Agents can find your front door. What happens after they walk in?

Your customers' AI assistants can now find your front door on their own. In 2026 the industry agreed on how agents discover and connect to a company's services. It did not agree on what happens next, and in a regulated process, what happens next is the whole job.

An agent that files a claim, changes an account or requests a refund is one more door into your process. It is not a new way to skip the rules. The question for every bank, insurer, health system and carrier is simple: when an agent walks in, who enforces your policies while the work runs?

What changed in 2026

Three pieces of plumbing fell into place this year:

• Discovery. In June, Google and ten industry partners published Agentic Resource Discovery (ARD), an open spec that lets a company publish a catalog of its agents and tools on its own domain, so other agents can find and verify them.
• Connection. The Model Context Protocol (MCP) became the default way an AI calls a company's tools, and its official registry now lists tens of thousands of servers. Agent-to-Agent (A2A) reached version 1.0 under the Linux Foundation for agents that talk to other agents.
• Directories. Customer service platforms began publishing directories of verified support agents, so a consumer's assistant can find a brand's official support destination instead of guessing.

Put together, a customer can tell their assistant "report the hail damage on my car" and the assistant can find the insurer's agent, confirm it is the real one, and connect.

The gap: every spec stops at the door

Read the specs closely and they all end in the same place. Discovery finds the agent. The protocol connects to it. The authors of ARD say it plainly: it does not replace authentication, authorization, governance, or organizational trust decisions.

None of these standards decides whether a step is allowed to run. None checks that the right disclosure was shown, that consent was captured, or that the data written to the system of record is correct. None produces the evidence an examiner will ask for. That work starts after the agent walks in, and it belongs to you.

Why you can't just connect the agent

The tempting move is to expose your claims or account APIs to any verified agent and let it work. In a regulated process that fails for three reasons:

• Conversational AI hallucinates. It cannot be wired straight to a system of record. One confident wrong value in a loan file or a claim is a compliance problem, not a typo.
• Some steps must stay human. Consent, signatures and attestations have to be given by the customer, on a screen the process controls, not paraphrased by an assistant.
• After-the-fact checking doesn't scale. Most companies check compliance later, in their GRC tool, and redo the work by hand when something was missed. Agents multiply the volume of work entering the door, so they multiply the rework too.

The agent isn't the risk. Running a regulated process without enforcement at the moment of execution is.

The pattern that works: the agent starts, the process enforces

Treat the agent as a door, the same as a form, a call or a chat. Then put enforcement between every door and the system of record. With Callvu, the Completion and Compliance Layer, an agent-started request runs like this:

1. The agent starts the governed process. It calls Callvu over MCP and carries what the customer already said into the run, so nobody types it twice.
2. Every action is evaluated while it runs. Callvu assesses each step for completion risk, compliance evidence, policy interpretation, data trust, audit readiness and exception patterns. A deterministic orchestrator then decides: execute, execute with safeguards, escalate to a human, or block.
3. Must-not-skip steps stay on a controlled screen. Consent and signature are handed to the customer prefilled, on a screen the process controls. The chat never stands in for them, and sensitive data never goes into the chat.
4. The result is written back with proof. The outcome goes into the system of record, and every run produces a Decision Trace (why each AI action was allowed) and an Audit Trace (the full governance record), pushed in real time to your GRC and BI tools.

It is one workflow underneath, recorded the same way whether a person, a link or an agent started it. Your policies don't change because the door did.

Three questions to ask your team this quarter

Agent traffic is early. The decisions that make it safe are not, and they take longer than the plumbing.

1. Which processes could an agent start? List the requests customers already make by chat or phone: claims, address changes, payment arrangements, service moves. Those are the first ones an assistant will try.
2. Which steps must stay human? For each process, mark the consent, signature, disclosure and attestation steps that can never be completed by an assistant.
3. How would you prove it? If an examiner asked tomorrow why an agent-started request was approved, could you show the policy applied at each step, or would someone rebuild it from logs?

If the third answer is "rebuild it", the gap is enforcement, not discovery.

See it run

The guide Bring your own AI walks through how an AI you already use can start a governed process in Callvu, with every policy enforced while it runs. To see a use case live, open the Callvu sandbox.

Agents will keep getting better at finding your front door. Make sure what happens after they walk in is already decided.

Sources

• Announcing the Agentic Resource Discovery specification, Google Developers Blog, June 17, 2026
• Google and industry partners announce ARD, InfoQ, July 2026
• MCP statistics 2026, eSEOspace, October 28, 2026
• A2A v1.0: a builder's guide, Agentic AI Foundation, August 27, 2026