Share

The Noun Problem

The Verb-Noun Gap

By Nora Kaplan— July 8, 2026

Feature image for article: The Verb-Noun Gap

Anyone can physically sign a document. The motion is trivial. What makes a signature consequential is everything the motion doesn't contain: authority, scope, organizational recognition. The agent ecosystem is converging rapidly on standardized actions — call, click, discover, complete — and they're getting reliable. But the organizational concepts those actions need to carry weight (mandate, delegation, approval, dispute) remain undefined. The next maturity threshold belongs to acts that can be recognized as acts within the institutions where they happen.

The Noun Problem

The Verb-Noun Gap

By Nora Kaplan— July 8, 2026

Anyone can physically sign a document. The motion is trivial. What makes a signature consequential is everything the motion doesn't contain: authority, scope, organizational recognition. The agent ecosystem is converging rapidly on standardized actions — call, click, discover, complete — and they're getting reliable. But the organizational concepts those actions need to carry weight (mandate, delegation, approval, dispute) remain undefined. The next maturity threshold belongs to acts that can be recognized as acts within the institutions where they happen.

Reading the Spec

What's Inside a Tool Call

By Rina Takahashi— July 8, 2026

Feature image for article: What's Inside a Tool Call

An MCP tool call carries a name, some arguments, and gets back a result. That's the complete method-specific payload. There's no field for who authorized the action, what policy governed it, what state existed before it fired, or how to reverse it. Authorization lives at the transport layer, structurally separate from the invocation. When it's absent, the call looks identical — no field goes empty, no flag flips. The spec gives agents everything needed to execute. Accounting for what happened afterward is someone else's problem.

Reading the Spec

What's Inside a Tool Call

By Rina Takahashi— July 8, 2026

An MCP tool call carries a name, some arguments, and gets back a result. That's the complete method-specific payload. There's no field for who authorized the action, what policy governed it, what state existed before it fired, or how to reverse it. Authorization lives at the transport layer, structurally separate from the invocation. When it's absent, the call looks identical — no field goes empty, no flag flips. The spec gives agents everything needed to execute. Accounting for what happened afterward is someone else's problem.

Primary Sources

MCP Tools Specification (v2025-06-18)

The canonical tool-call schema standardizes name and arguments — a clean verb with no slots for mandate, authority, or approval.

MCP Authorization Specification (v2025-06-18)

MCP's closest gesture toward governance covers transport access, not delegated business authority, and stays optional for the most common transport.

Agent2Agent Protocol v0.3.0 Specification

A First Measurement Study on Authentication Security in Real-World Remote MCP Servers

Observability for Delegated Execution in Agentic AI Systems

An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios

Primary Sources

MCP Tools Specification (v2025-06-18)The canonical tool-call schema standardizes name and arguments — a clean verb with no slots for mandate, authority, or approval.

MCP Authorization Specification (v2025-06-18)MCP's closest gesture toward governance covers transport access, not delegated business authority, and stays optional for the most common transport.

Quick links

Agent2Agent Protocol v0.3.0 Specification

A First Measurement Study on Authentication Security in Real-World Remote MCP Servers

Observability for Delegated Execution in Agentic AI Systems

An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios

Verbs the Ecosystem Has

Every protocol in the agent stack moves something specific across the wire. A schema. A bearer token. A pointer event. A span. The clarifying exercise is mapping where each verb's payload actually stops.

These eight cards trace a path from discovery through execution to observability. Each names a protocol, describes what it delivers, and identifies the point where the technical guarantee ends and the governance question begins. A pattern emerges quickly: the ecosystem has largely standardized how agents reach things and invoke them. How organizations authorize, bound, or contest what agents do remains almost entirely unspecified. That gap looks structural, not developmental.

Verbs the Ecosystem Has

Every protocol in the agent stack moves something specific across the wire. A schema. A bearer token. A pointer event. A span. The clarifying exercise is mapping where each verb's payload actually stops.

These eight cards trace a path from discovery through execution to observability. Each names a protocol, describes what it delivers, and identifies the point where the technical guarantee ends and the governance question begins. A pattern emerges quickly: the ecosystem has largely standardized how agents reach things and invoke them. How organizations authorize, bound, or contest what agents do remains almost entirely unspecified. That gap looks structural, not developmental.

Agent Discovery

Discovery Surfaces What Exists Without Granting Any Access

MCP's tools/list returns tool names, descriptions, and schemas. A2A Agent Cards publish capabilities and endpoints. Both surface what's available. No mandate, approval record, or scope boundary travels with the listing. Finding a tool and being authorized to invoke it remain entirely separate facts.

Session Layer

Connection Opens a Channel Without Binding Any Purpose

MCP's lifecycle negotiates capabilities through JSON-RPC initialize/initialized messages. Authorization is explicitly optional. STDIO transports pull credentials from the environment. A live session proves two parties can exchange messages. What those messages are permitted to cause is a question the protocol leaves open.

Identity Layer

OAuth Authentication Proves Identity and Nothing Beyond That

MCP's OAuth 2.1 layer binds audience-scoped bearer tokens to HTTP requests. It's optional, and measurement studies found widespread deployment gaps. Knowing which client connected is architecturally separate from knowing what that connection may trigger on the server.

Tool Invocation

Tool Calls Carry Arguments, Never an Approval Record

MCP's tools/call sends a tool name and typed arguments. Credentials ride in the HTTP Authorization header, not inside the call body. No standard fields exist for caller identity, human approval, or policy basis. Technically complete, organizationally unbound.

Browser Action

Click Confirms Element Geometry but Not Business Authority

Playwright's actionability checks confirm the target is visible, stable, enabled, and event-receiving before firing. WebDriver scrolls elements into view. The mechanics of clicking are well-handled. Whether that click constitutes an authorized business action, on current data, from a site recognizing automation, goes unexamined.

Context Retrieval

Retrieval Proves Viewing Permission, Says Nothing About Action

RAG pipelines filter results by identity provider or OData security filters, proving the user may see a document. That covers viewing permission. It says nothing about whether an agent may turn retrieved content into a customer commitment, price concession, or CRM mutation downstream.

State Validation

Benchmarks Match Goal States Without Checking Organizational Standing

tau-bench compares agent-produced database states against annotated targets. WorkArena validates through UI and database checks across ServiceNow tasks. Both verify the outcome matched the goal. Authorized delegation and the ability of affected parties to contest the result sit entirely outside their scope.

Execution Trace

Traces Log Execution Without Distinguishing Between Delegation Stories

OpenTelemetry's GenAI conventions capture model calls, agent IDs, tool spans, and token counts. Research shows identical traces can map to multiple incompatible delegation stories. More spans won't fix this. Delegation context itself has to be woven into the observability layer.

Nouns the Ecosystem Needs

Agent protocols specify how to connect and how to invoke. They don't yet specify how to govern. MCP defines a tool call as a name and arguments. A2A defines task states like submitted, working, and completed. Neither carries the governance objects that would make an agent's act accountable, bounded, or reversible.

Commerce is further along because payment rails already carry structures for authorization, dispute, and reversal. Money makes vague delegation operationally intolerable. Outside payments, these concepts remain application-defined or entirely absent.

The eight nouns below name what's missing: governance primitives that would need to exist before an agent's act can survive institutional scrutiny.

Nouns the Ecosystem Needs

Agent protocols specify how to connect and how to invoke. They don't yet specify how to govern. MCP defines a tool call as a name and arguments. A2A defines task states like submitted, working, and completed. Neither carries the governance objects that would make an agent's act accountable, bounded, or reversible.

Commerce is further along because payment rails already carry structures for authorization, dispute, and reversal. Money makes vague delegation operationally intolerable. Outside payments, these concepts remain application-defined or entirely absent.

The eight nouns below name what's missing: governance primitives that would need to exist before an agent's act can survive institutional scrutiny.

Principal Delegation

The delegation that authorizes an agent's act

Without a mandate, there's no way to know whether the agent acted for the right person within the right limits. ACP's delegate-payment field carries allowance bounds, currency, and expiration. MCP's tool-call body carries only a name and arguments. Mandate would need to travel with every tool call and task request.

Authority Proof

Proof the action falls within granted scope

Authentication answers who connects. Tool availability answers what exists. Delegated authority is a different question entirely: whether this agent, acting right now, stays within what the principal actually granted. It would need to travel in tokens or be reconstructable from claims, identity records, and runtime context.

Binding Approval

Evidence a specific human approved this action

A confirmation prompt proves a human was shown something. That's all. An approval record binds the approved action, the state at approval time, the approver's identity, policy checks, and consequence scope into a single reviewable object. MCP recommends confirmation prompts but defines no schema for tying approval to the action that actually executed.

Session Limits

Explicit limits on what the agent may touch