---
type: "article"
title: "API Evangelist Weekly — We Gave Agents an Identity, Then Measured the Enforcement Behind It"
summary: "7,424 unique posts across 1,787 provider blogs between September 6th and 13th. Last week four vendors shipped agents an identity. This week researchers checked what those identities are actually allowed to do and found one in five MCP access policies broken or missing — while agents claiming to be OpenAI systems wrote seventeen thousand posts to a wiki that was not supposed to accept writes. Meanwhile a second way of connecting an agent to your API showed up, and it is not a protocol."
newsletter: "API Evangelist"
newsletter_handle: "apievangelist"
newsletter_url: "https://usecommune.com/n/apievangelist"
author: "Kin Lane (@kinlane)"
published: "2026-09-14T19:49:15.997Z"
canonical_url: "https://usecommune.com/n/apievangelist/a/TGZAtr5a"
markdown_url: "https://usecommune.com/n/apievangelist/a/TGZAtr5a.md"
chat_url: "https://usecommune.com/n/apievangelist/a/TGZAtr5a/chat"
body_source: "native"
likes: 0
replies: 0
body_words: 2462
---

# API Evangelist Weekly — We Gave Agents an Identity, Then Measured the Enforcement Behind It

Two weeks ago I wrote that the agent could hold a credential but not obtain one. Last week the industry answered by shipping the credential — four identity products inside seventy-two hours — and I said the floor had arrived and the ceiling existed only as blog posts.

This week somebody measured the gap between them.

Researchers went and looked at MCP access policies in the wild and found that **one in five came back broken or missing**. Not weak. Not overly permissive. Broken, or simply absent — a policy file that does not parse or does not exist, sitting behind a server that is answering agent requests anyway.

Put that next to the incident that landed the same week. Agents identifying themselves as OpenAI systems wrote **seventeen thousand posts** to a wiki that was not supposed to accept writes from them. The identity worked. The agents announced what they were, honestly, in the user agent. Nothing stopped them, because on the other side of that honest identity there was no policy to consult.

That is the whole story of this week and I do not think it is a coincidence of timing. We spent eighteen months building the authentication half because it is the half with a product shape — you can sell an identity provider. The authorization half is a config file somebody has to write for every server, and one in five of them has not been written.

I will say the obvious thing once: this is not an agent problem. We have been shipping broken access policies since before anyone said the word agent. What changed is the volume, the speed, and the fact that the thing holding the credential no longer gets tired at five o'clock.

![A vast dark neon grid where a towering brilliantly lit checkpoint gate stands wide open, streams of small angular light-vessels pouring through it unimpeded, and immediately behind the gate a long row of empty pedestals where control mechanisms should stand — most of them bare, a few holding cracked and dark fragments.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-09-14-enforcement-layer-empty.png)

## The Enforcement Layer Got Measured, and It Is Mostly Empty

- The finding: [researchers found one in five MCP access policies came back broken or missing](https://thenewstack.io/mcp-vibe-coding-security/). Read the methodology before you quote the number — this is a sample, not a census — but a twenty percent failure rate on the file that decides what an agent may do is the most concrete thing anyone published this week.
- The incident: [agents identifying as OpenAI systems wrote 17,000 posts to a wiki no one was supposed to write to](https://venturebeat.com/security/agents-identifying-as-openai-systems-wrote-17-000-posts-to-a-wiki-no-one-was-supposed-to-write-to). I flagged the early version of this story two weeks ago when OpenAI called for disclosure standards. Now it has a number attached, and the number is the point: honest disclosure without enforcement is just a well-labelled flood.
- The argument caught up. [Akeyless: IdP-centric IAM falls short for agent identity](https://www.akeyless.io/blog/ai-agent-identity-security-idp-centric-iam-falls-short/) — which is last week's "identity is not enough" thesis, now aimed specifically at the architecture the four vendors shipped. And [Cerbos came back from Identity Week America with the bleakest one-line summary of the year](https://cerbos.dev/blog/identity-week-america-2026): same AI agent authorization problem, different badges.
- Then the frameworks arrived, and here is my favourite detail of the week. [Arcade published a six-stage agent lifecycle governance framework](https://www.arcade.dev/blog/ai-agent-lifecycle-governance/). [Grip published a five-stage continuous agent governance framework](https://www.grip.security/blog/viaro-beyond-policy-checklists-5-stage-ai-governance-framework). Same week, same problem, different stage counts. When a field starts producing competing numbered frameworks, it has stopped discovering and started marketing — and neither framework helps the one-in-five whose policy file does not parse.
- Underneath, real primitives moved. [HackerNoon on why SPIFFE agent identities can still be replayed, and how WIMSE fixes it](https://hackernoon.com/why-spiffe-agent-identities-can-still-be-replayed-and-how-wimse-fixes-it) is the most technically serious thing in this section. [SpruceID asked what happens when an agent acts on behalf of a resident](https://blog.spruceid.com/when-an-ai-agent-acts-on-behalf-of-a-resident/) — delegation with a government on the other end. And [WorkOS documented how Neon made Postgres claimable for agents with an ](https://workos.com/blog/neon-claimable-postgres-auth-md-case-study)`auth.md`. Another markdown file in the root of your project that quietly became production configuration. I have a paper about that.

![An immense dark neon grid split down the middle: on the left a tall elaborate multi-tiered protocol tower bristling with connectors and scaffolding, on the right a simple low open plinth holding a single flat glowing tablet, with small angular light-vessels visibly choosing the plinth and leaving a widening empty lane before the tower.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-09-14-skills-over-mcp.png)

## A Second Way to Connect an Agent Showed Up, and It Is Not a Protocol

- [Arcade published the sharpest piece of the week: "Skills Over MCP: The Unmerged Draft OpenAI Shipped"](https://www.arcade.dev/blog/skills-over-mcp-explained/). The title carries the story. A draft that never merged became a shipped product surface, and the thing it competes with is the protocol everyone spent eighteen months adopting.
- The comparison posts started immediately, which is always the tell. [NowNodes put MCP, Agent Skills and llms.txt side by side](https://nownodes.io/blog/agent-skills-vs-mcp-vs-llms-txt-what-actually-helps-ai-build-on-blockchains/) and asked which actually helps an agent build against you. That is a three-way now, and two of the three are just files.
- First-party skills started shipping. [Auth0 released Agent Skills for auditing your own tenant](https://auth0.com/blog/audit-your-auth0-tenant-with-auth0-agent-skills/) — an identity vendor shipping a skill rather than a server, in the same week its category was arguing about enforcement. [The Linux Foundation's Decentralized Trust group shipped Web3j skills for agentic development](https://www.lfdecentralizedtrust.org/blog/web3j-skills-for-agentic-development).
- And a useful counterweight: [Redocly says llms.txt is still overhyped](https://redocly.com/blog/llms-txt-still-overhyped). They have been consistent on this for a year and I think they are right, which matters more now that llms.txt is being offered as a peer to MCP rather than as a curiosity.

I wrote [Agent Skills: New Value, New Problems](https://apievangelist.com/2026/09/10/agent-skills-new-value-new-problems/) this week, and I will restate the part I care about. A skill is markdown. It has no versioning story, no deprecation story, no registry, and no way to tell you it changed. MCP has real problems — this issue opens with one in five of them — but it is a protocol with a spec and a revision history. We are about to trade a protocol with known flaws for a file with unknown ones, and we are going to do it because the file is easier to write on a Tuesday.

***

**📄 **[**The Agent Era Standards Onramp**](https://papers.apievangelist.com/papers/the-agent-era-standards-onramp/?utm_source=apievangelist&utm_medium=email&utm_campaign=the-agent-era-standards-onramp&utm_content=midpoint) — MCP, Agent Skills, llms.txt, OpenAPI, JSON Schema, AsyncAPI, Arazzo, APIs.json, agent descriptors. One provider wrote a three-way comparison of the first three this week and a fourth argued one of them is overhyped, which is roughly where a reader with a first public API gives up. This paper is the sequenced path through that list — what to publish first, what earns its place next, and what you can safely ignore until later. One rung at a time, in order, rather than all of it at once because a vendor blog said so. **$25**

![A long dark neon workshop where a single glowing blueprint scroll unrolls across a bench and three separate finished structures rise directly out of it — an archway, a tower and a small kiosk — each one traced in the same light as the blueprint beneath them, with no second blueprint anywhere in the room.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-09-14-one-description-three-surfaces.png)

## The Description Layer Quietly Won the Argument It Was Not In

While two camps argued about how agents should connect, a quieter group kept generating both ends from the document they already had.

- [Tyk published the cleanest version: one tool, three surfaces — from an OpenAPI file to an MCP server, without writing it twice](https://tyk.io/blog/one-tool-three-surfaces-from-an-openapi-file-to-an-mcp-server-without-writing-it-twice/). That is the whole argument in a headline. If your MCP server is generated from your OpenAPI, the Skills-versus-MCP fight is a rendering decision, not an architecture decision.
- [Redocly went the other direction and shipped introspect-mcp, documenting an MCP server from the server itself](https://redocly.com/blog/introspect-mcp) — recovering a description from a running protocol endpoint, which is what you need when somebody built the server first and the document never.
- [Backblaze shipped a B2 MCP server](https://www.backblaze.com/blog/introducing-the-backblaze-b2-mcp-server/), and the long tail kept going: Aave, Upstash going remote, CARTO, Pleo, Zoho PageSense, SerpApi bundles, Sigma, Buildkite, Open Liberty shipping `mcp-1.0` alongside protected resource metadata.
- [MuleSoft added governance to its Agent Registry](https://blogs.mulesoft.com/news/new-in-agent-registry-informatica-mdm-and-the-governance-that-comes-with-it/). A registry with governance attached is the thing the one-in-five finding says is missing, arriving as a commercial product rather than a standard. Expect five of these.

My own week went entirely into this seam, and I will spare you the full list: [Microsoft documented its OpenAPI extensions for a decade and never registered them](https://apievangelist.com/2026/09/07/microsoft-documented-its-openapi-extensions-for-a-decade-and-never-registered-them/), [the AWS API Gateway extensions are a de facto standard](https://apievangelist.com/2026/09/08/the-aws-api-gateway-extensions-are-a-de-facto-standard/), [ReadMe is carrying working code in eighty companies' contracts](https://apievangelist.com/2026/09/09/readme-is-carrying-working-code-in-eighty-companies-contracts/), [Stoplight is an extension that outlived its acquisition](https://apievangelist.com/2026/09/10/stoplight-an-extension-that-outlived-its-acquisition/), and [Stainless keys are inside the AI providers' specifications](https://apievangelist.com/2026/09/11/stainless-keys-are-inside-the-ai-providers-specifications/). Five companies, thousands of contracts, one registry nobody files with.

![A dark neon plain where a wide bright gateway arch stands over a roadway, and set into the arch's underside a dense cluster of locking mechanisms and keyed apertures glows far brighter and more intricate than the arch itself, small angular light-vessels pausing at each aperture in turn.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-09-14-gateway-hard-part-is-auth.png)

## MCP Grew a Security Literature, and Payments Woke Back Up

Two shorter threads worth putting next to each other.

**MCP now has enough security material to curate.** [Adversa published a "top MCP security resources" roundup for September](https://adversa.ai/blog/top-mcp-security-resources-september-2026/) — you only write that once there is a field. [Pomerium worked through what the OWASP framework requires and, more usefully, where enforcement actually has to live](https://www.pomerium.com/blog/mcp-governance-what-the-owasp-framework-requires-and-where-enforcement-has-to-live). Two weeks ago OWASP was drafting a taxonomy; now vendors are implementing against it. [WorkOS states the thing plainly: the hard part of an MCP gateway is auth](https://workos.com/blog/mcp-gateway-hard-part-is-auth), which is worth remembering while three gateway categories are sold into the same rack. [FusionAuth compared client identity metadata against dynamic client registration](https://fusionauth.io/blog/cimd-vs-dcr) under the best title of the week — dinner party or nightclub. [Salt shipped continuous MCP server visibility for Claude Enterprise](https://salt.security/blog/introducing-the-salt-claude-connect-continuous-mcp-server-visibility-for-claude-enterprise), and [The New Stack argued MCP security is really a permissions overhaul](https://thenewstack.io/mcp-security-permissions-overhaul/). It is.

And [Nango shipped an explainer on MCP elicitation — how agents ask users for input mid-tool-call](https://nango.dev/blog/mcp-elicitation-explained/). I have been tracking this one for three weeks: it went from a think-piece about multi-hop consent, to a spec feature, to LangChain shipping it, to an explainer aimed at people deploying it. That is the fastest path from problem to plumbing I have seen in this space, and it is the one genuinely good answer anyone has given to the consent-chain question.

**Agent payments came back.** After collapsing to five posts last week, the thread produced eleven — and the shape changed from protocol-fight to how-to. [Dodo Payments wrote explainers for both AP2](https://dodopayments.com/blogs/ap2-protocol-agent-payments/) and [x402](https://dodopayments.com/blogs/x402-protocol/). [Basis Theory published how to actually start accepting agent payments](https://blog.basistheory.com/accepting-agent-payments). [Formance covered protocols, rails and ledger controls](https://www.formance.com/blog/product/ai-agent-payments-protocols-rails-ledger-requirements) and, better, [the duplicate-payment problem and the idempotency fixes for it](https://www.formance.com/blog/industry-analysis/ai-agent-duplicate-payments-idempotency). That last one is the adult in the room. An agent that retries is an agent that double-charges, and idempotency keys are a 2013 answer to a 2026 panic.

![A dark neon amphitheatre seen from within, its concentric curved tiers lit with rows of small steady seat-lights facing a low central dais, while above the dais an open measuring-frame of bright beams hovers, casting an even grid of light across every tier.](https://kinlane-images.s3.amazonaws.com/apievangelist/api-evangelist-images/newsletter/2026-09-14-from-my-desk-toronto.png)

## From My Desk: Toronto, and the Room That Did Not Argue

I was at APIdays Toronto this week, which is why there is no conversation in this issue.

- I went to [argue that agents inherit your governance](https://apievangelist.com/2026/09/07/agents-inherit-your-governance-at-apidays-toronto/) — that whatever you already do badly, an agent will do badly at scale and at speed. Given what this issue opens with, I would now put it more bluntly: the one in five is not an agent failure, it is an inherited one.
- Then I showed the Kin Score to a room of practitioners, and [the room did not argue with it](https://apievangelist.com/2026/09/10/the-toronto-room-did-not-argue-with-the-score/). I have been carrying this rubric for a while expecting a fight about the weightings, and the fight did not come. People argued about what to *do* with the number, which is a much better conversation and not one I was prepared for.
- On MCP, where I have been mostly critical, I wrote the other half: [the good parts of MCP are prompts and resources](https://apievangelist.com/2026/09/08/the-good-parts-of-mcp-prompts-and-resources/). Everyone implements tools and ignores the two primitives that carry context. If you are weighing skills against MCP, weigh this — a skill can hold a prompt, but resources are the part nobody is replicating.
- Elsewhere: [when AI agents start acting, APIs become execution contracts](https://apievangelist.com/2026/09/10/when-ai-agents-act-apis-become-execution-contracts/). [What three models say about sixty-five API providers](https://apievangelist.com/2026/09/08/what-three-models-say-about-twenty-two-api-providers/) — I asked three of them the same questions about the same catalog and compared the answers. [Plumma carries CAMARA's vocabulary without its endpoints](https://apievangelist.com/2026/09/08/plumma-carries-camaras-vocabulary-without-its-endpoints/), which is the standards-adoption failure mode I keep finding: the nouns arrive, the contract does not. [Google makes the machine credential scriptable and the OAuth client console-only](https://apievangelist.com/2026/09/08/google-oauth-console-only-service-accounts-scriptable/) — the onboarding series, still finding the same door.
- And two that are not about APIs at all: [I am anti-AI and I run my business on it](https://apievangelist.com/2026/09/10/i-am-anti-ai-and-i-run-my-business-on-it/), and [forcing people to prove they are robots when you are all in on AI](https://apievangelist.com/2026/09/07/forcing-people-to-prove-they-are-robots-when-you-are-all-in-on-ai/).

The thing I keep turning over after Toronto: every person in that room already knew their access policies were thin. Nobody was surprised by the score. The gap is not knowledge and it is not tooling — we have had policy engines for a decade. It is that writing the policy has never once been the thing anyone was rewarded for shipping.

One in five. That number will not move because a fifth framework arrives with seven stages.

See you next week.

***

**🔌 **[**APIs.io Influence — agent readiness across the whole catalog**](https://apis.io/developer/plans/?utm_source=apievangelist&utm_medium=email&utm_campaign=apisio-pro&utm_content=footer) — This issue is one long argument that the agent layer is unmeasured. The measurement is the product: every provider in the catalog scored on agent readiness, as dimensions you can query rather than a number you have to trust.

Single-provider reads are free, and always will be — look up any one company, its APIs and its artifacts without a key. Agent readiness *across* the catalog is the part that is not, because ranking a field is a different product from looking up a member of it.

**The operation worth your week:** find the providers in your own stack, then look at which readiness dimensions they actually fail — before you write another integration against one.

```javascript
curl -H "X-API-Key: $KEY" "https://apis.io/api/v1/agent-readiness?limit=50"
curl -H "X-API-Key: $KEY" "https://apis.io/api/v1/agent-readiness/dimensions"
```

Same data as the `find_agent_readiness` and `agent_readiness_dimensions` MCP tools. Note the keyless response is a `401`, not a `402` — you need a key before the tier question even applies, so [log in with GitHub](https://apis.io/api/v1/auth/login) for a free Learn key first and see how much of the catalog answers you for nothing. **Influence is $499/mo, or $4,990/yr.**

***

## Discussion

No replies yet.