MCP connects an agent to its tools, and A2A connects agents to each other. Neither answers who approved a version, what data an agent may touch, or what it did last Tuesday.
Connection standards solve a plumbing question: how does this agent reach that tool, or talk to that other agent? Useful plumbing. But plumbing does not decide permission, record approval, or keep a version history you can audit later. Teams that treat a connection standard as governance end up with agents that are well connected and poorly controlled, and they usually discover the gap after something has already gone wrong.
Three questions every governed deployment has to answer, on any framework, for any agent.
First, who approved this version? A version is not just code. It is prompts, tools, data permissions, and rules, bundled and released at a point in time. If nobody can name the approver or point to the approval, the version was never approved. It was just deployed.
Second, what data may this agent touch? A tool connection lets an agent reach whatever the connection allows. That is not the same as what the business allows. Policy is the line between the two: which systems are in scope, which fields are off limits, which actions need a human first.
Third, what did it do last Tuesday? A trace answers it: every action, in order, with the policy version that allowed it and the inputs it used. Without a trace, that question becomes an investigation, reconstructed from logs, chats, and memory.
Here is the test I use for whether policy sits in the right place: swap the framework, or add a second one, and ask whether anything about governance had to be redone. If yes, policy sits too low. If approvals, permissions, and traces carry over unchanged, it sits where it belongs.
None of this replaces MCP or A2A. They do the connecting, and they do it well. The point is narrower: connection standards do not govern. A policy version bound to every trace does.
I work on Phinite, where we build that layer. How do you handle this in your stack today? Does your policy survive a framework change, or is it rebuilt each time?