Host: The entire software industry has spent the last year agreeing on how artificial intelligence agents should talk to each other, but almost nobody is talking about the elephant in the room: deciding which agents you should actually let in.

Listener: Wait, I thought that was the point of all these new standards? Like Anthropic's Model Context Protocol, or Google's Agent to Agent protocol. Don't they handle security?

Host: They handle the plumbing. They tell you how to find an agent, how to describe capabilities, and how to pass data back and forth. But if you read the fine print of both specifications, they explicitly say: deciding whether to trust whoever is knocking is not our job.

Listener: They actually say that in the spec?

Host: Word for word. In the Model Context Protocol, the authorization chapter literally begins with the sentence: 'Authorization is optional.' And on tool safety, it says tool descriptions should be considered untrusted unless obtained from a trusted server. But it leaves defining 'trusted' entirely up to you.

Listener: And Google's Agent to Agent spec does the same thing?

Host: Exactly the same. It uses an Agent Card at a well-known web address to declare who an agent claims to be and which authentication scheme it uses, like OAuth or API keys. But it specifically notes that authorization logic belongs to the enterprise policy, not the protocol.

Listener: So authentication just proves you're talking to the same key or computer as before, not that it's safe.

Host: Right. Mutual TLS proves you're connected to the same counterparty, but it says nothing about whether that counterparty should be allowed to book flights or spend money out of your company bank account.

Listener: Okay, so if the protocols punt on trust, what does real trust actually require? Where do you even start?

Host: It comes down to four fundamental questions, each harder than the last. First: who is this? Not what key signed it, but what legal person or organization is behind it? What an agent claims to be on a public card is just a self-declaration.

Listener: And the second question?

Host: What may it do, here, for this specific person, right now? Capability isn't intrinsic; it's relational. An agent allowed to read your calendar shouldn't automatically be allowed to drain your wallet.

Listener: Makes sense. And question three?

Host: What happens when it misbehaves? A trust system without consequences is just wishful thinking. If you can't revoke standing or kick an agent out permanently, reputation is just decoration.

Listener: And the fourth?

Host: Who is accountable? Software can't be sued or held liable. Every single automated action has to trace back to a reachable human being who answers for it.

Listener: So how is this actually implemented today? Are systems building that layer, or is it all theoretical?

Host: The research document breaks down a real production setup, and it's brutally honest about the current reality. In that system, identity is bound rather than declared. If an agent tries to act for a business it isn't registered to, it hits a hard wall and gets rejected immediately.

Listener: A hard wall. What about the capabilities it claims to have?

Host: That's softer right now. If an agent claims a different capability than what its record says, the system logs the mismatch and falls back to the stored record, rather than terminating the call outright. The strict blocking code actually exists in the repo, but it's sitting behind a flag turned off.

Listener: I appreciate the honesty. What about guardrails against bad behavior?

Host: Today, guardrails only cover six out of fifty-three tools in the catalog, all in one single domain. And the audit trail is currently kept in temporary memory with a note to wire it up to a persistent database. As the author puts it: governance you can't replay is governance you're taking on faith.

Listener: And what about the credentials granting permission to act?

Host: They're short-lived and request-bound, expiring in seconds so they can't be stolen and reused. But here is the biggest open gap in the whole industry: the name on that credential is still a human, not the agent itself. On the wire, the agent doesn't have its own passport yet.

Listener: So we've built the roads and the traffic signals, but we haven't built the border control or the driver's licenses.

Host: Exactly. Open registries right now only verify namespace ownership, like proving you own a domain or GitHub handle. That proves who published a tool, not whether it's safe. Answering requests is the easy half; building the admission gate that decides which agents get in is the real work ahead.