Eighty-five percent. That is the share of enterprises running agentic AI pilots, per figures Cisco presented at RSA 2026. Five percent. That is the share that has reached production. A single integer spans the gap, and it is not a rounding error.
I have audited enough failing systems to recognize this shape. When a technology performs inside a controlled environment and stalls at deployment, the defect is rarely in the component. It is in the seam. In 2017, I spent six weeks manually auditing the Solidity source of five prominent ICO contracts. Three carried reentrancy vulnerabilities. Every function compiled. Every contract passed its own unit tests. The interfaces between them did not. Agentic AI in 2026 is repeating that pattern at the infrastructure layer, and the market is not pricing the seam.
The four planes
The architecture problem is precise, and it is boring. That is exactly why it is being ignored.
Agentic AI rests on four orthogonal planes. The tool-calling plane, dominated by the Model Context Protocol (MCP), governs how an agent reaches a tool. The agent-to-agent plane, governed by A2A, governs how agents reach one another. The identity and authorization plane — contested among OAuth 2.1, Okta's Cross App Access (XAA), and formalized IETF work — governs who is permitted to act. The execution-isolation plane, built on sandboxes and per-session microVMs, governs where the action runs.
MCP is stateless and vertical. It connects an agent downward to a tool. A2A is horizontal. It connects an agent sideways to another agent. The two axes are complementary by design. They are also strangers in practice. Neither shares a session model, an identity model, or a state model with the other. That absence now has a name. The missing meta-orchestration layer.
The ledger never lies, only the narrative does. And the prevailing narrative — that agents are blocked by model capability — does not survive contact with the architecture. The model is the least of the problems. The problem is that four planes, each solving its own axis competently, do not share a coordination fabric.
The stateless trade-off nobody quantified
MCP's statelessness is the most underrated design decision in the stack. Statelessness improves scalability. It also pushes session state up to whatever orchestrator sits above it. That is not a bug. It is a load-bearing choice, and it is the technical root of the entire missing-layer thesis.
Read it carefully. If the tool plane holds no session, and the agent-to-agent plane holds no shared identity, then someone must hold the state that stitches them together. That someone does not yet exist as a standard. Every enterprise is currently building its own private version of that someone. The result is not a market. It is a thousand private seams.
I watched the same fragmentation play out in 2020. After the Sushiswap fork, the prevailing narrative was developer malice. I pulled 15,000 transaction logs across Ethereum mainnet and traced the initial liquidity deployments by hand. The migration was not a rug pull. It was a governance maneuver, and I could quantify the value at risk — roughly $4.2 million in ether — to the dollar. The data settled what the narrative could not. The same discipline applies here. The question is not whether agents are malicious. The question is who holds the state when they cross a boundary.
Identity is the real choke point
If the orchestration layer is the missing product, identity is the missing root. The evidence is scattered, and it points one direction.
The OpenID AIIM Community Group is working to ensure, in its own framing, that only authorized agents can access resources. Okta's XAA is a commercial bet on the same premise. The IETF is formalizing adjacent work. Three efforts, three maturity levels, one shared goal. None of them yet commands a cross-vendor trust root.
That is the gap that matters most. A coordination layer without a unified identity root is a switchboard without an operator. It can route. It cannot authorize.
Silence is the loudest warning sign in the code. The silence here is structural: no specification names who holds the trust root across heterogeneous vendors. Every pilot I have examined resolves this by hard-coding trust to a single platform. That works inside one wall. It fails the instant an agent must cross one.
Isolation and identity do not see each other
The split between the isolation plane and the identity plane is not a nuance. It is a verifiable engineering defect.
Sandboxes provide execution isolation. They cannot enforce identity. Gateways enforce boundaries. They cannot see the sandbox lifecycle. The two security primitives are mutually blind. One knows where code runs. The other knows who called it. Neither knows both.
This is the confused-deputy problem in its native habitat. An agent authorized for tool A can be induced, through a delegation chain across the agent-to-agent plane, to invoke tool B under borrowed authority. The gateway sees a valid token. The sandbox sees a valid process. Neither sees the escalation. There is no shared ledger of intent, only a shared ledger of execution.
The platform vendors are not building the neutral layer
AWS AgentCore offers a managed agent loop, configuration-driven definitions, and per-session microVM isolation. It is the most robust single-platform offering, and it is deliberately walled. Internal consistency takes precedence over cross-vendor interoperability. That is a coherent strategy for AWS. It is also an admission that the neutral layer is not their problem to solve.
Google's Gemini Enterprise Agent Platform enters through A2A horizontal coordination, with the protocol hosted under the Linux Foundation and a community exceeding 150 organizations. It embraces the horizontal axis. It leaves the vertical MCP seam unaddressed, which is precisely where the state problem lives.
Cisco's DefenseClaw, released at RSA 2026, integrates NVIDIA OpenShell and Splunk and delivers security and observability. Note what Cisco does not do. It explicitly avoids coordinating across MCP, A2A, and the identity plane. It picks the security wedge and declines the coordination problem.
That is a tell. The most security-literate vendor in the set chose not to solve the seam. It chose to observe the seam instead.
The neutral layer — OpenID AIIM, NIST initiatives — remains in the standards phase. Real, credentialed, and early. It holds no commercial product. It has no pricing. It has no paying customer.
What the omission reveals
Three things stand out when you audit the landscape rather than read the press releases.
First, Microsoft is absent from the dominant three-player narrative. Azure runs Copilot at scale and maintains its own agent frameworks. Its exclusion from the competitive frame is not an accident of reporting. It is a blind spot, and it weakens any conclusion built on a "three-player" premise.
Second, the Linux Foundation hosts both MCP and A2A. Governance consolidation is a signal. If a neutral orchestration layer ever emerges, it is more likely to grow from LF or CNCF soil than from a commercial vendor optimizing its own axis.
Third, and most important, the identity axis may be the actual throat of the market. Identity is the hardest primitive to commoditize. It is also the hardest for any single platform to absorb unilaterally. The vendor that holds the trust root holds the layer, whatever the layer is called.
Contrarian: correlation is not causation
Here I break with the framing, including the framing that this topic's own boosters repeat.
The missing orchestration layer is real. It is also a convenient scapegoat. The 85-to-5 gap has at least two candidate causes, and the industry prefers the one that sells more infrastructure.
Cause one: the seam is missing. Cause two: the productivity promise of agents is itself overstated, and the seam is a symptom rather than the disease. Both fit the data. Neither is proven. Anyone who tells you the gap is definitively an infrastructure problem is selling infrastructure.
Hype is a liability; data is the only asset. And the data here is thinner than the confidence around it suggests. The 87 percent interoperability-priority figure circulates without a named source. The 11-to-14 percent pilot-to-production rate circulates the same way. I do not reject these numbers. I flag them. An unsigned statistic is a hypothesis wearing a lab coat.
There is a harder precedent to weigh. Kubernetes proved that the neutral control plane can be commoditized. The value of the orchestrator did not accrue to a neutral middleware vendor. It was captured by the cloud providers who ran the substrate. Every argument for a thriving neutral orchestration market must explain why this layer escapes that gravity. So far, none does.
There is also the Gartner projection: more than 40 percent of agentic AI projects canceled by the end of 2027. Read it as a forecast of failure, or read it as a forecast of self-fulfillment. If vendors rebrand RPA and chatbots as agents, the cancellation rate climbs on its own. The prediction does not require a missing layer. It only requires sloppy labeling.
And here is the signal almost no one is reading: this analysis arrives through a Web3 news channel carrying no Web3 content. That is a topic migration, not a scoop. When a publication pivots its coverage to a hot adjacent sector, the reader should ask who the audience is and what the audience is meant to buy. Chaos in the market is just noise without context. A content-farm pivot is context.
The infrastructure cost nobody modeled
Strip away the standards language and the runtime cost becomes concrete.
Per-session microVMs carry real overhead — cold starts, memory residency, and provisioning latency. At fleet scale, that overhead is a cost center, not a rounding error. A meta-orchestration layer adds a further hop and a state store. Every hop adds latency. Every state store adds a surface to secure.
The strategic implication is unstated but clear. If agents multiply, the spend structure shifts from training-centric to inference-and-runtime-centric. The bill moves from the GPU cluster to the orchestration substrate. Whoever owns the runtime owns the meter.
My audit position
I write this with a specific bias, and I will name it. In 2025, I was retained to design a transparency reporting framework for an AI-driven crypto ETF. I built a Python tool that reconciled the fund's underlying holdings against its prospectus every hour, and I presented a fifty-page technical document describing how zero-knowledge proofs could verify solvency without exposing user data. That work taught me one thing above all: data integrity is the foundation of institutional trust, and integrity is an interface property, not a component property.
That is why this gap reads as familiar. In 2017, the seam was the interface between contracts. In 2020, the seam was the interface between liquidity pools. In 2025, the seam was the interface between a fund's ledger and its filings. In 2026, the seam is the interface between agent planes. The component always ships. The seam never does.
What I am watching next
Trust the hash, question the headline. Here is the hash I am tracking.
Watch the Linux Foundation's co-hosting of MCP and A2A. If those two protocols converge on a shared session model, the neutral layer is being built from the governance side, not the vendor side. That is the single most falsifiable signal in this entire thesis.
Watch the identity root. If Okta, OpenID, or the IETF names a cross-vendor trust anchor, the choke point is closing. If they keep working in parallel, it is not.
Watch for absorption. If AWS or Google ships a feature that spans the vertical and horizontal axes inside a single account, the neutral layer is dead on arrival and the control plane is captured, exactly as Kubernetes was.
Watch Microsoft. If Azure enters the coordination frame, the three-player story was never the story.
The component will ship. It always does. The question that decides this market is not who builds the best agent. It is who builds the seam — and whether anyone can own it before the hyperscalers give it away for free.
