[agentic-web]

2026-09-08[writing]

I tried to file one agent tool call as an order record under the EU trading rules. Of the eighteen fields that apply, six map to something standard and four have no source at all. Those rules have been binding since 2018, and in February the regulator pointed them at GenAI.

2026-08-27[writing]

I tried to write down the formula for revocation latency and it kept being wrong in instructive ways. The corrections come from validator source code: a five-minute grace on expired tokens in .NET, streams that outlive their token by design, and a 12-hour JWKS refresh on the one lever that actually works. With runnable experiments.

2026-08-19[writing]

Only two fields are Required on the OpenTelemetry span that records an agent taking an action. Not who authorized it, not what it was allowed to do, not what it sent. Here's the gap, field by field, and what to do about it.

2026-08-09[writing]

When a tool call dies mid-flight, neither MCP nor A2A can tell you whether it executed, and no retry can prove it is the same request. RPC solved this in 1984. Three changes close the gap.

2026-07-28[writing]

A2A moves tasks without prices, x402 moves money unconditionally, AP2 authorizes without verifying. PACT adds the missing object: the Verifiable Task Contract.

2026-07-23[writing]

A field guide to the protocols wiring the agentic web: MCP for tools, A2A for agent-to-agent work, Skills for know-how, and the three-way fight over payments.

2026-07-23[writing]

Four questions a bearer token cannot answer: agent identity, authorization flows, delegation chains, and accountability, each mapped to its standard.