Agent runtimes naturally create the first trustworthy evidence about an instance, which gives them the default position in agent identity. Runtime proof and enterprise binding are still separate jobs. In heterogeneous enterprises, a binding layer can map evidence from many runtimes into durable Agent and Agent Deployment records and supply that governed context to credential issuers and resources. It is a real control plane only if the enterprise state survives changing runtimes. In the open world, model-provider harnesses are better positioned to integrate the stack because they hold the user relationship and execution loop. Distribution determines the default. Standard seams determine whether it can be challenged. Even a won binding layer answers whose agent is running, not whether its current work remains approved. That requires the third control point, an approved-task record with its own lifecycle.
Agent task authority is scattered across four de facto records: harness permission prompts, OAuth grants, IAM roles, and change tickets. Each performs a real job, but none is a general, portable system of record for approved work. An action click is not task approval, a grant is not a task lifecycle, and an identity role is not a reason for one undertaking. The missing object is an approved-task record with its own owner, bounds, lifecycle, and evidence relationships. Existing standards provide much of the transport for structured requests, user interaction, decisions, and credential projection. They do not yet supply shared task semantics, lifecycle propagation, trust, or enforcement behavior. Four plays are competing to mint the record, and the contest turns on distribution, durable state, and resource acceptance.
The control-points series argues that distribution determines defaults and standard seams determine whether those defaults remain contestable. MCP adds the clock. It launched with a specification, SDKs, a distributed host, and reference servers, and one developer could run the whole loop before the ecosystem coordinated. Mature authorization and governance followed the adoption pressure. The lesson is not that ratification is obsolete or that protocols can be adopted unilaterally. It is that a seam needs a small first coordination radius, immediate utility, low exposed implementation cost, running code, and a path from one controlled deployment to multilateral interoperability. This essay runs the series’ seam table through that test, uses AAuth as the clean-sheet stress test, and explains what would produce an enterprise ‘SAML moment’ for agents.
Cross App Access is not twenty-five generally available integrations. It is three different things at three different stages: a stable MCP authorization extension, a live Claude and Okta beta, and a partner graph whose broader product rollout is still under way. That distinction makes the strategic result clearer. The launch coalition moves protocol coordination from each buyer to the vendors assembling the loop, giving the layered identity play an adoption wedge. ID-JAG carries both the enterprise user and a required OAuth client identifier, while the resource authorization server retains the final decision. What it does not standardize is the binding from that client to a logical Agent, approved deployment, or runtime instance, nor a record of the task that justifies access. The credential-projection foothold shipped. The Agent and approved-work records remain open.
Model routers and customer-controlled agent state are now concrete product architectures, but they do not make every model interchangeable or every memory store strategic. The important boundary is narrower. Task checkpoints are operational state, transcripts are evidence, embeddings are derived indexes, and model-generated memories are untrusted proposals. Canonical institutional knowledge becomes an enterprise record only when the company can govern its meaning, provenance, lifecycle, access, retention, and portability. That record feeds a context compiler, which builds a purpose-bounded view for an approved task, and a router, which selects an execution supplier. Reads are exposure decisions, and writes are changes to future behavior. The approved-task record should bound both without being confused with the memory itself. A vendor may operate the store, but the record must remain intelligible, governable, and recoverable when the vendor changes.
The enterprise agent control stack is not one product or one call chain. It is a set of independently governed answers: which instance is running, whose Agent it is, which deployment was approved, why its current work remains authorized, what an issuer may project, how credentials are acquired and presented, whether a resource permits one concrete action, and which evidence proves the joins afterward. Three upstream positions are contested control points: the provider seam, identity binding, and the approved-task record. The resource decision remains the non-delegable final word, while runtime evidence, issuance, and audit support the chain without substituting for its records. The context and memory plane crosses this path but does not merge with it: approved work bounds exposure and memory-write rights, while canonical institutional memory keeps its own lifecycle. Six rules, one forward-and-reverse trace, and five component-replacement tests turn the series into an architecture and procurement tool.