The Protocol Stack Nobody Audited

A production enterprise agent composes four complementary protocols — MCP for tools, A2A for agent coordination, ACP for messaging, and UCP for commerce — each designed in isolation with its own auth model and audit density. Each protocol documents what it audits; none documents what falls between them. This brief argues, from first principles and without any breach incident, that the composed audit surface is less than the sum of its parts, and gives a four-line checklist for auditing the seams.