Week of August 1 – August 6, 2026
Agent Authorization Got RFC Numbers, and User-Agent Became a Billing Identity
Last week I wrote that taking the session out of MCP makes it impossible to hide identity in it, and that every request would now have to prove itself. I expected that argument to take a few months to land. It took four days, and it arrived in the least glamorous form imaginable: people started publishing RFC numbers.
That is the tell I look for. When a new problem is fashionable, you get think pieces. When a new problem is real, you get someone sitting down with RFC 8693 and writing out an actor_token and an act claim by hand, because a team somewhere has to ship the thing on Monday. This week produced the second kind of writing, in volume, from the identity vendors rather than the AI vendors. Meanwhile the enterprises that have to actually operate this stuff went looking for a place to put the policy, and discovered — as they discover every seven years — that the place to put the policy is a gateway.
This was one of the quietest weeks for specification tooling I have seen all year (summer dayz). Third-party posts about OpenAPI, AsyncAPI, JSON Schema, or Arazzo: essentially zero. Everything moved to the agent layer.
The Agent Authorization Stack Got RFC Numbers
For a year the answer to “how does an agent authenticate?” has been a shrug and a diagram. This week it became a reading list with specification numbers attached.
- MojoAuth had the run of the week, and I do not think anyone else came close. Four posts, each one a worked example rather than an overview: how MCP authorization actually works — OAuth 2.1, resource servers, and resource indicators (the 401 challenge, resource metadata, client registration, and RFC 8707 audience binding under the 2026-07-28 revision); OAuth 2.0 Token Exchange, RFC 8693, for agent delegation, with
actor_token, theactclaim, downscoping, nested delegation chains, and an honest section on what the spec does not cover; workload identity for agents, SPIFFE/SPIRE versus OAuth client credentials — two specifications answering different halves of one question while sharing no vocabulary; and scoping agent permissions with Rich Authorization Requests, RFC 9396, narrowing a token per task and enforcing it at the resource server. - Auth0 shipped the enterprise shape of it: the Cross App Access protocol, for exposing APIs and MCP servers to trusted AI agents under enterprise-managed authorization. They also started a series on building secure AI agents with the Microsoft Agent Framework.
- WorkOS took on the unglamorous version of the problem: API keys versus OAuth, and how to run both without building two systems — which is the actual situation almost every provider is in and almost nobody writes about. They also flagged that stateless JWTs have a logout problem your enterprise customers will find, which is a very on-theme thing to discover the week after a protocol went stateless.
Look at what is being reached for here, because it matters more than the individual posts. Nobody invented an agent authorization protocol this week. They went into the drawer and pulled out RFC 8693 and RFC 8707 from 2020, RFC 9396 from 2023, and SPIFFE — specifications written for service-to-service delegation years before anyone said “agent” — and started applying them. That is exactly what should happen, and it is the strongest signal yet that this problem is being solved by people who have operated identity systems rather than people who have demoed them. It also means the hard part is no longer the specification. It is that four of these have to work together, none of them share a vocabulary, and there is still no profile telling you which combination is correct.
The MCP Gateway Became a Product Category
Two weeks ago I wrote that whoever brokers agent credentials is rebuilding an API gateway for a buyer who does not know they already own one. This week the category got a name and started shipping.
- WitnessAI published the definitional piece — what an MCP gateway is, as a control layer between agents and the MCP servers they reach, governing which tools each agent can touch and producing an audit trail. When a vendor writes the “what is X” post, the category has a budget line.
- Akka built one for themselves and wrote it up honestly: wiring each service individually, per user, per machine, creates security gaps and becomes ungovernable at scale, so they centralized it. That is the most useful kind of vendor post — the internal problem that produced the product.
- Cloudflare shipped WriteGuard, fine-grained controls for MCP servers, in private beta. Read the name: the interesting permission boundary is no longer can this agent connect but can this agent write.
- Redpanda made the architectural argument that the policy engine has to sit out-of-band — governance an agent cannot ignore, because anything in-band is something a prompt can talk its way past.
- Salt Security debuted an AWS WAF managed ruleset for AI agent and API protection, which is the API security industry doing the obvious and correct thing: pointing the existing appliance at the new traffic.
- The platform side filled in around it — MuleSoft turned its platform API operations into an MCP server, Azure DevOps took its remote MCP server generally available, and Zapier bundled its governed AI products into one story.
- Two more pieces of the same machine: Cloudflare shipped agent traces instrumented by the Agents SDK — you cannot govern what you cannot observe, and observability is the half of this category nobody is selling yet — and AWS wrote up an MCP bridge giving an AgentCore-hosted agent access to local MCP tools, which is the hosted-versus-local seam everyone hits about a month in.
- Worth noting that the other gateway had a real week too: Kubernetes Gateway API v1.6 graduated TCPRoute and UDPRoute to Standard, with Isovalent pairing it with Argo Rollouts for progressive delivery. Same word, different layer, and the older one is still quietly finishing the job it started years ago.
- And WorkOS wrote the two best security posts of the week. Approval fatigue is agent governance’s next attack surface — we studied alert fatigue for a decade, and attackers are now writing prompts specifically to trigger it in agents. Then prompt injection depends on the surface, not the model, citing Anthropic’s own data showing one model at a 0% attack success rate in one environment and 78.6% in another, with only the available actions changed.
That last finding deserves to end the section, because it reframes the whole category. If the same model is safe in one environment and catastrophically unsafe in another purely because of what it was allowed to do, then “is this model secure?” is not a question with an answer, and every dollar spent evaluating model safety instead of constraining tool surface is misallocated. The control is the toolset. Which is to say: the control is the gateway, and the scope on the token, and the thing MojoAuth spent four posts explaining. All three sections of this newsletter so far are one argument.
📄 Explicit Agent Boundaries — “The agent shouldn’t touch that” is not a control. It is a hope. Explicit boundaries make it a contract: declared, versioned, and checkable before the agent runs rather than discovered afterwards. A machine-checkable boundary spec for the agent era. $25
Stateless MCP, Week Two: The Platforms Finished the Job
Last week’s seventy-two-hour scramble turned into the slower, more consequential work of actually shipping it.
- Cloudflare published the full accounting — a rewritten stateless core, the new feature lifecycle, the SDK migration path, and early adopters already in production. If you only read one migration document, read that one.
- Google wrote up scaling agent infrastructure on the stateless updates, which is the read from the side of the house that has to run it at Google volume.
- CData did the enterprise translation in a burst: what stateless MCP means and why it matters, the 2026-07-28 release explained for enterprise teams, and how enterprise-ready MCP delivers accurate answers.
- Cisco wrote the post I have been waiting for somebody to write: applying ordinary API engineering practices to MCP servers. Versioning, testing, contracts, lifecycle. None of it is new. That is the point.
- And the token-efficiency conversation matured into engineering. CData on seven ways custom MCP tools cut LLM token costs, and Figma on Code Connect producing better code with fewer tokens. Appwrite’s July update folded the remote MCP server in beside an ordinary Projects API, which is what “settled” looks like.
- The tooling layer did quiet, unfashionable work worth naming. Postman shipped an official TypeScript SDK for its own API — the company that sells API tooling finally treating its own API like a product. And APImatic published a benchmark for API integration quality, going past “it works” to what good means, which is exactly the measurement gap I keep complaining nobody fills.
- Agent Skills kept spreading without much noise: Google on building, testing, and scaling its own Agent Skills, Agent Skills in Genkit Go, Agent Skills for Amazon MSK, and Aiven framing skills as guardrails for contributing to Kafka without knowing every module.
Notice the shape of the second week. The first week was platforms proving they could move fast. This week was Cisco saying MCP servers need versioning and testing, and CData explaining the release to enterprise teams, and Figma counting tokens. That is the boring part, and the boring part is where a protocol either becomes infrastructure or becomes a 2026 story. I called MCP last-mile plumbing this week and I meant it as a compliment: plumbing is what you get to be if you survive.
From My Desk: The Toll Booth, Not the Ad
I spent this week with a crawler and a lot of status codes, and it went somewhere I did not plan.
- It started with how Time serves ads to AI agents. The trade press covered the deal and said outright they could not tell you the mechanism, so I went and found it: no content negotiation, no markdown twin, just CDN-edge user-agent detection serving an entirely different document to agents —
text/markdownwith YAML frontmatter and, on a quarter of pages, an ad. The ad is not a banner. It is a structured knowledge object engineered for retrieval, with tables carrying aSourcecolumn and aschema.org/FAQPageJSON-LD block, and on ad-bearing pages it runs 41% to 70% of the bytes the crawler ingests. The advertiser is more than half the document, positioned ahead of the journalism. Time’s ownllms.txtdisallows Anthropic; the edge serves every Anthropic agent markdown and ads anyway. - Then I went looking for how many others were doing it, and the answer was almost nobody — differential serving shows up on 1.8% of the panel, and Time is the only site serving ad payload to agents. Zero others. But while looking for ads I kept hitting HTTP 402 Payment Required, and that turned out to be the real story. Across 185 media properties, 17.0% gate at least one AI vendor behind a 402 and 11.8% do it selectively. The Atlantic answers OpenAI with a 200 and Anthropic with a 402. Forbes bills everybody. Anthropic is billed by 15.0% of outlets, roughly double OpenAI’s 7.8%. The tech trade press — the people writing all the coverage about AI scraping — gate AI companies at 0.0%. And the postures cluster by owner, not newsroom: every People Inc property runs one identical toll, while Penske is running two contradictory policies at once because the Vox acquisition has not propagated.
- I want to flag that I got things wrong twice on the way there and wrote both up, because the errors were more instructive than the findings: my first pass was probed entirely with curl and I was measuring curl’s TLS fingerprint rather than Time’s policy, and I initially called the 402s “cloaking,” which would have been a false accusation against nine publishers doing something entirely defensible. The tooling now runs two independent HTTP clients and refuses to report when they disagree.
- The uncomfortable part is that somebody else arrived at the same place independently, and said it more sharply than I did. WorkOS: TIME serves bots a different website, and User-Agent is now a billing identity. That is the sentence. The routing key for an entire commercial ledger is a header any client can type.
- Elsewhere on my desk: scoring the secondary market — 278 companies whose shares trade on Forge, Hiive, and EquityZen, run through the Kin Score, averaging 27.5 with 78% in the emerging/thin/minimal bands and 129 of them rating human-only. Valued like technology companies; not operable like them. And open at launch, walled off by Series D, which is the same finding told as a story instead of a number.
- Doing GraphQL is governance by default, doing REST is not surprised me to write, given how ambivalent I have been about GraphQL: you cannot ship the first query without a single consistent typed schema, so the machine-readable contract REST governance programs spend two years producing is just there the moment the server starts. In REST, governance is something you impose from outside, against the grain, forever.
- The overlays series continued with governance as an artifact, not enforcement and environment promotion across dev, staging, and production. Onboarding reviews landed on Ping Identity’s two roads to a programmatic client, WorkOS handing you a dashboard key then letting the agents run, and Stytch, which already built the self-serve onboarding the agentic web needs. Plus agents don’t magically understand your API, the tool is one implementation among many, transparency logs for API authorization, governing an API standard with ADRs and attacker models, strip out the university and this is a template, and my current stance on how I use artificial intelligence.
Here is the thing I keep circling. We spent twenty years building a discovery layer out of files at well-known paths that honestly describe a site’s intentions — robots.txt, llms.txt, OpenAPI, APIs.json. The most consequential commercial development on the web right now is described in none of them. Who gets billed, who walks in free, which intermediary collects, what the price even is: all of it lives in edge configuration and response bodies, discoverable only by impersonating a crawler and reading a status code. You cannot govern what you cannot observe. That is the same sentence I have written about agent cards, about Spectral, and about the Time markdown, and it keeps being the answer.
A Conversation: Tony Tam on the Backstory of Swagger
I have wanted to record this one for a long time.
Tony Tam created Swagger — the specification that became OpenAPI — and founded Wordnik, where it came from. We go all the way back to the late-night desperation that started it: a six-person team that could not keep up with hand-writing clients and documentation, and an email Tony sent at three in the morning asking what if the API could just describe itself. From there we trace the arc — the accidental naming, the stranger who turned up in an IRC channel to mention they were pushing two billion dollars a day through it, the inversion from code-generates-spec to spec-generates-server, and the move into the Linux Foundation. Then the part I most wanted to ask about: the two moments he realized this would matter for AI, why an OpenAPI document is now a ticket into AI infrastructure, whether AI even needs APIs at all, and where the human craft of designing a contract still adds value when machines write most of the code.
Put that against everything above. This week the industry reached back into a drawer of specifications written years before anyone said “agent” and found they mostly worked. Tony’s document is the oldest thing in that drawer, and it is the one that turned out to be the ticket. Every provider now scrambling to be legible to an agent is discovering that the artifact they needed was the one somebody wrote at three in the morning in 2010 because he was tired of writing documentation by hand. The vocabulary keeps changing. The contract endures.
See you next week.
📄 The State of Cybersecurity APIs — 1,964 security companies scored at 30.2 against a catalog average of 22.5 — the second-best-scoring market of twenty-five. Genuinely competent, and the report says so. Then there is the disclosure gap: 72% will not tell you how to report a vulnerability, now that the EU Cyber Resilience Act requires exactly that. $500
