THE AGENTIC PROTOCOL FABRIC

EXECUTIVE BRIEF

Enterprise artificial intelligence is entering a new architectural phase. The initial generation of enterprise AI focused on individual models, copilots, assistants, and task-specific agents. The current phase is increasingly defined by networks of specialized agents that can communicate, discover capabilities, exchange information, delegate tasks, invoke tools, access enterprise systems, and participate in multistep workflows.

This transition redefines the central enterprise question. It is no longer sufficient to ask, "How do we connect AI agents?" The more critical question becomes, "What happens after those agents are connected?" Open protocols are becoming foundational for this evolving environment.

The Agent2Agent (A2A) Protocol reached Version 1.0 on March 12, 2026, establishing a stable open standard for AI agent communication. The Model Context Protocol (MCP) released its 2026-07-28 specification, featuring a stateless protocol core, Multi Round-Trip Requests, header-based routing, cacheable list results, authorization hardening, and a formal extensions framework.

Simultaneously, governance and security research is advancing in areas such as agent identity, authorization, interoperability, and autonomous execution. NIST launched its AI Agent Standards Initiative in February 2026, with explicit pillars covering agent standards, open protocol development, and research into AI agent security and identity. NIST has also published work examining identity and authorization for software and AI agents.

OWASP's 2026 Top 10 for Agentic Applications identifies critical security risks linked to autonomous and agentic AI systems. Singapore's Model AI Governance Framework for Agentic AI provides organizational guidance for responsible deployment, emphasizing that humans remain ultimately accountable.

Therefore, the emerging architectural challenge extends beyond mere agent interoperability. It involves developing an enterprise control architecture capable of connecting: Identity → Context → Policy → Authority → Execution → Evidence. The objective is not to prevent autonomy, but to ensure it is bounded, observable, governed, and accountable.

01 — THE STRUCTURAL SHIFT: FROM AGENTS TO AGENT NETWORKS

Traditional enterprise AI often follows a structure like: User → Application → AI Model → Result. Agentic systems, however, introduce a more dynamic structure: User → Orchestrator → Specialized Agents → Tools → Enterprise Systems.

A more complex environment might involve: Agent A → Agent B → Agent C → Tool → Application → Data → External Service. Each additional interaction introduces a potential boundary. The system must increasingly understand:

• who initiated the objective;
• which agent is acting;
• which agent delegated the task;
• what context influenced the decision;
• which policies apply;
• what authority has been granted;
• what action is permitted;
• what resources may be accessed;
• how long the authority remains valid;
• what happened during execution;
• and what outcome resulted.

This leads to a foundational distinction: "Capability is not authority." An agent may be technically capable of performing an action without being authorized to do so. This distinction becomes increasingly important as agent networks gain access to production systems.

02 — OPEN AGENT PROTOCOLS ARE BECOMING INFRASTRUCTURE

Interoperability is becoming a fundamental requirement for multi-agent architectures. A2A v1.0, released in March 2026, provides an open standard for communication between AI agents. This includes a common semantic model, protocol bindings, and version negotiation, designed to support interoperability across various systems and technology stacks.

MCP addresses another crucial architectural component: how AI applications interact with tools and external systems. The 2026-07-28 MCP specification introduced a stateless protocol core, Multi Round-Trip Requests, header-based routing, cacheable list responses, authorization hardening, and a formal extensions framework.

Together, these developments indicate a significant architectural direction. Agents increasingly need standardized mechanisms to:

• discover capabilities;
• communicate;
• exchange structured information;
• request or obtain authorization;
• invoke tools;
• execute operations;
• receive results;
• and participate in larger workflows.

However, standardized communication only creates the communication foundation. It does not automatically establish organizational trust or business authority. This distinction is critical.

03 — INTEROPERABILITY IS NOT TRUST

An agent protocol can define how systems communicate, but it does not, by itself, answer every enterprise governance question. For example, key questions include:

• **Identity:** Who exactly is this agent?
• **Context:** What information and instructions surround this request?
• **Purpose:** Why is this action being requested?
• **Policy:** Which organizational rules apply?
• **Authority:** What is the agent actually allowed to do?
• **Risk:** What could happen if the action is wrong, manipulated, or misused?
• **Approval:** Does the action require human or organizational approval?
• **Execution:** What system will actually perform the operation?
• **Evidence:** What record demonstrates what happened?

NIST's 2026 AI Agent Standards Initiative explicitly includes agent security and identity as areas requiring further standards and research. Similarly, NIST's work on agent identity and authorization focuses on applying identity and authorization controls to software and AI agents. This points toward a broader architectural principle: "Communication infrastructure must be complemented by control infrastructure."

04 — AUTHORITY MUST TRAVEL WITH CONTEXT

In conventional software, authorization is frequently evaluated at a relatively clear application or service boundary. Agentic systems complicate this model. An agent may receive an objective from another agent, interpret context, retrieve information, select a tool, delegate another task, and ultimately cause an action in an enterprise system.

Therefore, an enterprise needs to understand not only, "Who is calling?" but also, "Under whose authority is the action being performed, for what purpose, under which policy, and within what boundaries?" A useful conceptual representation is: Identity + Context + Purpose + Policy + Authority + Risk + Action. This creates the foundation for bounded autonomy. An autonomous system does not need unlimited authority; it needs clearly defined authority.

05 — CONTEXT IS BECOMING A SECURITY BOUNDARY

Traditional software often treats data as information consumed by an application. Agentic systems introduce another dimension. Context can influence what an agent believes it should do. Context may include:

• user instructions;
• system instructions;
• retrieved documents;
• enterprise knowledge;
• tool outputs;
• messages from other agents;
• memory;
• environmental information;
• external content;
• workflow state.

Not every piece of context should automatically be trusted. A retrieved document may contain instructions. A tool response may contain unexpected data. Another agent may provide an incorrect recommendation. An external system may return manipulated or incomplete information. Therefore, "Context is no longer merely information for the model. It can influence decisions, authority interpretation, and execution." This makes context integrity an important component of agent security.

OWASP's 2026 Top 10 for Agentic Applications provides a globally peer-reviewed framework focused specifically on critical security risks associated with autonomous and agentic AI systems. The practical implication is straightforward: enterprise AI governance must increasingly consider the information that influences an action, not only the model that generates it.

06 — THE EMERGING AGENTIC CONTROL FABRIC

The emerging enterprise architecture can be understood as a set of coordinated control functions, organized into planes:

TRUST PLANE

Responsible for: - identity; - authentication; - authorization; - credentials; - trust relationships; - delegation; - provenance.

COMMUNICATION PLANE

Responsible for: - agent-to-agent communication; - tool communication; - protocol mediation; - capability discovery; - structured message exchange.

OBSERVATION PLANE

Responsible for: - telemetry; - policy decisions; - execution events; - provenance; - anomalies; - outcomes; - operational evidence.

Across these planes, an enterprise can conceptualize a core control sequence: IDENTITY → CONTEXT → POLICY → AUTHORITY → EXECUTION → EVIDENCE. This is not intended to replace MCP, A2A, IAM, API gateways, security platforms, observability systems, or enterprise applications. Instead, it represents an architectural coordination problem: "How can these existing capabilities work together when software systems are increasingly capable of autonomous action?"

07 — SEPARATING INTELLIGENCE FROM AUTHORITY

One of the most important distinctions in autonomous enterprise architecture is: "Intelligence does not equal authority." An AI system may produce a highly useful recommendation, but that does not automatically mean it should execute the recommendation.

A governed workflow may therefore look like: Intelligence → Recommendation → Policy Evaluation → Authorization → Execution → Evidence. For example, an agent may identify a potential procurement opportunity. A second agent may analyze the financial implications. A third system may validate organizational policy. A decision authority layer may determine whether the proposed transaction is permitted. Only then may an execution system perform the authorized action. This separation creates a critical control boundary between what an AI system believes should happen and what the enterprise permits to happen.

08 — DELEGATION BECOMES A FIRST-CLASS ENTERPRISE PROBLEM

Multi-agent systems introduce delegation chains. For example: Agent A → Agent B → Agent C → Enterprise Tool. Agent A may not directly execute an operation. Instead, it may delegate the task to Agent B. Agent B may delegate part of the task to Agent C. Agent C may ultimately invoke a production tool. This creates a new governance requirement: "Delegated authority must remain traceable across the chain."

An enterprise should be able to reconstruct: Origin → Delegation → Authorization → Action → Outcome. The objective is not necessarily to record unrestricted internal reasoning. Instead, enterprises can focus on actionable provenance such as: - identity; - authorization events; - policy decisions; - delegation relationships; - tool invocation records; - execution results; - outcome records.

This produces meaningful evidence without requiring unrestricted exposure of private model reasoning.

09 — FAILURE CAN PROPAGATE ACROSS THE NETWORK

Consider a simplified workflow: Research Agent → Planning Agent → Procurement Agent → ERP Tool. If the research agent produces incorrect information, the planning agent may incorporate it. The procurement agent may then act on that plan. The ERP system may execute the resulting transaction. The original error can therefore propagate through multiple autonomous components. The challenge is not merely detecting a bad model response; it is containing the system-level consequences of that response.

Potential architectural controls include: - bounded delegation; - scoped permissions; - transaction limits; - policy checkpoints; - approval gates; - execution isolation; - sandboxing; - anomaly detection; - rate controls; - circuit breakers; - escalation mechanisms; - emergency intervention.

The objective is not to eliminate every possible failure. It is to ensure that a failure in one component does not automatically become an uncontrolled enterprise-wide action.

10 — OBSERVABILITY MUST FOLLOW THE ACTION

Traditional observability focuses heavily on infrastructure and application behavior. Agentic systems require an additional question: "Why did this action happen, under whose authority, and what did it produce?" A useful enterprise evidence chain is: Identity → Context → Policy → Authority → Execution → Outcome. This allows governance, cybersecurity, IAM, observability, compliance, and enterprise operations to converge around a common operational record. For autonomous systems, observability is therefore not merely about uptime; it increasingly becomes part of governance.

11 — THE AEXOREX CASCADE PROPAGATION RISK MODEL

AexoreX proposes Cascade Propagation Risk (CPR) as an analytical concept for studying how an apparently limited agent action can propagate through delegated capabilities and interconnected enterprise systems. CPR is not an industry standard, regulatory metric, or universally accepted risk formula. It is an AexoreX analytical model intended to support architectural reasoning.

Conceptually: CPR = f(Privilege, Context, Delegation, Detection, Impact). The model asks questions such as: - How much privilege exists at the originating point? - How sensitive is the context? - How many delegation steps are involved? - How quickly can abnormal behavior be detected? - What is the potential downstream impact?

The purpose is not to create a universal numerical score. The purpose is to help architects identify where autonomous workflows could amplify relatively small errors or unauthorized actions into materially larger outcomes.

12 — SIX FUNCTIONAL LAYERS OF AN AUTONOMOUS ENTERPRISE

A mature autonomous enterprise can be viewed through six functional responsibilities:

1. SYSTEM OF RECORD

Where authoritative enterprise data resides. Examples include: - ERP; - CRM; - financial systems; - HR systems; - operational databases.

2. SYSTEM OF INTELLIGENCE

Where models and AI capabilities interpret information and generate recommendations or decisions.

3. SYSTEM OF ORCHESTRATION

Where workflows, agents, tasks, dependencies, and processes are coordinated.

4. SYSTEM OF AUTHORITY

Where policies, permissions, delegation, approvals, and decision rights are defined and enforced.

5. SYSTEM OF EXECUTION

Where authorized actions actually occur.

6. SYSTEM OF EVIDENCE

Where decisions, authorizations, executions, outcomes, and relevant provenance become observable and auditable.

These are functional responsibilities, not necessarily six separate products. The architectural objective is to ensure that intelligence and execution remain connected through explicit authority and evidence.

13 — GOVERNANCE IS MOVING INTO RUNTIME

Traditional governance often emphasizes policies, documentation, assessments, model validation, and periodic review. Agentic systems introduce a more dynamic requirement. Governance increasingly needs to operate during execution. Singapore's Model AI Governance Framework for Agentic AI recommends technical and non-technical measures for responsible deployment and emphasizes that humans remain ultimately accountable. Its May 2026 update added real-world case studies and new best practices.

For autonomous enterprise systems, this creates a practical architecture: IDENTITY → CONTEXT → POLICY → AUTHORITY → RISK → APPROVAL → EXECUTION → EVIDENCE → OUTCOME. This nine-stage sequence is an AexoreX architectural model, not a universal technical standard or regulatory requirement. It extends the core control sequence by making risk, approval, and outcome explicit.

The distinction is useful: - **Core Control Fabric:** Identity → Context → Policy → Authority → Execution → Evidence - **Extended Enterprise Authority Lifecycle:** Identity → Context → Policy → Authority → Risk → Approval → Execution → Evidence → Outcome

The first describes the core control architecture, while the second describes a broader enterprise decision and execution lifecycle.

14 — HUMAN GOVERNANCE DOES NOT DISAPPEAR

Greater autonomy does not remove the need for human governance. It changes where human governance is applied. Humans should define: - organizational objectives; - authority boundaries; - risk categories; - policies; - approval requirements; - escalation rules; - unacceptable actions; - accountability structures.

Machines can then enforce these boundaries consistently at runtime. This leads to a practical governance principle: "Human-defined authority + machine-enforced boundaries + observable execution." The objective is not to place a human in every individual transaction. The objective is to ensure that the enterprise itself defines the boundaries within which autonomous systems operate.

15 — WHAT CIOS AND CTOS SHOULD WATCH

As multi-agent architectures mature, enterprise technology leaders should pay attention to several architectural questions:

• **AGENT IDENTITY:** Can the organization reliably identify autonomous software actors?
• **DELEGATED AUTHORITY:** Can authority be transferred between agents without losing traceability?
• **CONTEXT INTEGRITY:** Can trusted and untrusted context be distinguished?
• **POLICY ENFORCEMENT:** Can organizational policy be applied at the point of action?
• **EXECUTION CONTROL:** Can high-impact actions be constrained before execution?
• **EVIDENCE:** Can the organization reconstruct what happened?
• **INTEROPERABILITY:** Can agents operate across different vendors, frameworks, and protocols?
• **SUPPLY CHAIN:** Can third-party agents, tools, models, and services be governed?
• **FAILURE CONTAINMENT:** Can an abnormal agent be isolated without disabling the entire enterprise?
• **ECONOMIC CONTROL:** Can organizations understand and control the operational cost of autonomous workflows?

These questions shift the conversation from, "Which AI agent should we deploy?" toward, "What enterprise architecture should govern autonomous digital labor?"

16 — FROM MODEL GOVERNANCE TO SYSTEM GOVERNANCE

Model governance remains important. But autonomous enterprise systems introduce additional layers. The governance surface increasingly includes: Models + Agents + Identity + Context + Tools + Policies + Delegation + Execution + Evidence. This is consistent with the direction of current standards and governance work. NIST's AI Agent Standards Initiative explicitly addresses interoperability, security, and identity for AI agents, while its related identity and authorization work examines how existing identity standards and practices can apply to agentic systems.

The enterprise governance question therefore evolves. Instead of asking only, "Is this model safe and reliable?" organizations increasingly need to ask, "Can this autonomous system operate safely within defined enterprise authority?" That is a fundamentally broader question.

17 — THE NEXT ENTERPRISE CONTROL LAYER

The next major enterprise control problem may not be another AI model. It may be the coordination layer that governs what autonomous systems are permitted to do. Such a control architecture would coordinate: - **Identity:** Who or what is acting? - **Context:** What information surrounds the action? - **Policy:** Which rules apply? - **Authority:** What is the actor permitted to do? - **Execution:** Which system performs the action? - **Evidence:** What proves what happened?

This architecture should ideally remain as independent as practical from any single model vendor. Models will change. Frameworks will change. Protocols will evolve. Applications will change. Enterprise authority and accountability, however, must remain coherent.

18 — WHAT REMAINS UNSOLVED

Despite rapid progress in agent interoperability and governance, significant challenges remain:

• **CROSS-ORGANIZATION TRUST:** How should autonomous agents establish trust across organizational boundaries?
• **DELEGATED AUTHORITY:** How should authority be transferred without creating uncontrolled privilege expansion?
• **SEMANTIC SECURITY:** How should systems understand the security meaning of instructions, context, and tool results?
• **DETERMINISTIC GOVERNANCE:** How can probabilistic intelligence operate inside deterministic organizational boundaries?
• **EVIDENCE:** What evidence is sufficient to demonstrate why an autonomous action was authorized and executed?
• **ECONOMIC EFFICIENCY:** How can enterprises operate increasingly complex agent networks without uncontrolled infrastructure and model costs?
• **ACCOUNTABILITY:** When several autonomous systems contribute to one outcome, how should responsibility be assigned?

These are not merely AI-model questions; they are enterprise architecture questions.

19 — THE AEXOREX PERSPECTIVE

AexoreX views the emergence of multi-agent systems as a transition from isolated AI applications toward AI-enabled enterprise infrastructure. The critical distinction is between intelligence that can act and authority that governs what it may do.

Protocols such as A2A and MCP are important because they improve interoperability and create standardized communication mechanisms for increasingly connected AI systems. A2A reached v1.0 in March 2026, while MCP's July 2026 specification introduced significant architectural changes for scalable tool and application interaction. NIST's work on agent standards, security, identity, and authorization demonstrates that the broader ecosystem is also moving toward the infrastructure required for trusted agent adoption. OWASP's agentic security work and IMDA's governance framework further demonstrate the growing importance of security, governance, and accountability around autonomous systems.

AexoreX uses the term Agentic Protocol Fabric as an analytical architecture for thinking about this emerging control problem. It is not an existing industry standard or regulatory framework. It represents a simple architectural proposition: "As agents become interconnected, interoperability must be connected to identity, authority, policy, execution control, and evidence." The enterprise does not merely need agents that can communicate; it needs autonomous systems that can operate within defined authority.

20 — CONCLUSION

The enterprise AI landscape is moving toward greater autonomy. AI agents are becoming more capable, agent protocols are becoming more interoperable, and enterprise systems are becoming increasingly accessible to autonomous software. Governance is moving closer to runtime, and the architecture surrounding AI is becoming as important as the intelligence inside the model.

The strategic question is therefore changing. Yesterday's question was: "How do we connect agents?" Tomorrow's question is: "How do we govern what happens after they connect?" The answer requires more than intelligence. It requires: - Interoperable autonomy with bounded authority. - Intelligence with explicit policy. - Execution with observable evidence. - Automation with accountable governance.

The future of enterprise AI will not be defined only by how intelligent individual agents become. It will also be defined by how effectively organizations govern the relationships between them. "Interoperability creates the network. Governance creates the enterprise."