The NewsRupt

Standards work is the least glamorous thing happening in AI and, over a five-year horizon, likely among the most consequential. The current round concerns how a model reaches the outside world: how it discovers a tool, describes it, calls it, authenticates to it, and reports what happened.

Until recently every vendor solved this privately. A function-calling schema here, a plugin manifest there, a bespoke agent framework on top, each mutually unintelligible. The cost of that fragmentation fell on whoever wanted to connect a model to a system of record, which in practice meant writing the same integration several times, once per model provider, and rewriting all of them whenever a provider changed its format.

What has changed is that the industry has begun converging on a small number of interoperable patterns for exposing tools and context to models, and the major providers have moved towards supporting them rather than only their own. The technical content is unremarkable: a way to describe a tool, a transport, an authorisation story, a convention for returning structured results and errors. The significance is not in the design but in the shared adoption.

Three consequences follow, and they are worth separating from the enthusiasm.

The first is that integration work starts to amortise. A connector written against a common interface can serve several model providers, which changes the internal economics of building one. This is the direct and least speculative benefit, and it is already visible in the number of first-party connectors that internal platform teams now maintain instead of buying.

The second is that switching costs fall at the model layer and rise at the orchestration layer. If tools are addressed through a shared interface, replacing the model behind them becomes a configuration change rather than a rewrite. The lock-in does not disappear; it relocates into whatever system holds the permissions, the audit trail and the routing logic. Buyers negotiating hard on model pricing while adopting a proprietary orchestration layer without scrutiny have simply chosen a different place to be locked in.

The third is a security surface that many organisations have not yet priced. A standard interface for giving models access to internal systems is, by construction, also a standard interface for exfiltration if the permission model is weak. The relevant questions are dull and specific: which identity does a tool call execute as, whose consent was recorded, what is logged, how is a call from a model distinguished from a call from a person, and what happens when instructions embedded in retrieved content attempt to trigger a tool. Convergence makes these questions answerable in a general way, which is progress, but only for teams that ask them.

The limitations of the current moment should temper the reading. Convergence is not completion; competing specifications remain, coverage of authorisation and delegation is thinner than coverage of invocation, and several providers support a common surface while extending it in incompatible directions — the familiar pattern by which a standard is embraced and then diluted. It is also early enough that adoption statistics mostly measure enthusiasm among developers rather than production deployment in regulated environments, which is the harder test.

Still, the trajectory is legible, and it rhymes with earlier infrastructure transitions. Interfaces that become boring tend to become load-bearing. The organisations that will benefit most are the ones treating tool access as an identity and permissions problem now, while the deployments are small, rather than after a standard interface has quietly connected a capable model to everything the company knows.