The substrate gap

The test#

Pick an action a real organisation would care about. An agent adjusts a laser’s PID parameters on a running experiment. It moves €4,000 to a supplier. It amends a batch record. Then ask three questions. Who authorised this — not which token validated, which person, holding what authority, at what time? Can that authority be withdrawn mid-flight — not will the token expire, but can a human revoke it in the next four seconds and have the machine stop? And can the first answer be reconstructed in eighteen months, by someone who was not there, against a challenge?

Every layer above answers those questions inside itself and drops them at its boundary. That is the substrate gap. It is not that pieces are missing. It is that nothing carries accountability across the seams between the pieces — and the seams are where all the consequential work happens.

The principal is dropped at the first hop#

The IETF solved delegated authority in January 2020. RFC 8693 §1.1 draws the distinction that matters: under impersonation, principal A “is indistinguishable from B in that context”; under delegation, “principal A still has its own identity separate from B… In a sense, A is an agent for B.” The act claim names the acting party, nested act claims represent prior actors, and the may_act claim states in advance which actor may act for a subject. That is a delegation chain — standardised, registered with IANA, six years old, and describing an agent in so many words.

MCP does not use it. Search the complete 2026-07-28 specification tree for on-behalf-of, delegation, delegate, token exchange, or RFC 8693 and each returns zero occurrences. What MCP has instead is a deliberately one-hop model: the server is an OAuth 2.1 resource server for exactly one audience, and forwarding is forbidden — “MCP servers MUST NOT accept or transit any other tokens,” and “The MCP server MUST NOT pass through the token it received from the MCP client.”

This is good security engineering. The confused-deputy problem is real and MCP closes it. But watch what happens to the principal. At hop one the token says: this agent, acting for this human, may do this. At hop two it says: this server may do this. The human is not hidden. The human is absent. There is no protocol-carried record of the original principal, because the protocol has nowhere to carry one.

A2A gets closer and then declines. Its only chaining mechanism is TASK_STATE_AUTH_REQUIRED, which “enables forming a chain of Tasks in TASK_STATE_AUTH_REQUIRED” — a chain of requests for permission, not a chain of verifiable authority. And it warns, correctly, that in-band credential exchange “can allow credentials to be passed across chains of multiple A2A agents, exposing those credentials to each agent participating in the chain.” Neither protocol is careless. Both scoped the problem out, and the scope-out is load-bearing: “Identity information is handled at the protocol layer, not within A2A semantics.” Which protocol layer? That is the seam.

There is corroborating evidence that the industry knows. The Linux Foundation announced its intent to launch an Agent Name Service on 23 June 2026, framed as letting operators “verify who an agent represents, what permissions it has, and whether its code and operational history remain authentic,” and a DNS-AID project on 27 May 2026. Neither would be necessary if MCP or A2A covered identity.

Nothing can be taken back#

Ask what happens when a human wants to stop an agent that is already running. A2A answers explicitly, and this is the sharpest sentence in either specification: “The A2A protocol does not define the scope, representation, validity, or revocation semantics of the authorization decision or credential obtained in response to this state.” It goes further and forbids inferring standing authority. What remains is a local best-practice bullet — “Agents SHOULD implement credential revocation mechanisms” — with no wire format.

MCP is silent, and the silence is the finding: revoke and revocation appear zero times across the entire 2026-07-28 specification tree. The only available lever is expiry, and the guidance is that authorization servers should issue short-lived access tokens. Expiry is not revocation. Expiry is a timer that does not know why you want it to stop.

This matters most precisely where the Model Hardware Standard now puts agents. QuEra’s laser held lock across a nineteen-hour unattended run. Carnegie Mellon’s agent orchestrated three computers, one of them a GUI-only instrument with no API at all. In both cases the correct question during hour eleven is not “has the token expired” but “does the person who authorised this still authorise it, and how fast can they say no.”

So far as we can find, one institution has written this down as a requirement. The Monetary Authority of Singapore published Safeguards for Agentic Finance at Runtime on 3 July 2026: a runtime checkpoint between every agent decision and its execution, built on a verified agent identity, a controls repository, a disposition engine, and a “tamper-evident, append-only” audit log described as “the authoritative record, independent of any party with an interest in how events are characterised after the fact.” And the sentence that names the seam exactly — in multi-step workflows, “prior authorisation should not carry forward.” SAFR is a non-binding paper from a central bank, not a protocol. It is also the clearest published statement of what the missing layer has to do.

There is no record#

Neither MCP nor A2A defines any portable record of what happened. Across both complete specification texts: provenance zero, ledger zero, non-repudiation zero. MCP mentions audit exactly once, in non-normative tool guidance. A2A mentions it twice, both as local SHOULDs, with no schema, no export format, and no cross-agent correlation requirement — then hands the question to implementers: “Authorization boundaries are defined by each agent’s authorization model, not prescribed by the protocol.”

The closest either ecosystem gets is observability. MCP 2026-07-28 adopted OpenTelemetry trace context propagation in _meta. Trace context is unauthenticated, self-asserted, and discarded on a retention schedule. It is excellent for debugging one operator’s stack and useless as a cross-organisational record of who authorised what.

And in the same revision, MCP removed the last thing that resembled continuity. The 2026-07-28 spec removed protocol-level sessions and the initialize handshake entirely. It now states: “MCP has no protocol-level session, so a server cannot rely on implicit per-connection state to relate one tool call to the next.” This is, again, correct engineering — sessions in a protocol are a liability. But it means the durable thread of an agent’s work is now, by design, somebody else’s problem. Everyone building on MCP has to build it, and almost nobody builds it the same way. That is the definition of a substrate gap.

The memory literature is measuring the wrong thing#

If continuity is somebody else’s problem, the obvious reply is that this is what memory systems are for. The evidence there is worse than the marketing. LOCOMO is the field’s de facto scoreboard. On it, Mem0’s graph variant reports about 68.5 per cent. Zep, re-running its own evaluation, reports 75.14 per cent. The full-context baseline — no memory system at all — scores about 73. And Letta, the team behind MemGPT, reached 74.0 with GPT-4o-mini and a plain filesystem: grep, search, open, close.

A benchmark on which a filesystem beats every specialised memory product, and on which doing nothing beats the market leader, is not measuring memory. Zep’s own critique enumerates why: conversations average 16k–26k tokens, comfortably inside modern context windows; there are no knowledge-update questions; an entire category is unusable for missing ground truth.

The deeper problem is that the field measures capability when the binding constraint is reliability. τ-bench reports pass^1 around 61 per cent on retail and pass^8 around 25 — the same tasks, eight independent attempts, consistency collapsing. METR’s TH1.1 update gives Claude Opus 4.5 a 50 per cent time horizon of 320 minutes, and across models the 80 per cent horizon runs roughly four to ten times shorter. And Vending-Bench found that every model’s coherence declines after roughly 120 simulated days in a way uncorrelated with context exhaustion — bigger windows do not fix it.

A larger context window is not continuity. A vector store is not a record. Continuity is the property that an agent can resume a responsibility after an interruption without inventing context or silently discarding the constraints under which the work began. No benchmark in this literature tests that, because testing it requires a record none of them have.

Money crossed the line before the authority chain did#

Payments are the one place where the money moved first and the questions came later. x402 is genuinely shipped: it settles on Base and Solana mainnet, moved to the Linux Foundation on 14 July 2026 with forty member organisations, and its premier roster reads Adyen, AWS, American Express, Circle, Cloudflare, Coinbase, Fiserv, Google, Mastercard, Ripple, Shopify, Stripe and Visa.

Now the number everyone quotes. As displayed on 30 August 2026, x402.org reports for the trailing thirty days: 75.41 million transactions, $24.24 million volume, 94,060 buyers, 22,000 sellers. Divide, and the average transaction is about thirty-two cents. No published source separates economic volume from testnet, bot, or wash traffic. It is the only public transaction figure in the entire agentic-payments sector, and it is unaudited.

Everything else is earlier than it sounds. AP2’s donation to FIDO on 28 April 2026 is real and its v0.2 specification is substantive, but the SDK and MCP server are not shipped and the samples mock payment service providers. Visa’s own pages for Intelligent Commerce and the Trusted Agent Protocol carry the disclaimer that the product “is in the process of development and deployment.” Mastercard’s Agent Pay release of April 2025 is written entirely in future tense and has published no pilot results. One correction worth making, since most secondary coverage is stale: AP2 launched with Intent, Cart and Payment mandates; the shipped v0.2 has Checkout and Payment only.

And here is the seam. AP2’s mandates are the closest thing the industry has to a portable, cryptographically signed statement of human intent — and they are scoped to a transaction. They authorise a purchase. They do not carry the agent’s standing authority into the next action, they do not chain to the identity layer, and they expire with the checkout. Three separate bodies now claim this layer, and Visa and Mastercard sit on two of them simultaneously. Convergence is asserted, not demonstrated.

Physical work has two rulebooks that do not reference each other#

This is the most important seam, and the newest. Anthropic’s Model Hardware Standard is, in our reading, the most consequential thing that happened to physical agents in 2026 — and it is worth being precise about why, because the reasons are better than the summary.

The results are specific and they are real. At Genentech, Claude converged on flow rates of roughly 140 µL/s for water at 0.016 RMSE and 10 µL/s for viscous BSA at 0.181 RMSE, recovering unaided from tip-pickup and fluid-detection errors. At QuEra, a titanium-sapphire laser relock routine that a four-person team had built over several months worked 58 per cent of the time at about 150 seconds per attempt; an overnight agent loop reached about six seconds and 96 per cent, and a later blind test recovered the lock 695 times in 700 trials. A separate QuEra run tuned twelve PID parameters across 363 experiments in sixteen unattended hours, taking residual error from 15.7 mV to 1.55 mV. At Carnegie Mellon, integration across three computers — one a GUI-only instrument with no API at all — took about eight hours instead of the several weeks a vendor setup takes, and six deliberately induced fault conditions were all blocked before any device moved.

Those are not demos. They are the first credible evidence that the integration tax on scientific instrumentation is solvable, and that an agent operating instruments can beat a specialist at a tuning task while running unattended overnight.

Now the gap. Nothing in the published MHS material references ISO 10218, ISO/TS 15066, performance levels, safety integrity levels, or any functional-safety standard. Doosan Robotics and Universal Robots appear as MHS partners. Both make products governed by exactly those standards. No mapping between the two regimes has been published.

That matters because both regimes moved in the same eighteen months, and neither moved toward the other. ISO 10218-1 and -2 were replaced on 5 February 2025, with both 2011 editions withdrawn the same day. Edition 3 introduces a robot classification — Class I is a manipulator of mass at or below 10 kg, maximum force 50 N, speed 250 mm/s, requiring PL b; Class II is everything else, requiring PL d. ISO/TS 15066’s biomechanical content migrated inward, and the speed-and-separation formulas became normative. ANSI/A3 R15.06-2025 followed on 29 October 2025, adopting the ISO editions and adding an all-new part on the use of industrial robot cells.

So we have a control regime in which an agent discovers a device’s capabilities at runtime from a natural-language manifest, and a safety regime in which a human integrator performed a risk assessment and pinned that device to a class and a performance level before anything ran. Those assumptions are not compatible unless something carries the risk assessment forward into the agent’s operating envelope, and carries the agent’s actual behaviour back into the record. That something does not exist yet.

This is not a criticism of Anthropic for shipping a research preview as a research preview. Anthropic says plainly that it is developing a physical safety roadmap and will publish findings when the standard is open-sourced, and it names its own limits: MHS “doesn’t yet work with hardware that lacks a programming interface,” and Claude’s spatial and physical reasoning “still require expert oversight.” The point is narrower and structural. The seam between the control regime and the safety regime is currently unoccupied, and it is the seam that decides whether any of this deploys in a regulated facility.

For teams that want to work in that seam now, the open hardware is adequate and cheap. An ORCA Hand is 17 degrees of freedom, under 2,000 CHF in materials, buildable in under eight hours by one person, tested past 10,000 continuous cycles. A bimanual OpenArm 2.0 is 7 DOF per arm at 4.1 kg nominal payload for around $6,500, Apache-2.0. A pair of SO-101 arms is $229.88. Berkeley Humanoid Lite is a $4,312 bill of materials with a published sixty-hour durability test. What none of them publish is repeatability — no ISO 9283 figure exists for any of the three, where a UR5e publishes ±0.03 mm. And “open source robot” reliably means open software, sometimes open CAD, and almost never a permissive hardware licence. If you are planning to build on open hardware, budget for characterising it yourself. Nobody has done it for you.

The law will not close it, and has just moved further away#

The reflex is to assume regulation will force the record into existence. It will — later than you think, and it will still not make the agent accountable. Every regime we checked attaches accountability to a legal or natural person. 21 CFR §11.100(a) requires each electronic signature to be “unique to one individual and shall not be reused by, or reassigned to, anyone else” — an agent structurally cannot hold one. DORA Article 5(2)(a) puts ultimate ICT risk responsibility on the management body. AI Act Article 26(2) requires deployers to assign human oversight to natural persons.

That is the correct design. Accountability should terminate in a person. But it means the entire burden of connecting an agent’s actions to that person falls on infrastructure — and the infrastructure deadline just slipped. Regulation (EU) 2026/1744 of 8 July 2026, in force 27 July 2026, amended the AI Act’s timetable. This is adopted law, not a proposal. Article 12 on automatic logging and Article 14 on human oversight moved from 2 August 2026 to 2 December 2027 for Annex III high-risk systems; the Annex I embedded tranche moved from 2 August 2027 to 2 August 2028. The stated reason was delayed availability of standards and common specifications.

So the two provisions that would most directly govern an autonomous agent — the log and the stop button — are the two that just slipped, while the Act became generally applicable on 2 August 2026. Anything written before 27 July 2026 that gives 2 August 2026 or 2 August 2027 as the high-risk date is now simply wrong. Meanwhile NIST SP 800-207 §5.7 has said since August 2020 that how AI and software agents authenticate themselves in a zero-trust architecture “is an open issue.” The control overlays that would address it are still pre-draft. Six years on, still open.

What the missing layer has to do#

Every seam above fails in the same shape: something true at hop n is not representable at hop n+1. So the missing layer is not another protocol beside MCP and A2A. It is the thing they each explicitly decline to be — a durable record that outlives every session, every model, every tool call and every machine, from which four things can be read at any point in time.

Who. A persistent identity for the agent that survives model changes, environment changes and embodiment, with the accountable human attached rather than implied. The workload-identity primitives already exist. What does not exist is the binding from that workload to an organisational principal that persists when the workload is replaced — SPIFFE is candid about its own limit here: trust domain names are “nominally self-registered,” with “no guarantee of global uniqueness,” and colliding domains “will be unable to federate.”

On whose authority. A delegation chain representable on the wire, not reconstructed from logs afterwards. RFC 8693’s nested act claims are the standing IETF answer and neither agent protocol uses them. The chain must narrow as it goes — an agent should be able to grant a sub-agent less than it holds and never more — and it must be inspectable before the action, not only after it.

Until when, and until who says otherwise. Revocation as a first-class event with a defined propagation path, distinct from expiry, reaching a running physical process fast enough to matter. MAS’s formulation is the right one: prior authorisation does not carry forward.

And what actually happened. A tamper-evident record that keeps observation separate from inference, that captures the machine’s telemetry rather than the agent’s claim about the machine, that records interventions as first-class events with who intervened and why, and that can be reconstructed against a challenge years later. Not a transcript — a record of state, evidence and authority, in which ALCOA+’s nine attributes are properties of the system rather than an export format. Those four are one object, not four features. Split them across four systems and you have rebuilt the seam inside your own architecture.

Four tests we will hold ourselves to#

Arguments of this shape are easy to make and hard to falsify. Here is how to check us, and anyone else claiming to close this gap.

The migration test. Move the agent to a different model and a different compute environment. Can it resume the same responsibility, with the same accountable history, while receiving only the authority valid in the new setting? If not, the system moved an application, not an agent.

The revocation test. With a physical process running, have an authorised human withdraw authority. Measure the time from revocation to a stopped actuator, and check that the record contains the revocation, the observed state at the moment of stopping, and the reason — without the agent’s own narration of it.

The embodiment test. Attach a hand. Does a second agent appear in the system, or does an existing agent gain a bounded capability with its own safety envelope, telemetry and revocation path attached to the same record? If a robot creates a new identity, the identity layer was never real.

The reconstruction test. Eighteen months later, with the model retired and the tool decommissioned, reconstruct why a specific decision was made: the observation, the transformation, the inference, the human approval, and the authority in force at the time. If that requires forensics rather than a query, there was no record.

What we do not know#

We should be as exacting about ourselves as about anyone else. We do not know what MHS’s safety enforcement actually is, because it has not been published; we are reasoning from an announcement page and one self-designed fault test. We do not know whether x402’s volume figure represents economic activity or traffic. We do not know how much of the reliability gap is a memory problem versus a different failure mode entirely — Vending-Bench’s finding that coherence collapse is uncorrelated with context exhaustion suggests memory architecture is not the whole answer, and we have no better hypothesis. We do not know whether the EU’s 2027 and 2028 dates will hold.

And we do not know whether the industry will converge on one record layer or fragment into per-vendor ledgers that cannot be reconciled — which would be the substrate gap reproduced one level up.

What we are confident about is narrower and, we think, defensible. For six of the seven seams above, we can point at the specific sentence in the specific specification where responsibility is handed off and not caught. That is an unusual position for an argument about the future to be in. It is also why we think this layer — not another model, not another protocol — is the thing worth building.