150,000 AI Agents Per Fortune 500 Firm — and MCP/A2A Won't Manage Them

By Olivia Hart

Gartner predicts the average Fortune 500 enterprise will run more than 150,000 AI agents within two years. Yet 76% of organizations hit critical roadblocks trying to move AI initiatives from pilot to full production in the past 12 months, according to Collibra's 2026 Hallucination Tax Report. The gap between those two numbers is where the real enterprise work sits — and it's work that the industry's two headline protocols, MCP and A2A, simply don't do.

The Model Context Protocol (MCP) and the Agent2Agent protocol (A2A) now sit under the Linux Foundation's Agentic AI Foundation, and platform vendors have adopted them fast. Claude, OpenAI, Microsoft Copilot and other model platforms already expose skills, connectors, and plug-ins built on them. Vibe-coding and app-building tools — Bolt.new, Lovable, Pave, Replit, v0 — connect to MCP servers. AI coding editors including Claude Code, Cursor, Devin Desktop, Gemini CLI, GitHub Copilot, and Kiro ship MCP clients.

But there's widespread confusion about what each protocol actually does, and enterprises that assume the protocols cover everything will scale themselves into trouble.

What do MCP and A2A actually do?

Three experts, three framings — all pointing the same way.

Scott Gerlach, cofounder and chief security officer at StackHawk, offers a remodeling analogy: "If you think about doing some bathroom remodeling and you call a plumber to move a sink, he'd use tools in his MCP toolbox to complete his work. But when it's time to fix the drywall, repaint, and put the vanity back together, the plumber agent would use A2A to call other contractor agents."

John Pettit, CTO at Promevo, calls MCP "the secure USB port for an AI agent, or a universal power adapter for enterprise AI," letting models plug into local files, databases, and SaaS tools without custom API middleware — while A2A is "like a general contractor managing a team of specialized subcontractor agents."

Arpita Soni, a senior IEEE member, splits the stack into vertical and horizontal: "MCP is the vertical connection and standardizes how a single agent accesses external tools, data sources, and APIs… A2A is the horizontal connection, and it standardizes how independently built agents discover each other, negotiate capabilities, and hand off tasks."

Four capability layers must be built on top: identity and authorization, the business context layer, business process re-engineering, and agenticops.

Who's authorized to place the call?

The protocols define how agents present credentials, not who governs them. Kevin Paige, CISO at C1.ai, is blunt: the protocols give agents "a dial tone to tools" and "a dial tone to each other, but neither saying who is authorized to place the call." MCP binds every token to a single-server audience; A2A treats peer agents as opaque and halts at AUTH_REQUIRED, leaving credential handling outside the protocol.

That makes agents non-human identities. Andrew Hartnett, CTO at Bitwarden, says any agent acting within sensitive systems "must be managed as a privileged identity under strict least-privileged boundaries backed by human-in-the-loop guardrails for high-risk actions." Organizations also need unstructured data governance policies spelling out which agents, under what circumstances, get access to which resources and at what granularity.

Can agents be trusted with answers?

MCP's primary use case is connecting agents to the organization's context layer — knowledge repositories, semantic layers, and knowledge graphs built on high-quality data and runtime AI governance. Skip that, and you repeat the ODBC/JDBC sprawl of early BI deployments, racking up AI debt in siloed connections.

Collibra CEO Felix Van de Maele puts it plainly: "AI governance has two sides: the inputs around context and semantics, and governing the output around what the agent actually does and is allowed to do. If we don't agree on the business terminology, there's no way we can trust the agent with the answer."

Barr Moses, cofounder and CEO of Monte Carlo, warns: "MCP and A2A implemented in silos have the potential to increase the velocity of bad responses." Vivek Vaidya, cofounder and CTO at Kana, adds that without preserved shared context and decision history, more endpoints just "move work faster without creating a system that learns."

What about process re-engineering and ops?

Today's agents are task-based. The next wave is collaboration — and that forces a rethink of processes designed before AI existed. Camunda CTO Daniel Meyer: "All of those business processes were designed in the world before AI existed. They're all legacy." Order-to-cash, onboarding, and compliance reporting are prime candidates for agent-to-agent collaboration over A2A, with Coveo CTO Marc Sanfaçon noting the underlying systems "still need to deliver relevant, up-to-date information and enforce permissions."

Then there's agenticops. Arcjet CEO David Mytton flags the coming visibility problem: "The next big security challenge is when agents start doing work for each other, and it gets even more difficult to see what's happening." In regulated environments, Smarsh CPO Kamesh Tumsi says every interaction is subject to the same role-based access controls, audit logging, and chain-of-custody requirements. Site reliability engineers will take on monitoring, issue resolution, and root-cause analysis for agent fleets.

The protocols will keep improving. The identity management, context governance, process re-engineering, and agenticops around them — that's your build, not your vendor's.