Six Protocols That Make AI Agents Actually Work

Here's the dirty secret about AI agents that the demos don't linger on: an agent with no protocols is basically a very confident liar. Ask it to check inventory and place an order, and it will do exactly that—except the inventory numbers are fabricated, the prices are invented, and the order confirmation came from nowhere. The agent doesn't know it's making things up. It's just doing what language models do, which is produce plausible-sounding text.

That gap—between what an agent sounds like it can do and what it can actually do—is exactly what a new layer of infrastructure is trying to close. At Google I/O 2026, Kristopher Overholt, a developer relations engineer on the Agent Development Kit (ADK) team, walked through six protocols that together form something like a nervous system for production AI agents. The agent protocol stack is one of the less-hyped but more consequential things coming out of I/O this year.

The framing Overholt uses is worth pausing on: "Traditional APIs assume a person is on the other end. A person clicks buy, but an agent doesn't know how to check out. A person can browse a storefront, but an AI agent doesn't have a catalog. A person can read a form, but an AI agent produces text." That's not a minor inconvenience. It's a fundamental architectural mismatch. The web was built for humans. Agents need something different.

The demo that grounds it all

To make the protocols concrete, Overholt builds a kitchen manager agent—something that orders food supplies for a restaurant from wholesale vendors. It's a good choice of example because it immediately runs into every problem real agents face: it needs external data, it needs to coordinate with other systems, it needs to spend money, and it needs to show results to a human. No single protocol handles all of that. The demo is essentially a live argument for why the stack exists.

Starting from a bare agent that hallucinates inventory and order numbers, Overholt adds one protocol at a time. By the end, the same agent can check real inventory, consult specialist agents, place a typed order, get payment authorized with signed mandates, render a dashboard, and stream everything to a front end in real time. The transformation is instructive precisely because each protocol solves exactly one problem and doesn't pretend to solve the others.

What the six protocols actually do

MCP (Model Context Protocol) is probably the most familiar name here—it's been circulating in developer circles for months. The short version: without it, you write a custom tool for every API endpoint your agent touches. Three services in, you're managing a combinatorial mess. MCP lets an agent connect to an MCP server that dynamically exposes available tools at runtime, so adding a new data source means adding a URL, not writing more tool scaffolding. In the kitchen agent, three MCP servers cover inventory, recipes, and supplier email. For MCP vs A2A skeptics wondering where one ends and the other begins: MCP is about connecting agents to data and tools. What comes next is about connecting agents to each other.

A2A (Agent-to-Agent Protocol) handles the expertise problem. Your kitchen manager can check inventory, but it doesn't know today's wholesale salmon prices or whether a supplier grades their fish. That knowledge lives with different agents, potentially built by different teams in different frameworks. A2A standardizes how agents discover each other—each agent publishes an "agent card" at a known URL describing its capabilities—and how they delegate tasks via a standard message format. The agent doesn't need to know how the remote agent is implemented. It just needs the URL. Overholt points out that this is where A2A's value becomes organizational as much as technical: "When every team in your company is building their own agent, A2A gives you a standard way to discover and delegate tasks to them."

UCP (Universal Commerce Protocol) addresses the checkout problem. An agent can't browse a storefront. UCP provides a machine-readable endpoint (/.well-known/ucp) where suppliers expose their catalogs and accept structured checkout requests. The agent sends typed line items and quantities; it gets back an order number. No HTML parsing, no guessing at checkout flows. For anyone who's tried to automate purchasing through screen-scraping or fragile API integrations, this is the protocol equivalent of a loading dock with standardized pallets.

AP2 (Agent Payments Protocol) is the one that addresses the question you should already be asking: who authorized any of this spending? UCP lets an agent place an order, but nothing stops it from buying from an unauthorized vendor or blowing past budget. AP2 introduces typed mandates—a checkout mandate that specifies approved merchants, a payment mandate that enforces spending limits and records user authorization, and signed receipts that create an audit trail. The distinction Overholt draws is sharp: "Instead of telling your agent, 'Don't spend more than $500' in the instructions and hoping for the best, you're actually specifying conditions in a typed protocol with enforceable guardrails." The difference between a prompt instruction and a cryptographically enforced constraint is not a minor one when money is actually moving.

A2UI (Agent-to-User Interface Protocol) solves a problem that most agent demos quietly avoid: what do you show users? The default answer is a wall of text. A2UI lets an agent compose user interfaces on the fly using 18 defined primitives—cards, buttons, date pickers, sliders, text fields—delivered as a declarative JSON payload that any compatible renderer (Lit, Angular, Flutter) turns into native components. The agent doesn't generate HTML; it generates structure. The same prompt "Show me what to reorder" produces a checklist dashboard; "Set up an order form" produces a form with a date picker and urgency slider; "Compare two suppliers" produces side-by-side comparison cards. Three different UIs, zero changes to the agent.

AGUI closes the loop on visibility. An agent can do everything right and still leave users staring at a spinner while work happens invisibly. AGUI standardizes the streaming events that flow from agent to front end—tool calls, tool results, text output, run completion—so users see work happening as it happens, not after. In the kitchen agent demo, this means watching MCP check inventory, A2A query specialist agents, UCP place the order, and AP2 return a signed receipt, all in sequence, in real time.

The open questions this stack doesn't answer

Overholt is careful to note that these protocols are independent—you don't need all six, and you shouldn't reach for them until you have the problem they solve. That's a reasonable thing to say from a developer relations perspective, and it's probably good practical advice.

But the presentation is, understandably, a Google-centric view of the world. ADK is Google's open-source framework, and several of these protocols are either Google-originated or Google-championed. The A2A protocol in particular has adoption questions that a demo can't resolve: standards are only standards when multiple parties implement them. MCP has achieved real cross-vendor traction; whether UCP, AP2, A2UI, and AGUI follow the same path remains to be seen.

There's also a question that the demo's clean abstraction glosses over: what happens when these protocols interact with each other in failure modes? An agent that can autonomously discover suppliers, place typed orders, and authorize payments up to $500 is a meaningfully capable autonomous economic actor. AP2's mandate system is designed to constrain that, but mandate configuration is itself a layer of complexity that can be misconfigured. The signed audit trail is valuable after something goes wrong; it doesn't prevent the mistake.

None of that is a reason to dismiss the stack. The problems these protocols solve are real, and "your agent will confidently make up inventory data" is not a minor limitation for anything running in production. The multi-agent architecture problem has needed a coherent answer for a while, and layered protocol specifications are at least the right shape of solution.

The more interesting question might be: what changes about how we build software when an agent can autonomously discover a supplier, negotiate a contract, authorize payment, and deliver results—all without a human in the loop until the signed receipt arrives? The protocols in Overholt's demo are designed to make that possible. Whether the guardrails are designed well enough to make it safe is a question that won't be answered in a 14-minute demo.

---

Marcus Chen-Ramirez is a senior technology correspondent at Buzzrag. He covers AI, software development, and the intersection of technology and society.