Almost every enterprise agent announcement in the past ten days was about permissions, not answer quality.
Salesforce introduced seven named Agentforce agents on September 11 — Casey, Paige, Carter, Hunter, Marshall, Piper, Fin — each scoped to a business function and sitting on the existing Customer 360 data platform, operating inside a company's current business rules, permissions, and security setup. Two days later, Boomi's Agent Control Plane surfaced with the same premise from the other direction: reporting that a large share of enterprise agents run without meaningful security controls, and a product to give organizations oversight of how agents reach systems, data, and resources. OpenAI's in-app browser fits the pattern — it keeps state separate from a user's Chrome profile, walls the agent off from extension DOM and data, and lets admins disable the browser, restrict sites, block credential imports, and enforce policies users can't override.
Treat the vendor specifics as trade-press summaries until you've read the release notes. The direction is the signal.
The protocol layer moved first
MCP's 2026-07-28 specification — the largest revision since launch — made the protocol stateless at its core, via six SEPs, alongside an Extensions framework, Tasks, MCP Apps, authorization hardening, and a formal deprecation policy. The deployment consequence is real: a remote server that previously needed sticky sessions, a shared session store, and gateway-level packet inspection can now sit behind an ordinary round-robin load balancer. That's a genuine operational win, and it relocates work rather than removing it. If your knowledge server carried per-session cursors, pinned documents, or accumulated retrieval context, that state is now yours to model explicitly — which is better, but it's a migration.
The more interesting item is unfinished. The updated roadmap published August 22 notes the Server Card Working Group is still working through `.well-known` metadata conventions so a server can be discovered and reasoned over without connecting to it. Today, enumerating what a server exposes means opening an authenticated connection to it. At three servers that's fine. At three hundred internal ones — every team's wiki, ticket system, warehouse view — building a catalog means a fan-out of live connections, and your tool-selection retrieval index is only as fresh as your last crawl.
Why this matters if you build the index
Static server metadata turns tool discovery into a build-time artifact. You can index it offline, diff it between releases, and review capability changes in CI instead of discovering at runtime that a connector grew a `delete` tool. For anyone doing retrieval over tool descriptions — which is what tool selection becomes past a few dozen tools — that's the difference between a stable corpus and a moving one.
What none of this week's launches solves is permission-aware retrieval itself. Enforcement at the action layer is not enforcement at the index layer: if a user-scoped query can pull a chunk from a document that user can't open, you've leaked through the summary. That still requires ACL-carrying chunks and filter-during-search, with the recall cost that implies. The protocol is catching up. Your retriever still has to do its own homework.