The Port,
Not The Kernel
MCP standardised what an agent can reach. It did not standardise how an agent decides. The gap between those two sentences is the next layer to build.
A compliance lead said it cleanly.
"Our agents now read directly from the policy database. We were promised this would improve consistency. Why are we still getting opposite decisions on near-identical cases?"
The team had just completed an MCP rollout. The integration story, finally, was finished. Tools, systems, customer data — the agents could now reach everything the human reviewers could reach. By every measure the engineering team tracked, the rollout was a success.
That paradox is not local to one team. It is showing up across organisations that completed MCP rollouts in the past year — the moment the integration layer becomes a solved problem, a different layer announces itself.
Same tools. Same protocol.
II. The Plumbing And The Judgment
MCP — the Model Context Protocol — gives AI agents a standard way to access tools, systems, and data. Before MCP, every integration was a bespoke connector. After MCP, agents speak a common language to the world around them. That is a real problem solved, and the protocol's adoption across the major labs and frameworks in 2025–2026 is deserved.
But solving how an agent reaches something is not the same as solving how it decides about it.
The protocol — defines how an agent calls a tool. The shape of the request. The shape of the response.
The decision — defines how the agent weighs the response against everything else it knows. What it prioritises. What it ignores. What it concludes.
MCP standardises the first. It is silent on the second.
Two agents in the same organisation, configured by different teams, can call the exact same MCP server, retrieve the exact same record, and reach opposite conclusions. The protocol defines how they make the call. It says nothing about the logic of the call.
Access. Authentication. The format of the tool request. The format of the tool response. The contract between agent and system.
How the agent interprets a contradictory policy clause. Which prior decisions carry forward into this one. What counts as enough evidence. When to escalate, when to decide.
There is a quieter effect, too. When access is uniform, divergent outcomes stop looking like data problems. They start looking like judgment problems — because the surface of the system is finally consistent. MCP, in that sense, can mask the inconsistency it was supposed to remove. Everything looks the same on the way in. Only the decisions on the way out give the gap away.
The maintainers of MCP have been candid about this. Their 2026 roadmap, published in March, names "enterprise readiness" and "governance maturation" as priority areas for the year ahead. Audit, identity, gateway behaviour, policy. The lead maintainer acknowledged plainly that enterprises deploying MCP are running into a predictable set of problems the protocol does not yet address. They are right to flag it. And the gap is wider than the items on that list.
This is the pattern across categories now — protocols, frameworks, observability stacks, memory layers, orchestration tools. Each one solves the layer it was built for. None of them owns what happens between layers, across time, across agents.
AI systems before
building operating
systems for them.
So we compensate. Larger context windows. More orchestration. More wrappers. More filters. Every new layer adds reach — and adds hidden complexity nobody owns.
Tool access is not cognitive control. Orchestration is not ownership. Memory is not state. Observability is not accountability. Each pair looks similar from the outside. Each one is structurally different in the only way that matters: who is responsible when behaviour drifts.
IV. The Layer The Protocol Cannot Be
A protocol defines what an agent can reach. An operating system defines what is allowed to happen — every time, across every agent, without exception. The first is a contract. The second is an authority.
That distinction has been quiet for most of the last two years because the integration story was loud. Every team had a reason to spend their effort there. Now that the integration story is closing, the next one is opening — and the language for it is already inside the analogy.
The kernel
still has to be built.
A port standardises the connection. A kernel decides what runs, what persists, and what is denied. The first lets a thousand devices speak to a machine. The second is the reason the machine remains coherent while they do.
Governance is not.
Before the next protocol upgrade. Before the next agent deployment. Before the next dashboard.
Ask one question instead.
made opposite decisions
today — what layer
would have prevented it?
If the answer is the prompt, you are governing one agent at a time.
If the answer is monitoring, you are observing the past.
If the answer is the protocol, you have just found the gap.
The kernel isthe work ahead.
