Intent Leakage by Design: Governance Gaps in MCP, Tool Use, and A2A

The rapid adoption of tool-augmented AI protocols — particularly the Model Context Protocol (MCP), function calling interfaces, the Agent-to-Agent (A2A) protocol, and the newly deployed WebMCP browser-native agent standard — has created a new class of governance blind spots that existing security frameworks fail to address. This paper identifies seven structural governance gaps in these protocols, maps them to a five-level leakage taxonomy, and proposes procurement-grade acceptance criteria for enterprise adoption: verifiable intent isolation, correlation resistance, schema least-disclosure, attestable context bounds, delegation provenance continuity, cross-site run settlement, and delegation transparency. While current discourse focuses on implementation-level vulnerabilities such as prompt injection and command execution, the deeper structural problem is that these protocols expose intent-bearing behavioral signals that enable adversaries to reconstruct user strategy, decision patterns, and organizational priorities — without accessing any protected data. The seven governance gaps are: (1) Tool-Path Fingerprinting, where the sequence and combination of tool invocations leaks strategic intent; (2) Cross-Endpoint Correlation, where behavioral patterns across independent MCP servers can be linked to reconstruct holistic user profiles; (3) Schema-as-Capability Map, where tool definitions themselves reveal organizational capabilities and priorities; (4) Context Persistence, where MCP servers accumulate user behavioral patterns across sessions; (5) Delegation Provenance Loss, where responsibility attribution becomes untraceable in multi-hop agent workflows; (6) Cross-Site Context Accumulation, where an agent executing sequential calls across multiple WebMCP-enabled sites accumulates a composite intent profile that no individual site can observe, audit, or settle — a condition present by default from the moment of WebMCP deployment, requiring no adversarial action; and (7) Programmatic Delegation Opacity, where agents delegate sub-tasks through code-level or API-level invocations that bypass the natural-language audit trail, rendering the delegation chain invisible to governance frameworks and human oversight. Each gap is mapped to the five-level leakage taxonomy proposed in companion work [1], demonstrating that tool-augmented protocols amplify risks at Levels 3–5 (cognitive, intent, and conjunctive leakage) — precisely the levels where current governance frameworks provide no coverage. Gap 6 is validated not by adversarial demonstration but structurally: the WebMCP specification (W3C Community Group Draft, February 2026) ships without any cross-site settlement primitive, making the accumulation condition the default operating state of every enterprise WebMCP workflow. Securing these protocols requires not merely better implementation practices, but a governance layer that enforces responsibility completion conditions at the protocol level.