AGNTCon + MCPCon 2026: Why MCP management is the next step in AI governance

I attended AGNTCon + MCPCon North America in San Jose last week. Session after session, the conversation came back to two questions every business now faces. How do we get real value from AI? And how do we stay in control while we do it?

Key takeaways for IT leaders

• Open standards like the Model Context Protocol (MCP) are becoming baseline infrastructure. Supporting them no longer sets a vendor apart.
• Agents should earn autonomy step by step. This is the principle of least agency.
• MCP gateways are table stakes. Governing MCP at scale takes MCP management.
• Every AI agent needs a verifiable identity before access, audit and cost controls can work.
• Token spend is now a budget line item that needs owners and limits.

Here are the five shifts that stood out to me.

1. The AI agent stack is becoming open infrastructure

On opening day, the Agentic AI Foundation added four projects to its home for open standards, including Agent Skills from Anthropic and Open Responses from OpenAI. It now hosts ten projects, including MCP, the open standard for connecting AI agents to tools and data. Agent skills, model interfaces and tool connections are becoming shared standards, not proprietary features.

For enterprises, that lowers switching costs. It also means protocol support will soon be a baseline, not a reason to pick a vendor. The harder question is how to govern everything running on those protocols.

2. Autonomy should be earned: why least agency matters

Restraint was the most common thread on the agenda. Sessions included “Bounded Autonomy: It’s Earned, Not Granted” and “Should This Be an AI Agent?” Red Hat showed agents that start with zero access and gain capabilities one at a time.

We call this least agency. Least agency is the principle that an AI agent gets only the autonomy its job requires. Least privilege limits what a user can access. Least agency also limits how much an agent can decide on its own. An agent that reads orders shouldn’t issue refunds unless that is its job, and a large refund may still need a person to approve it.

3. MCP gateways are table stakes. MCP management is next.

MCP gateways, which route agent requests and check credentials, showed up all over the agenda. But a gateway only handles one moment, when a request passes through. Running MCP across a business means knowing which servers and tools exist, deciding what each agent can see, and tracking how it’s used over time.

IBM’s Karthik Karunanithi made this case in “The MCP Cold-Start Problem,” which looked at an agent that has 100 tools and has to pick one. Every tool an agent can see is another chance to pick the wrong one. Deciding what each agent sees is a management decision. It mirrors the shift years ago from API gateways to API management.

4. AI agents need identities before they can be governed

You can’t control what you can’t identify. Several sessions covered how MCP is reshaping OAuth, including a move toward Client ID Metadata Documents, which give each AI client a verifiable identity instead of anonymous one-off registrations. Others focused on registries and catalogs that track which agents exist and what they can do. Access rules, audit trails and cost tracking all depend on knowing which agent did what, for whom.

5. Token spend is the new IT line item

Honeycomb reported that agents now make more than 40% of its weekly queries. Datadog uses agents to review more than 10,000 pull requests a week. Capital One runs multi-agent pipelines with compliance guardrails built in. At that scale, token spend becomes a line item, and several sessions covered cost attribution and spend limits. These systems need owners, budgets and an off switch, like any other production system.

Why rules, agents and people need the same access

Most enterprises run three kinds of automation side by side. Rules still run the core, like orders into the ERP and payroll into the HRIS. Agents read, reason and act alongside those workflows, like pulling supplier invoices from PDFs. And people approve and handle exceptions, like credit and refund approvals.

All three touch the same systems and data. Yet most companies add a separate tool for each need: one for app sync, one for data movement, one for EDI, one for APIs and now one for MCP. The same order ends up wired five different ways, with no single view of who or what can touch it. Gartner predicts that 70% of organizations building multi-LLM apps and AI agents will use integration platforms for data orchestration by 2028.

Security teams solved a version of this problem years ago. Instead of managing a separate login for every application, they moved to a single identity provider, so every app shares one set of identities and permissions. Automation needs the same move. Celigo is one platform that connects the business once and runs every kind of automation on top of it. Companies already use it to connect ERP, CRM, commerce and trading partners and to move data between them.

MCP Management extends that foundation to AI. MCP management means discovering, controlling and monitoring every MCP server, tool and agent across the business. Teams can discover the MCP servers in use, control what each agent and person can reach, and connect AI to systems that are already integrated and governed. Every rule, agent and person works through the same identity, permissions and audit trail. That is least agency, applied across the business.

The builders in San Jose made it clear that value and control are not a tradeoff. The companies that get the most from AI will be the ones that connect it to their business on a foundation they already trust, with every action governed from the start.

Want to see what that looks like in practice? Watch the replay of our MCP Management webinar to see how teams discover, control and connect AI across the business on one platform. Watch the webinar replay