interoperable and Secure Innovation
National Institute of Standards and Technology
Published: 2026-02-17
NIST’s Center for AI Standards and Innovation announces an initiative focused on industry-led agent standards, open-source protocols, and research on agent security and identity. It is an initiative rather than a finalized standard, an adoption measure, or a demonstration of agent safety.
Source 4: MLCommons Agent Reliability Profile Named a Finalist in Global Agentic Regulator Hackathon
MLCommons
Published: 2026-09-15
MLCommons describes an Agent Reliability Profile prototype: a builder turns institutional documents into an asserted profile, and a validator attempts to falsify it against system behavior. The open-banking consent demonstration is a hackathon entry, not an adopted standard or a measured reliability result.
Source 5: acl resource type - Microsoft Graph v1.0
Microsoft Graph
Published: 2024-07-26
Microsoft's Graph reference defines an access-control entry for an indexed external-connection item. Entries grant or deny access to users, groups, tenant-wide audiences, or external groups; Microsoft Entra identities use object identifiers. This defines an item-level ACL model, not how an MCP caller maps to an Entra identity, a user-consent flow, runtime retrieval behavior, or equivalence with another system's authorization model.
Source 6: externalItem resource type - Microsoft Graph v1.0
Microsoft Graph
Published: 2024-07-22
Microsoft's externalItem reference requires an ACL collection on every indexed external-connection item and describes the item's full-text-indexed content. It establishes that document-level ACLs are part of the indexed-item model. It does not show how an MCP server passes a caller identity to Graph, prove that source permissions remain current after indexing, or establish a common authorization model with another product.
Source 7: CheckIngestedDocumentAcl
Amazon Bedrock
AWS's API reference describes a document-access check against an ingested knowledge-base ACL. A caller with the relevant Bedrock permission supplies a document identifier plus user context containing a user ID and optional group memberships; the operation returns whether that context has access. It establishes a diagnostic API and an application-supplied principal model, not MCP token mapping, every retrieval path's enforcement, correct configuration, or production control effectiveness.
Source 8: GetIngestedDocumentAcl
Amazon Bedrock
AWS's API reference describes retrieval of an ingested document's allow and deny membership lists for access-control troubleshooting. It establishes that the stored ACL can be inspected by an authorized caller. It does not establish that the list matches source-system intent, record an end-user audit trail, or demonstrate portable authorization across a different data surface.
Source 9: IA : la CNIL met à jour son outil de traçabilité des modèles publiés en source ouverte
Commission Nationale de l'Informatique et des Libertes
Published: 2026-08-26
France's data-protection regulator describes an updated version of Genmod, a demonstrator built by its AI service with its digital innovation laboratory and first published in November 2025, which maps the genealogy of openly published models: a model's ancestors and its descendants. The regulator states the point of that mapping directly: where a model has memorised personal data, the tool helps identify others in the same lineage that may have retained it, which bears on how data-protection rights could be exercised. The update adds an English interface, faster graph search, and a weekly automated rebuild from public repository data. It establishes that a regulator is building lineage tooling and why; it is an experiment, not an enforcement action, a finding against any named model, or evidence that derived models carry legal duties.