# Protocols, Data Access, Identity, and Coordination | AI Wars of 2026 > Connection, authority, and portability. Source-backed analysis from AI Wars of 2026. Canonical URL: https://ai-wars.correax.com/chapter/protocols-identity-and-coordination ## Part III — Technologies That Turn AI Into Action ## Protocols, Data Access, Identity, and Coordination ### In research A shared connection protocol does not decide who may act, which data they may use, or whether a workflow can move to another host. Those are separate questions, and the evidence answers them at different levels. Connection standards can reduce integration friction. They do not automatically make authorization, data access, policy, evaluation, identity, or workflow accountability portable. ### Big Idea > **Shared standards and governed data access can extend an agent's reach. But identity and governance decide whether it can use that access safely in real work.** ### What a shared protocol establishes MCP specifies how hosts, clients, and servers connect AI applications to external data and tools. Its July 2026 specification uses self-contained, stateless requests and opt-in extensions. Common message rules can make integration more consistent; they do not make prompts, memory, permissions, or entire workflows portable between hosts. [Source 1]() Institutional governance is another layer. The Linux Foundation's Agentic AI Foundation announcement identifies founding contributions including MCP, AGENTS.md, and goose. NIST's AI Agent Standards Initiative describes work on industry-led standards, open protocols, security, and identity. The former establishes a foundation and its projects; the latter establishes an initiative. Neither establishes universal adoption or a completed security standard. [Source 2]() [Source 3]() ### Connection does not settle authority An identity can identify an actor without proving that a particular action is authorized. MLCommons' Agent Reliability Profile prototype illustrates the next question: does actual behavior stay within an asserted policy? Its open-banking demonstration concerns a customer's data-sharing consent. The prototype does not establish production effectiveness or portable consent enforcement. The behavioral-testing distinction is developed in [Controlled Action](/chapter/controlled-action). [Source 4]() MCP authorization is a transport boundary, not a portable downstream identity. For HTTP transport, its token is issued for the MCP server and must not be accepted or passed through to another resource. A downstream data surface needs its own authorization path [Source 1](). Microsoft Graph external connections and Bedrock Managed Knowledge Base both attach access rules to indexed documents, but they document different principal models. Graph requires an ACL on each external item and uses Microsoft Entra identities or external groups. Bedrock can check an application-supplied user ID and optional groups against an ingested document ACL, then expose that ACL to an authorized caller [Source 5]() [Source 6]() [Source 7]() [Source 8](). The sources do not show a shared identity mapping, consent chain, or runtime proof that one person's document authority survives across both systems. Provenance answers a different question again. CNIL's Genmod demonstrator maps the lineage of openly published models to help investigate where memorized personal data may persist. It is a regulator's experimental traceability tool, not an access-control mechanism, an enforcement finding, or proof that a derived model carries a particular legal duty. [Source 9]() ### The portability test A convincing portability claim would show a defined workflow moving between hosts while preserving required identity checks, data permissions, consent, and audit records. It would measure the changes and costs needed to do so. The sources here identify parts of that problem; they do not supply that comparison. A common protocol may coexist with substantial host-specific work. ### Research outline - Compare the roles of Model Context Protocol (MCP) and Agent2Agent (A2A) without treating them as interchangeable. - Map the layers between a protocol connection and a governed action: identity, permissions, policy, evaluation, audit, and recovery. - Compare governed data-access surfaces — including Microsoft Work IQ and Microsoft Graph — with comparable Google, Amazon, Apple, and Meta ecosystem surfaces without assuming that a connector, API, or permission model is equivalent. - Test how permission scope, data freshness, retrieval limits, consent, and administrative control affect an agent's practical context. - Identify named, documented contender implementations and preserve unsupported adoption claims as open questions. - Test whether a shared standard lowers switching costs or moves strategic control to the host, workflow, or identity layer. ### Evidence boundary This chapter will rely on specifications, primary launch material, API and permission documentation, and explicit implementation records. Partner lists and compatibility claims will not be treated as evidence of production use, workflow portability, equivalent data access, or a settled industry standard. ### What will make this chapter publishable The final chapter needs a source-linked comparison of protocol scope and governed data access, a documented implementation matrix, a security and governance counterargument, and a clear test for any claimed reduction in switching cost. ### Sources - [Source 1]() - [Source 5]() - [Source 6]() - [Source 7]() - [Source 8]() - [Source 2]() - [Source 3]() - [Source 4]() - [Source 9]() ### Source references #### Source 1: Model Context Protocol Specification Model Context Protocol [Open original source]() Published: 2026-07-28 Current specification for a protocol connecting LLM applications with external data sources and tools through hosts, clients, and servers. The 2026 revision uses stateless, self-contained requests and adds opt-in extensions; standardized integration does not make prompts, memory, identity, authorization, or workflows fully portable. #### Source 2: Linux Foundation Announces the Formation of the Agentic AI Foundation Linux Foundation [Open original source]() Published: 2025-12-09 The Linux Foundation announces the Agentic AI Foundation with founding project contributions including Model Context Protocol, AGENTS.md, and goose. Foundation formation does not establish universal adoption, secure interoperability, or vendor-neutral outcomes. #### Source 3: Announcing the AI Agent Standards Initiative for Interoperable and Secure Innovation National Institute of Standards and Technology [Open original source]() Published: 2026-02-17 NIST’s Center for AI Standards and Innovation announces an initiative focused on industry-led agent standards, open-source protocols, and research on agent security and identity. It is an initiative rather than a finalized standard, an adoption measure, or a demonstration of agent safety. #### Source 4: MLCommons Agent Reliability Profile Named a Finalist in Global Agentic Regulator Hackathon MLCommons [Open original source]() Published: 2026-09-15 MLCommons describes an Agent Reliability Profile prototype: a builder turns institutional documents into an asserted profile, and a validator attempts to falsify it against system behavior. The open-banking consent demonstration is a hackathon entry, not an adopted standard or a measured reliability result. #### Source 5: acl resource type - Microsoft Graph v1.0 Microsoft Graph [Open original source]() Published: 2024-07-26 Microsoft's Graph reference defines an access-control entry for an indexed external-connection item. Entries grant or deny access to users, groups, tenant-wide audiences, or external groups; Microsoft Entra identities use object identifiers. This defines an item-level ACL model, not how an MCP caller maps to an Entra identity, a user-consent flow, runtime retrieval behavior, or equivalence with another system's authorization model. #### Source 6: externalItem resource type - Microsoft Graph v1.0 Microsoft Graph [Open original source]() Published: 2024-07-22 Microsoft's externalItem reference requires an ACL collection on every indexed external-connection item and describes the item's full-text-indexed content. It establishes that document-level ACLs are part of the indexed-item model. It does not show how an MCP server passes a caller identity to Graph, prove that source permissions remain current after indexing, or establish a common authorization model with another product. #### Source 7: CheckIngestedDocumentAcl Amazon Bedrock [Open original source]() AWS's API reference describes a document-access check against an ingested knowledge-base ACL. A caller with the relevant Bedrock permission supplies a document identifier plus user context containing a user ID and optional group memberships; the operation returns whether that context has access. It establishes a diagnostic API and an application-supplied principal model, not MCP token mapping, every retrieval path's enforcement, correct configuration, or production control effectiveness. #### Source 8: GetIngestedDocumentAcl Amazon Bedrock [Open original source]() AWS's API reference describes retrieval of an ingested document's allow and deny membership lists for access-control troubleshooting. It establishes that the stored ACL can be inspected by an authorized caller. It does not establish that the list matches source-system intent, record an end-user audit trail, or demonstrate portable authorization across a different data surface. #### Source 9: IA : la CNIL met à jour son outil de traçabilité des modèles publiés en source ouverte Commission Nationale de l'Informatique et des Libertes [Open original source]() Published: 2026-08-26 France's data-protection regulator describes an updated version of Genmod, a demonstrator built by its AI service with its digital innovation laboratory and first published in November 2025, which maps the genealogy of openly published models: a model's ancestors and its descendants. The regulator states the point of that mapping directly: where a model has memorised personal data, the tool helps identify others in the same lineage that may have retained it, which bears on how data-protection rights could be exercised. The update adds an English interface, faster graph search, and a weekly automated rebuild from public repository data. It establishes that a regulator is building lineage tooling and why; it is an experiment, not an enforcement action, a finding against any named model, or evidence that derived models carry legal duties.