Home Blog Agents
Agents

Agent Field Notes: sprawl, a delayed EU deadline and a stateless MCP

Four developments from the summer that change what a sensible agent rollout looks like, each with a source, a date and our honest take.

By The Cadrix team5 min read
Overhead view of an open notebook, a pen and a coffee cup beside a laptop
Photo by mk. s on Unsplash

This is the first of our short field notes. The rule is simple: every item has a link, a date, and a sentence on what it means for someone building workflows. No predictions of our own, and no numbers we could not trace to their owner.

1. Agents are being created faster than anyone inventories them#

On 3 August 2026, SAP published a feature on "agent sprawl": agents are created and connected faster than organisations can list them, assign an owner, control their permissions or retire them. The article is vendor writing, and it promotes SAP's own product, so read it for the problem statement rather than the pitch.

It leans on a Gartner release from 28 April 2026, "Gartner Identifies Six Steps to Manage AI Agent Sprawl". The forecast quoted there is that by 2028 an average global Fortune 500 enterprise will have more than 150,000 agents in use, up from fewer than 15 in 2025. That is a forecast, not a measurement, and we could not open Gartner's page ourselves, so we are repeating it as reported by SAP and press coverage.

Our take. You do not need 150,000 agents to have the sprawl problem. Twenty workflows built by six people, each with a different mailbox connection, is enough. The cheap fix is boring: one list with an owner, a purpose, the tools each workflow can touch, and a review date. In a workspace-based tool, that list is partly free, because workflows, connections and members already live in one place. What you still have to do is decide who looks at it and how often.

2. The EU delayed its high-risk AI deadlines#

The EU's "Digital Omnibus on AI" moved the date when the strictest AI Act obligations start. According to law-firm summaries, Parliament adopted the text in June, the Council gave final approval on 29 June, it was signed on 8 July and it entered into force on 27 July 2026. Obligations for high-risk systems listed in Annex III now start on 2 December 2027, and for systems embedded in regulated products on 2 August 2028. Transparency duties under Article 50 were not part of the delay in the same way, with a grace period to 2 December 2026 for marking certain generated content.

We are relying on secondary summaries for these dates, listed at the end. If a decision depends on them, read the Official Journal text or ask your counsel.

Our take. A later deadline is not a reason to postpone the design work. The human oversight article (Article 14) describes things you would want anyway: someone who understands the system's limits, can override it and can stop it. We wrote a longer plain-English reading of that article in a separate post.

3. MCP dropped sessions and the initialise handshake#

The Model Context Protocol published a specification revision dated 2026-07-28. Its changelog lists, among the major changes, removal of protocol-level sessions and of the initialize handshake, so every request now carries its protocol version and capabilities. It also deprecates OAuth Dynamic Client Registration in favour of Client ID Metadata Documents, and deprecates the Roots, Sampling and Logging features, with a stated minimum twelve-month deprecation window for deprecated features.

Our take. If you only use MCP servers that other people maintain, most of this happens beneath you. It matters in two places. First, server authors will ship updates, so ask whoever runs your servers which spec version they support. Second, the authorisation changes are a reminder that an MCP connection is a credential, and should be treated like one. Our explainer for operations teams covers what to check.

4. Governance is moving from policy documents to controls#

Across the summer, the common thread in vendor and analyst writing was that "responsible AI" statements are being replaced by things a buyer can test: inventories, scoped permissions, logs and approval steps. The SAP piece says so directly, and Gartner's sprawl guidance frames governance around the tools and processes used to manage agents rather than a statement of principles.

Our take. That is the right direction, and it is also easy to fake. A control exists if it can stop a run. An approval step that is optional, a log nobody reads and a permission nobody ever narrowed are all policies wearing a costume. When you evaluate any platform, ours included, ask to see the thing refuse something.

What we left out on purpose#

You will see bigger numbers elsewhere: market-size forecasts, adoption percentages, claims about how much work agents will take over. We left them out. Most trace back to a vendor survey or an analyst forecast with a method we cannot inspect, and a number without a method is decoration. If a figure in a future note matters to a decision, it will come with a link to where it came from and the date it was published.

We also left out product launches that were announced but not yet available. A feature on a roadmap is not a control you can rely on, and the only fair way to compare tools is by what you can switch on today.

One thing to try this week#

Build the inventory. Open a spreadsheet and list every workflow that can send a message, change a record or spend money. For each one, write down: owner, trigger, tools it can use, who approves, and the date someone last read its run history.

You will find at least one workflow with no clear owner. Fix that first.

In Cadrix, the workflow list, the connections page and the run history give you most of the raw material; the spreadsheet is where you add the owner and the review date.

Where the human goes. Ownership is the human part of an inventory. Every workflow that acts on the outside world needs a named person who is allowed to switch it off, and a backup for when they are away.

Sources#

Get new posts by email

Practical notes on governed AI workflows, in your inbox. Unsubscribe whenever you like.

Opens your email app to send the request. We use your address only to send the blog. See the privacy policy.

Keep reading