The Protocol Pivot: AI’s Center of Gravity Is Moving

Breaking news, hidden shift

For months the AI headlines looked familiar: new models, higher scores, bigger context windows. The real story sat below the fold. In June 2025, the Linux Foundation announced the Agent2Agent project with backing from AWS, Microsoft, Salesforce, SAP, ServiceNow and others, seeded by Google’s donation of the protocol specification and tooling. Read the primary announcement in the Linux Foundation announced the Agent2Agent project post. In parallel, more teams standardized on the Model Context Protocol specification to connect agents with tools and data regardless of model or runtime.

Put simply, the center of gravity is moving from models to protocols. Models will keep getting better, but the constraint on value is no longer how smart one model is. It is how quickly agents can discover one another, negotiate capabilities, pass tasks, and transact safely across companies and clouds.

Why protocols beat single model bets

Think of models as engines and protocols as highways. A faster engine helps, but the speed limit on an economy is the network of roads. Protocols give agents the map, the traffic rules, and a common language for cargo. Value shifts from who has the best engine to who can compose, route, and secure flows across a network of engines.

Three forces drive the pivot:

1. Composability beats raw capability. Organizations do not run monolithic tasks. They run chains. A claims bot pulls from a policy database, consults a fraud model, calls a document parser, then hands off to a human. Chaining across apps and vendors depends less on one genius model and more on a reliable way to exchange tasks and context.

2. Interoperability lowers switching cost. As protocols normalize identity, capabilities, and permissions, teams can swap models or agent providers without ripping out the plumbing. Procurement shifts from buying a single flagship model to buying plugs for a shared socket. This is the practical sequel to the post-benchmark era.

3. Security moves to the edges. When identity, authorization, and audit travel with messages, you get end to end control no matter which agent or cloud executes a step. That is hard inside one vendor’s garden and natural in a protocol world where messages are the unit of trust.

This year’s realignment in plain terms

The clearest way to see the shift is to watch platform posture.

• A2A as the universal handshake. The ecosystem needed a way for agents to introduce themselves, list capabilities, and accept tasks from one another. A2A’s agent identity and task lifecycle provide that handshake. The Linux Foundation move turned it into a neutral meeting place with multiple clouds at the table.

• MCP as the tools and data socket. While A2A enables agent to agent collaboration, MCP standardizes how agents tap into tools and enterprise systems. The practical result is boring and important. Connectors you build for one agent become reusable across models and runtimes, which collapses integration time from months to weeks.

• Payments, identity, and audit harden at the protocol layer. If agents can discover and delegate, they will need to pay, settle, and prove provenance. Protocols for mandates, receipts, and audit trails are appearing in specs and SDKs. This aligns with our argument that the AI signature layer becomes a primitive, not an afterthought.

These are not abstract shifts. They change product roadmaps. A model lab now wins by offering protocol native runtimes, strong sandboxes, and excellent observability, not just by posting a leaderboard entry. A cloud now competes by offering agent registries, key management, confidential compute, and programmable network isolation that speak the same open dialects.

From apps to process networks

Most companies still think in terms of applications, but their work is a mesh of processes. A sales quote touches product configuration, discount policy, legal review, and revenue recognition. A capital project touches sourcing, risk, budget, and change control. Each step already has a system and a person. Tomorrow, each step will also have an agent.

Process networks make this explicit. The primitives become:

• Identity. Every agent gets a durable, cryptographically bound identity plus posture signals like security attestations and provenance claims.
• Capability. Agents advertise what they can do in a standard format that another agent can parse and match to a task.
• Permission. Access is scoped at the message level with short lived, least privilege grants that travel with the task rather than living inside a vendor silo.
• Accountability. Signed messages, tamper evident logs, and replayable task traces create a shared audit fabric across organizations.

Once these primitives are embedded in protocols, companies stop drawing charts around applications and start drawing them around processes. A quote to cash graph, for example, might be owned by a small team that curates agents, policies, and service levels, even if those agents run across five apps and three clouds. This is one concrete path to the Agent OS arrives thesis.

What gets built next: protocol native workflow graphs

A protocol native workflow graph is a composition of agents that agree on how to talk, prove who they are, and request specific capabilities with scoped permissions. To make this concrete, here are three patterns you can ship soon.

The delegated analyst

A research agent ingests a task from a sales agent, requests read only access to the customer’s document store via MCP, runs a structured analysis with a finance agent, then returns a signed decision brief to the sales agent. Each edge in the graph carries signed scopes and an audit hash. Security posture and provenance travel with the message, not with the vendor account.

The service desk triangle

A triage agent takes a ticket, asks a knowledge agent to summarize similar incidents, requests a remediation plan from a patch agent, and returns a playbook to a human. Agents never get blanket access to production. They receive a time boxed, sandboxed capability token to run read only diagnostics, and a separate token to propose a change that a human must approve.

The close the books relay

A reconciliation agent collects monthly statements, a policy agent applies accounting rules, and a controller agent assembles the narrative. Every step emits a verifiable artifact that plugs into your audit system without screenshot cargo cults. Because the artifacts are signed, audit can replay a close call with the exact same inputs and outputs.

Across all three, the hard parts are not model selection. They are identity assignment, scope control, capability discovery, and message validation. That is why protocols are now the center of gravity.

Trust and safety as protocol properties

If the agent internet is going to compound rather than fragment, trust and safety must be protocol features, not dashboard afterthoughts. The blueprint is straightforward.

• Identity by construction. Assign every agent a verifiable identifier backed by a hardware or service attestation. Use short lived keys and automated rotation. Bind identity to capability by signing agent cards and tool manifests.

• Capability bounding. Do not give an agent generic shell access. Define verbs and resources, then mint capability tokens that allow specific actions such as create branch in repository X but not delete repository. Scope them for minutes, not days.

• Prompt and tool hygiene. Treat tool definitions as part of your attack surface. Require code review, static analysis, and dependency scanning on MCP servers. For prompts that invoke tools, lint them like code, enforce parameter schemas, and add rejection rules for unsafe patterns.

• Human in the loop where it counts. Gate high impact actions behind human approval and dual control. A protocol message should describe the intent, the context, and the diff of the proposed change. Approval is a structured signature, not a chat emoji.

• Systematic red teaming. Build scenario libraries for prompt injection, tool misbinding, data exfiltration, and role confusion across agents. Replay them across vendor stacks. Publish your attack catalog internally and treat it like phishing simulation.

• Continuous audit. Every task hop leaves a signed breadcrumb. Store them in an append only log. Make replay a product feature so compliance can re run any incident with the same artifacts.

The goal is not perfection. It is a clear risk envelope with protocols that make good behavior easy and dangerous behavior auditable.

The cloud chessboard resets

Cloud realignments follow the protocol pivot. Here is the short story of the platform race.

• Registries and directories. Expect cloud providers to offer searchable catalogs of agents and MCP servers with verification tiers, reputation scores, and integration tests that run on every update.

• Key and policy as a service. Key management, confidential compute, and per message policy engines will be packaged directly into agent platforms. Think OAuth for agents, but with task scoped claims and explicit tool manifests.

• Native observability. Traces will cross vendor boundaries. You will click a task and see the entire path including latency, cost, token usage, and failure points even when three clouds participated.

• Marketplaces that look like package managers. You will add a calendar agent or a reconciliation agent the way you add a dependency. Policies and scopes ship with the package and are verified at import.

This rerun of cloud history rewards platforms that make protocol native composition the default. Lock in comes not from secret model weights but from the ease of composing safe, auditable graphs.

A practical plan for this quarter

Acceleration without guardrails is cargo cult. Guardrails without acceleration stalls the flywheel. Here is a concrete plan that does both.

1. Choose one protocol for agent to agent and one for tools. You do not need to pick the final answer for the industry. You need a standard for your company. A2A for inter agent tasks plus MCP for tools and data will get you started. Publish a one page internal profile that lists allowed verbs, scopes, and message headers. Link to the Model Context Protocol specification in your engineering handbook and update it as you evolve.

2. Create an agent card for each critical workflow. Start with claims processing, customer support, month end close, or release engineering. Force each agent to declare capabilities, required scopes, and supported artifacts. Keep the first version narrow and versioned.

3. Wrap tools in MCP servers. Take three high value systems such as your code host, ticketing system, and document repository. Build or adopt MCP servers with strict scopes and logging. Remove direct credentials from prompts. Put expiration on every scope.

4. Add a protocol gateway. Stand up a small service that verifies signatures, rewrites scopes, enforces policy, and logs messages before they cross team or vendor boundaries. This lets you adopt protocols without changing every app.

5. Establish a red team loop. Twice a month, run a fixed battery of attacks against your agent graphs. Rotate the graph under test and publish a two page after action with fixes. Track time to detect and time to repair.

6. Measure what matters. For each graph, track cycle time, error rate, rollback rate, and human approval latency. Tie wins to dollars saved or revenue unlocked. Protocols are not a philosophy. They are a compounding asset when you can prove impact.

What changes for model strategy

This pivot does not say models do not matter. It says model choice becomes a replaceable part if the protocol layer is right. That gives you new options.

• Dual source high risk steps. Run the same critical decision through two different models behind the same protocol boundary. Require a quorum or escalate to a human if they disagree beyond a threshold.

• Use small models where you can. If a step is deterministic and tightly scoped, a compact model with a well defined tool is cheaper, faster, and easier to audit. Save frontier models for ambiguous work where judgment matters.

• Swap models without rewiring. With protocol native graphs, changing models becomes a configuration change, not a rewrite. That is the point of an interoperability layer.

The risk of balkanization and how to avoid it

Every platform cycle faces the same fork. Either the industry standardizes on a few open protocols and grows a commons, or it splinters into vendor dialects and slows down. The playbook to keep compounding is simple and hard.

• Standardize fast on message shapes and scopes. Agree on how to declare identity, capability, and permission even if implementations differ under the hood. The moment you drift on the wire is the moment your ecosystem starts to fracture.

• Ship production pilots, not only demos. Run a real process under protocol control with audit and rollback. Invite compliance to the kickoff. Run tabletop exercises for failures and attacks before you scale.

• Treat governance as engineering. Encode policies as verifiable claims and contracts. Do not bury them in wiki pages. If a process requires dual control or separation of duties, make the protocol enforce it.

• Share artifacts and tests. Publish open conformance suites and reference agent cards. Interop that lives in press releases dies in the field. Interop that lives in tests survives contact with reality.

The bottom line

The center of AI is moving from the model to the message. Protocols turn agents from isolated apps into members of a process network that spans companies and clouds. This year’s interoperability push is the hinge: A2A for agent collaboration, MCP for tools and data, and identity, permission, and audit as first class fields in every message.

The winners will not be the teams with the single smartest model. They will be the teams that compose the fastest, govern the tightest, and prove the most. Choose your protocols, constrain your scopes, wire your audit, and ship a real process on the network. The agent internet is arriving. Better to help lay the roads than wait for traffic to pass you by.