Agent pilots became agent fleets. Regulators, standards bodies and the large platform vendors all shipped agent-specific governance in the same window. The numbers below set the bar every architecture review should now clear.
Singapore's IMDA published the first governance framework written for agentic AI in January 2026, built on four dimensions: bound the risk up front, keep a human accountable, enforce technical controls, and make end users responsible. It expects every agent to carry a verifiable identity and a trail of who authorized what.
The OWASP Top 10 for Agentic Applications (ASI01 to ASI10) replaced prompt-injection-only thinking with agent failure modes: goal hijack, tool misuse, privilege abuse, memory poisoning, insecure inter-agent messaging, cascading failures and rogue agents.
Microsoft made Entra Agent ID generally available and Google announced Agent Identity plus an Agent Registry. Each agent now gets a registered identity, an accountable owner, a permission boundary and a lifecycle. Agent sprawl is treated the same way service-account sprawl was.
MCP standardizes how an agent reaches tools and context. A2A, at v1.0 under the Linux Foundation and carried in all three major clouds, standardizes how agents delegate to each other across framework and organizational boundaries. Both are the clear direction of travel. Enterprise adoption patterns, security profiles, SDK maturity and operational tooling are still developing, so pin versions and keep a thin abstraction where you can.
MCP's authorization specification is OAuth 2.1 based: protected resource metadata for discovery, resource indicators so tokens are bound to an audience, PKCE on the code flow, audience validation at the server, and an explicit prohibition on passing a received token through to a downstream service. A2A requires HTTPS, credentials in HTTP headers and authorization checks on protocol operations, while leaving the authorization model itself to the implementer.
The accurate formulation. MCP and A2A standardize discovery, communication, and parts of authentication and authorization transport. The enterprise platform still has to enforce business entitlements, delegated authority, data policy and accountability.
NIST's Center for AI Standards and Innovation opened its AI Agent Standards Initiative in February 2026, with agent identity, interoperability and SP 800-53 control-overlay material in development. Treat it as direction of travel rather than a finalized control set, and design so that adopting an overlay later is a mapping exercise rather than a rebuild.
The Digital Omnibus pushed standalone high-risk obligations from August 2026 to December 2027, and to August 2028 for embedded products. The extra runway is useful. Design to ISO/IEC 42001 now and the deadline stops being an event.
OpenTelemetry GenAI semantic conventions are converging on a shared vocabulary for model and agent spans. Agent operations such as invoke_agent and execute_tool remain at Development stability, so cross-vendor interoperability cannot be assumed yet. Adopt the current conventions, pin a version, and define enterprise extensions for policy decisions, approvals, memory, delegation and outcomes.
If you are standing up an agent platform, tightening the controls on one you already have, or preparing for an audit that now includes agents, I am happy to look at it with you.
Tell me where you are with agents and what you are trying to make safe. I reply to every enquiry within two business days.
