Enterprise AI agent deployments using OAuth 2.1 tokens, JWT bearer tokens, and Model Context Protocol (MCP) connectors operate outside existing identity governance infrastructure due to structural gaps in the protocols themselves — no native agent instance identifier, no delegation chain tracking, and insufficient logging fields for post-incident attribution. No CVE exists and no patch is available; mitigation requires compensating controls and a formal AI agent identity governance program.