---
type: "article"
title: "API Evangelist Weekly — Agent Authorization Got RFC Numbers, and User-Agent Became a Billing Identity"
newsletter: "API Evangelist"
newsletter_handle: "apievangelist"
newsletter_url: "https://usecommune.com/n/apievangelist"
author: "Kin Lane (@kinlane)"
published: "2026-08-10T17:52:50.568Z"
canonical_url: "https://usecommune.com/n/apievangelist/a/MbFH4qer"
markdown_url: "https://usecommune.com/n/apievangelist/a/MbFH4qer.md"
chat_url: "https://usecommune.com/n/apievangelist/a/MbFH4qer/chat"
body_source: "native"
likes: 1
replies: 0
body_words: 3246
---

# API Evangelist Weekly — Agent Authorization Got RFC Numbers, and User-Agent Became a Billing Identity

Last week I made a prediction: that taking the session out of MCP would make it impossible to hide identity inside it, and that every request would now have to prove itself. I thought that argument would take a few months to land. It took four days, and it showed up in the least glamorous way I could have imagined: people quietly started publishing RFC numbers.

That's always the tell, for me. A fashionable problem gets think pieces written about it. A real one gets someone sitting down with RFC 8693, writing out an `actor_token` and an `act` claim by hand, because a team somewhere actually has to ship something on Monday. This week gave us the second kind of writing, and a lot of it, mostly from the identity vendors rather than the AI vendors. Meanwhile, the enterprises who actually have to run this stuff went looking for somewhere to put the policy, and found what they always find, every seven years or so: the place to put the policy is a gateway.

It was also one of the quietest weeks I've seen all year for specification tooling (summer will do that). Barely any third-party posts about OpenAPI, AsyncAPI, JSON Schema, or Arazzo. Everyone's attention moved to the agent layer instead.

![](https://fmxorstnlyoqpqdftivs.supabase.co/storage/v1/object/public/article-images/3c8ce8e6-6e56-40ce-9ef0-480f913d2840/319513cc-a8d5-4044-a3fe-2f861b81032a/1786384188630-l808uzsu.png)

## The Agent Authorization Stack Got RFC Numbers

For the best part of a year, the honest answer to "how does an agent authenticate?" has been a shrug and a whiteboard diagram. This week, it turned into an actual reading list, complete with specification numbers.

MojoAuth had the strongest week of anyone, and it wasn't close. Four posts, each one a worked example rather than a think piece: a walkthrough of [how MCP authorization actually works — OAuth 2.1, resource servers, and resource indicators](https://mojoauth.com/blog/how-mcp-authorization-actually-works-oauth-2-1-resource-servers-and-resource-indicators) (the 401 challenge, resource metadata, client registration, and RFC 8707 audience binding under the 2026-07-28 revision); a piece on [OAuth 2.0 Token Exchange, RFC 8693, for agent delegation](https://mojoauth.com/blog/oauth-2-0-token-exchange-rfc-8693-for-agent-delegation-a-worked-example), working through the `actor_token`, the `act` claim, downscoping and nested delegation chains, with an honest section on what the spec doesn't cover; a comparison of [workload identity for agents, SPIFFE/SPIRE versus OAuth client credentials](https://mojoauth.com/blog/workload-identity-for-agents-spiffe-spire-vs-oauth-client-credentials), two specifications answering different halves of the same question while sharing no common vocabulary; and a walkthrough of [scoping agent permissions with Rich Authorization Requests, RFC 9396](https://mojoauth.com/blog/scoping-agent-permissions-rich-authorization-requests-rfc-9396-in-practice), narrowing a token per task and enforcing it at the resource server.

[Auth0 shipped the enterprise shape of it](https://auth0.com/blog/xaa-protocol-auth0-ai-agents/): the Cross App Access protocol, for exposing APIs and MCP servers to trusted AI agents under enterprise-managed authorization, and kicked off a series on [building secure AI agents with the Microsoft Agent Framework](https://auth0.com/blog/building-secure-ai-agents-with-microsoft-agent-framework-and-auth0-part-1-user-authentication/).

[WorkOS took on the unglamorous version of the problem](https://workos.com/blog/api-keys-vs-oauth): API keys versus OAuth, and how you actually run both without maintaining two separate systems, which is the reality almost every provider is quietly living with and almost nobody writes about. They also flagged something worth remembering: [stateless JWTs have a logout problem your enterprise customers will find](https://workos.com/blog/stateless-jwt-logout-problem).

Here's what I think matters more than any individual post: nobody invented a new agent authorization protocol this week. They went into the drawer and pulled out RFC 8693 and RFC 8707 from 2020, RFC 9396 from 2023, and SPIFFE, specifications written for service-to-service delegation years before anyone said the word "agent", and just started applying them. That's exactly what should be happening, and it's the strongest signal yet that this problem is being solved by people who've actually operated identity systems, not people who've demoed them. It also means the hard part isn't the specification anymore. It's that four of these now have to work together, none of them share a vocabulary, and there's still no profile telling you which combination is the right one.

It's the same question, really, whether you're picking an authorization stack or trying to work out how a prospective customer sees your platform: the pieces you need are usually already out there, and the hard part is knowing which combination actually fits your situation.

![](https://fmxorstnlyoqpqdftivs.supabase.co/storage/v1/object/public/article-images/3c8ce8e6-6e56-40ce-9ef0-480f913d2840/319513cc-a8d5-4044-a3fe-2f861b81032a/1786384200355-ybxwpp25.png)

## The MCP Gateway Became a Product Category

Two weeks ago, I wrote that whoever ends up brokering agent credentials is effectively rebuilding an API gateway for a buyer who doesn't yet realise they already own one. This week, that category got a name and started shipping.

[WitnessAI published the definitional piece](https://witness.ai/blog/mcp-gateway/): what an MCP gateway actually is, a control layer sitting between agents and the MCP servers they reach, governing which tools each agent can touch and producing an audit trail as it goes. When a vendor writes the "what is X" post, you know the category has a budget line behind it now.

[Akka built one for their own use and wrote it up honestly](https://akka.io/blog/building-the-akka-mcp-gateway): wiring each service up individually, per user, per machine, creates security gaps and becomes unmanageable at scale, so they centralised it instead. That's the most useful kind of vendor post there is, the internal problem that quietly produced the product.

[Cloudflare shipped WriteGuard, fine-grained controls for MCP servers](https://blog.cloudflare.com/mcp-portal-writeguard-private-beta/), currently in private beta. The name tells you where the real boundary has moved to: it's no longer "can this agent connect", it's "can this agent write".

[Redpanda made the architectural case](https://www.redpanda.com/blog/agentic-ai-needs-out-of-band-governance) that the policy engine has to sit out-of-band, governance an agent genuinely cannot ignore, because anything sitting in-band is something a clever prompt can talk its way past.

[Salt Security debuted an AWS WAF managed ruleset for AI agent and API protection](https://salt.security/blog/salt-debuts-first-aws-waf-managed-ruleset-for-ai-agent-and-api-protection), which is really the API security industry doing the obvious, sensible thing: pointing the appliance they already have at the new traffic.

The platform side filled in around all of this. [MuleSoft turned its platform API operations into an MCP server](https://blogs.mulesoft.com/news/mulesoft-platform-mcp-server-turn-api-operations-into-natural-language/). [Azure DevOps took its remote MCP server generally available](https://devblogs.microsoft.com/devops/azure-devops-remote-mcp-server-ga/). [Zapier bundled its governed AI products into one story](https://zapier.com/blog/zapier-ai-guide). And two more pieces completed the picture: [Cloudflare shipped agent traces instrumented by the Agents SDK](https://developers.cloudflare.com/changelog/post/2026-08-04-agent-tracing/), because you can't govern what you can't observe, and observability is the half of this category nobody's really selling yet, and [AWS wrote up an MCP bridge giving an AgentCore-hosted agent access to local MCP tools](https://aws.amazon.com/blogs/machine-learning/how-we-built-an-mcp-bridge-to-give-our-agentcore-hosted-ai-agent-access-to-local-mcp-tools/), which is the hosted-versus-local seam almost everyone hits about a month into building one of these.

Worth a mention, too, that the *other* gateway had a real week: [Kubernetes Gateway API v1.6 graduated TCPRoute and UDPRoute to Standard](https://kubernetes.io/blog/2026/08/03/gateway-api-v1-6-release/), with [Isovalent pairing it with Argo Rollouts for progressive delivery](https://isovalent.com/blog/post/argo-rollouts-and-gateway-api/). Same word, completely different layer, and the older one is still quietly finishing the job it started years ago.

And WorkOS wrote the two best security posts of the week, in my view. One on [approval fatigue as agent governance's next attack surface](https://workos.com/blog/approval-fatigue-agent-governance), noting that we've studied alert fatigue in security teams for a decade, and attackers are now writing prompts specifically designed to trigger the same fatigue in agents. The other on how [prompt injection risk depends on the surface an agent has access to, not the model itself](https://workos.com/blog/ai-agent-governance-prompt-injection-surface-not-model), citing Anthropic's own data showing one model sitting at a 0% attack success rate in one environment and 78.6% in another, with only the available actions changed between the two.

That last finding is worth sitting with, because it reframes the whole category. If the same model can be safe in one environment and catastrophically unsafe in another purely because of what it was allowed to do, then "is this model secure" isn't really a question with a stable answer, and every dollar spent evaluating model safety instead of constraining tool surface is, in a real sense, misallocated. The control is the toolset. Which is to say: the control is the gateway, and the scope on the token, and the exact thing MojoAuth spent four posts carefully explaining. Every section of this newsletter so far has quietly been one argument.

It's worth asking the same kind of question about your own platform. Every vendor above is, in effect, demonstrating their agent-readiness in public, through documentation and shipped product rather than through a claim on a slide. If a prospective customer went looking for that same evidence about your platform this week, would they find it? That's the exact question the API Management Market Report was built to answer, not with an opinion, but by scoring API management platforms against the same criteria buyers are already starting to check for themselves: contract quality, developer ergonomics, commercial clarity, operational transparency, governance, discoverability, and agent readiness. Five providers currently land a flat zero on that last one, and a zero doesn't always mean the capability's missing, sometimes it just means nobody can find proof that it exists, which in practice amounts to the same thing from a buyer's side of the table.

***

**📄 **[**API Management Market Report**](https://app.notion.com/p/REPORT-PAGE-URL?utm_source=apievangelist&utm_medium=email&utm_campaign=api-management-market-report&utm_content=warm_variant_midpoint) — See how your platform and its competitors score against the same evidence buyers are already checking. Contract quality, developer ergonomics, governance, discoverability and agent readiness, scored across the market. Know where you stand before a prospective customer tells you. **$500**

***

![](https://fmxorstnlyoqpqdftivs.supabase.co/storage/v1/object/public/article-images/3c8ce8e6-6e56-40ce-9ef0-480f913d2840/319513cc-a8d5-4044-a3fe-2f861b81032a/1786384217448-6fzeszo2.png)

## Stateless MCP, Week Two: The Platforms Finished the Job

Last week's seventy-two-hour scramble turned into the slower, more consequential work of actually shipping the thing properly.

[Cloudflare published the full accounting](https://blog.cloudflare.com/mcp-v2/): a rewritten stateless core, the new feature lifecycle, the SDK migration path, and early adopters already running it in production. If you only read one migration document this week, make it that one.

[Google wrote up how they're scaling agent infrastructure on the stateless updates](https://developers.googleblog.com/scaling-ai-agent-infrastructure-with-the-mcp-stateless-updates/), which is a genuinely useful read from the side of the house that has to actually run it at Google's volume.

CData did the enterprise translation in a quick burst of three posts: [what stateless MCP means and why it matters](https://www.cdata.com/blog/stateless-mcp), [the 2026-07-28 release explained for enterprise teams](https://www.cdata.com/blog/mcp-2026-07-28-release), and [how enterprise-ready MCP delivers accurate answers](https://www.cdata.com/blog/enterprise-ready-mcp-accurate-ai-answers).

[Cisco wrote the post I've been quietly waiting for someone to write](https://blogs.cisco.com/developer/beyond-the-protocol-applying-api-engineering-practices-to-mcp-servers/): applying ordinary API engineering practices, versioning, testing, contracts, lifecycle, to MCP servers. None of it is new. That's rather the point.

And the token-efficiency conversation finally matured into real engineering. [CData covered seven ways custom MCP tools cut LLM token costs](https://www.cdata.com/blog/custom-mcp-tools-cut-token-costs), and [Figma wrote about Code Connect producing better code with fewer tokens](https://www.figma.com/blog/the-benefits-of-code-connect-in-mcp/). [Appwrite's July update](https://appwrite.io/blog/post/july-product-update-remote-mcp-server-projects-api-and-more) folded its remote MCP server in beside an ordinary Projects API, which is what "settled" actually looks like once the dust clears.

The tooling layer did some quiet, unfashionable work worth naming properly. [Postman shipped an official TypeScript SDK for its own API](https://blog.postman.com/introducing-postman-api-sdk-the-official-typescript-sdk-for-the-postman-api/), the company that sells API tooling finally treating its own API like a product. And [APImatic published a benchmark for API integration quality](https://www.apimatic.io/blog/api-integration-benchmark), moving the conversation past "does it work" to what "good" actually means, which is exactly the measurement gap I keep pointing at and nobody quite fills.

Agent Skills kept spreading without much noise: [Google wrote about building, testing and scaling its own Agent Skills](https://cloud.google.com/blog/topics/developers-practitioners/behind-the-scenes-how-we-build-test-and-scale-google-agent-skills/), alongside pieces on [Agent Skills in Genkit Go](https://developers.googleblog.com/enable-on-demand-expertise-with-agent-skills-in-genkit-go/), [Agent Skills for Amazon MSK](https://aws.amazon.com/blogs/big-data/streamline-apache-kafka-cluster-operations-and-migrations-with-agent-skills-for-amazon-msk/), and [Aiven framing skills as guardrails](https://aiven.io/blog/skills-as-guardrails-contributing-kafka) for contributing to Kafka without needing to know every module.

Notice the shape of these two weeks together. The first was platforms proving they could move fast. This one was Cisco saying MCP servers need versioning and testing, CData explaining the release to enterprise teams, and Figma quietly counting tokens. That's the unglamorous part, and it's exactly where a protocol either becomes real infrastructure or becomes a story people tell about 2026. I called MCP [last-mile plumbing](https://apievangelist.com/2026/08/04/mcp-is-last-mile-plumbing/) this week, and I meant it as a genuine compliment. Plumbing is what you get to become, if you survive.

![](https://fmxorstnlyoqpqdftivs.supabase.co/storage/v1/object/public/article-images/3c8ce8e6-6e56-40ce-9ef0-480f913d2840/319513cc-a8d5-4044-a3fe-2f861b81032a/1786384238923-7ln5csxe.png)

## From My Desk: The Toll Booth, Not the Ad

I spent this week with a crawler and a lot of status codes, and honestly, it went somewhere I hadn't planned on going.

It started with [how Time serves ads to AI agents](https://apievangelist.com/2026/08/03/how-time-serves-ads-to-ai-agents/). The trade press covered the deal and admitted outright they couldn't tell you the mechanism, so I went and found it myself. There's no content negotiation, no markdown twin, just CDN-edge user-agent detection serving an entirely different document to agents, `text/markdown` with YAML frontmatter, and on a quarter of pages, an ad. And it's not a banner. It's a structured knowledge object engineered for retrieval, complete with a `Source` column and a `schema.org/FAQPage` JSON-LD block, and on ad-bearing pages it accounts for 41% to 70% of the bytes the crawler actually ingests. The advertiser is, quite literally, more than half the document, sitting ahead of the journalism. Time's own `llms.txt` disallows Anthropic. The edge serves every Anthropic agent the markdown and the ads anyway.

I wanted to know how many others were doing the same thing, and [the answer was almost nobody](https://apievangelist.com/2026/08/04/the-ai-licensing-market-is-visible-in-http-status-codes/). Differential serving shows up on just 1.8% of the panel I checked, and Time is the only site actually serving ad payload to agents. Zero others. But while I was looking for ads, I kept running into HTTP 402 Payment Required, and that turned out to be the real story. Across 185 media properties, 17.0% gate at least one AI vendor behind a 402, and 11.8% do it selectively. The Atlantic answers OpenAI with a 200 and Anthropic with a 402. Forbes bills everybody. Anthropic gets billed by 15.0% of outlets, roughly double OpenAI's 7.8%. The tech trade press, the very people writing all the coverage about AI scraping, gate AI companies at 0.0%. And the postures cluster by owner rather than newsroom: every People Inc property runs the same identical toll, while Penske is currently running two contradictory policies at once because the Vox acquisition hasn't fully propagated yet.

I'll be upfront that I got this wrong twice on the way to finding it, and I wrote both mistakes up, because they turned out to be more instructive than the findings themselves. My first pass was probed entirely with curl, and I was actually measuring curl's TLS fingerprint rather than Time's real policy. I also initially called the 402s "cloaking", which would have been a false accusation against nine publishers doing something entirely defensible. The tooling now runs two independent HTTP clients and simply refuses to report anything when they disagree with each other.

The uncomfortable part is that someone else arrived at the same place independently, and said it more sharply than I did: [WorkOS: TIME serves bots a different website, and User-Agent is now a billing identity](https://workos.com/blog/user-agent-is-now-a-billing-identity). That's the sentence that stuck with me. The routing key for an entire commercial ledger is a header any client can type in.

Elsewhere on my desk this week: I ran the Kin Score across [the secondary market](https://apievangelist.com/2026/08/05/scoring-the-secondary-market-does-the-hype-have-an-api/), 278 companies whose shares trade on Forge, Hiive and EquityZen, and found an average of 27.5, with 78% falling into the emerging, thin or minimal evidence bands, and 129 of them rating human-only. They're valued like technology companies. They're not operable like one. I also found the same finding told a different way: many are [open at launch and quietly walled off by Series D](https://apievangelist.com/2026/08/06/open-at-launch-walled-off-by-series-d/).

I also wrote up why [doing GraphQL is governance by default, while doing REST simply isn't](https://apievangelist.com/2026/08/06/doing-graphql-is-governance-by-default/), which genuinely surprised me to write, given how ambivalent I've generally been about GraphQL. You can't ship the first query without a single, consistent, typed schema, so the machine-readable contract that REST governance programs spend two years trying to produce is just *there*, from the moment the server starts. In REST, governance is something you impose from the outside, against the grain, forever.

The overlays series continued this week too, with pieces on [governance as an artifact rather than enforcement](https://apievangelist.com/2026/08/02/openapi-overlays-for-governance-as-an-artifact/), and [environment promotion across dev, staging and production](https://apievangelist.com/2026/08/05/openapi-overlays-for-environment-promotion/). And onboarding reviews landed on [Ping Identity's two roads to a programmatic client](https://apievangelist.com/2026/08/01/ping-identity-two-roads-to-a-client/), [WorkOS handing you a dashboard key and then letting the agents run](https://apievangelist.com/2026/08/03/workos-dashboard-key-then-agents-run/), and [Stytch, which has already built the self-serve onboarding the agentic web actually needs](https://apievangelist.com/2026/08/05/stytch-built-self-serve-onboarding/). Plus a handful more worth a look: [agents don't magically understand your API](https://apievangelist.com/2026/08/04/agents-dont-magically-understand-your-api/), [the tool is one implementation among many](https://apievangelist.com/2026/08/05/the-tool-is-one-implementation-among-many/), [transparency logs for API authorization](https://apievangelist.com/2026/08/04/trust-in-protocols-not-institutions-transparency-logs-for-api-authorization/), [governing an API standard with ADRs and attacker models](https://apievangelist.com/2026/08/06/show-your-work-governing-an-api-standard-with-adrs-and-attacker-models/), [strip out the university and this is a template](https://apievangelist.com/2026/08/03/strip-out-the-university-and-this-is-a-template/), and [my current stance on how I use artificial intelligence](https://apievangelist.com/2026/08/03/my-current-stance-on-how-i-use-artificial-intelligence/).

Here's the thing I keep circling back to. We spent twenty years building a discovery layer out of files at well-known paths that honestly describe a site's intentions, `robots.txt`, `llms.txt`, OpenAPI, APIs.json. The most consequential commercial development on the web right now is described in none of them. Who gets billed, who walks in free, which intermediary collects, what the price even is, all of it lives in edge configuration and response bodies, discoverable only by impersonating a crawler and reading a status code. You cannot govern what you cannot observe. That's the same sentence I keep writing, about agent cards, about Spectral, and now about Time's markdown too, and it keeps being the answer.

![](https://fmxorstnlyoqpqdftivs.supabase.co/storage/v1/object/public/article-images/3c8ce8e6-6e56-40ce-9ef0-480f913d2840/319513cc-a8d5-4044-a3fe-2f861b81032a/1786384255384-mwp9osxj.png)

## A Conversation: Tony Tam on the Backstory of Swagger

I've wanted to record this one for a long time.

[YouTube video](https://youtu.be/AY2c9JrOFi0?si=K-LPHHA5S5dCiALe)

[Tony Tam](https://conversations.apievangelist.com/store/2026-08-04-tony-tam/) created Swagger, the specification that became OpenAPI, and founded Wordnik, where it all started. We went right back to the late-night desperation that kicked it off: a six-person team who couldn't keep up with hand-writing clients and documentation, and an email Tony sent at three in the morning asking, essentially, what if the API could just describe itself. From there we traced the whole arc, the accidental naming, the stranger who turned up in an IRC channel one day to mention they were pushing two billion dollars a day through it, the inversion from code-generates-spec to spec-generates-server, and the eventual move into the Linux Foundation. Then we got to the part I most wanted to ask about: the two moments he realised this would matter for AI, why an OpenAPI document is now effectively a ticket into AI infrastructure, whether AI even needs APIs at all, and where the human craft of designing a contract still adds real value when machines are writing most of the code.

Put that conversation against everything above, and it lands differently. This week, the industry reached back into a drawer of specifications written years before anyone said "agent" and found that most of them still worked. Tony's document is the oldest thing in that drawer, and it turned out to be the one that mattered most. Every provider now scrambling to become legible to an agent is discovering that the artifact they needed was the one somebody wrote at three in the morning in 2010, because he was simply tired of writing documentation by hand. The vocabulary keeps changing. The contract endures.

If you're one of the people whose job is now to make sure your own platform is legible in exactly that way, to buyers as well as agents, that's really what this week's newsletter has been circling the whole time. The API Management Market Report has the full picture: where the market stands right now, who's setting the pace, and where the five providers scoring zero on agent readiness are actually falling short. It's worth ten minutes with your morning coffee, even if you don't buy anything.

[Read more about the report →](https://app.notion.com/p/BLOG-POST-URL?utm_source=apievangelist&utm_medium=email&utm_campaign=api-management-market-report&utm_content=warm_variant_closing)

See you next week.

**📄 **[**The State of Cybersecurity APIs**](https://papers.apievangelist.com/papers/state-of-cybersecurity-apis/?utm_source=apievangelist&utm_medium=email&utm_campaign=state-of-cybersecurity-apis&utm_content=footer) — 1,964 security companies scored at 30.2 against a catalog average of 22.5, the second-best-scoring market of twenty-five I've assessed. Genuinely competent, and the report says so. Then there's the disclosure gap: 72% won't tell you how to report a vulnerability, right as the EU Cyber Resilience Act requires exactly that. **$500**

***

## Discussion

No replies yet.