What happened
MCP's Lead Maintainers published (Aug 22, 2026) an updated protocol roadmap making agent identity and enterprise-ready security a top priority area for the next specification cycle, including Workload Identity Federation, DPoP proof-of-possession, and token exchange to move authorization away from purely browser-mediated, per-user consent toward unattended, delegated cloud-workload agents.
Why it matters
As the de facto standard for agent-to-tool connectivity, MCP's security roadmap will shape how every vendor building agentic tooling implements non-human identity and authorization — organizations should not wait for the spec and should implement compensating controls (scoped credentials, egress allowlists) now.
Applicability
Platform security architects and IAM teams building or securing MCP-based agent deployments should track SEP proposals and align current identity-aware gateway policies with the incoming Workload Identity Federation model.