AGNTCon + MCPCon Europe 2026

AI models are becoming a commodity. GPT-4, Claude, Gemini.  Pick one, swap it next quarter, and the differentiation has already moved on. What hasn't moved is context: the data an agent can actually reach. Most of today's MCP ecosystem wraps the easy 80 percent.  SaaS APIs, ticketing systems, chat platforms, anything that already had a REST endpoint.

The other 20 percent: legacy databases running since the 1980s, CAD/BIM/GIS formats, real-time sensor and SCADA feeds, regulated records that legally can't leave the building, and hybrid environments split across cloud and on-prem by design,  still have no real path to an agent. In most enterprises, that's exactly where the decision-relevant data lives. 

Drawing on 32 years building spatial and enterprise data integration, this talk looks at what it actually takes to expose hard, hybrid, and on-prem data as MCP tools: treating data workflows as callable tools instead of one-off scripts, separating the control plane (what an agent is allowed to call) from execution (where the data actually lives and stays), and building both directions, consuming MCP tools and exposing your own, without hardwiring to one model or vendor. 




​In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 

Every application ever built needs to be rebuilt - with agentic AI at the core.  

Moving from cloud-native to ai-native means a new architecture for unlocking enterprise data to safely and securely deliver personalized experiences and services at scale.

Delivering business outcomes requires delivering those experiences to employees and customers globally, wherever they live and work.

To build the Agentic Enterprise, enterprises need to rethink their infrastructure strategy, own their data, and own their AI stack.

In this session, we’ll explore a new infrastructure approach to unlock enterprise AI - and how agents can help.




In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 

Teams move fast to ship an agent pilot, then crash into company policy the moment it needs real access. It works in a sandbox. It stalls the moment it needs an MCP server, a real credential, or a scope wider than a demo account. Governance hasn't kept pace, and shipping on top of that gap isn't speed, it's debt that comes due in production.

This talk makes the case for an agent control plane: guardrails, agent identity, MCP authorization, and access, built to catch up. Control only holds up if it works across any model, framework, or deployment - both for the agent estate you have today and the one you'll have in a year. We'll cover what agent control needs the moment something breaks: live identity, real-time enforcement, an audit trail that survives the incident, and the ability to isolate one agent without disrupting others.

Takeaways: 

• How controls accelerate agent production, not block it
• Why real control has to travel with the agent, not bolted to the stack when it was built
• How framework-agnostic governance at the org level eliminates silos and future-proofs your agents

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 

Every agent starts simple: one model, one SDK, a demo that works. Then comes the second provider, the MCP tools, the fallback logic, the rate-limit backoff — and suddenly half your codebase is integration glue that has nothing to do with what your agent actually does.
Agent Router — newly donated to the Agentic AI Foundation, with a 1.0 GA release and production deployments at scale — collapses all of it into a single integration: every model, every tool, one declarative API.
We'll walk through a live agent workload end-to-end: routing across model providers with automatic failover; understanding exactly what each agent and team spends — and capping it before it surprises you; and choosing which MCP tools each agent can see and call. All declared in one place, none of it in your application code. You'll leave knowing exactly where a router fits in your agent stack, what it takes to run one in production, and how to get involved in the Agent Router project.

In one year, agents went from unable to pay for anything to spoiled for choice. x402 (Coinbase, now Linux Foundation) for machine-to-machine. AP2 (Google, donated to the FIDO Alliance) for signed payment mandates. ACP (OpenAI and Stripe) for checkout. MPP (Stripe and Tempo, launched March 2026) for streamed micropayments against a pre-authorized session. Four protocols, four layers, real volume.

What none of them owns is the part that decides whether an agent is allowed to spend this, now, on this. MCP returns HTTP 402 inside a tool call, but it has no concept of a budget, an attribution, or an audit trail. The vendor bolt-ons are already multiplying and fragmenting.

And the question stopped being academic. US regulators now treat agent purchases as ordinary card transactions, Europe is moving to put liability on whoever deployed the agent unless they can produce the mandate and audit trail. The receipts are now a legal requirement with no standard home.

This talk maps the four-protocol stack, shows the MCP payment handshake live, and argues for the one layer the agent economy is still missing.

Enterprise mainframe systems often contain large amounts of unused and unreachable code, increasing complexity and risk. Safely removing this logic is difficult due to deeply interconnected execution paths.

In this session, I present a real-world case study where we delivered large-scale dead code remediation into production with zero incidents using an MCP-powered agentic AI approach.

We developed specialised AI agents, backed by Python tooling, to analyse code, detect unused logic, and support safe, auditable remediation with human validation. This reduced analysis time from days to under an hour per program.

The same approach was extended to business knowledge enablement using a reverse engineering agent, generating structured context integrated into Copilot Spaces, enabling finance teams to query system behaviour using natural language.

Learn how agentic AI can safely modernise legacy systems and bridge developer and business understanding.

We promised our CX team an agent that would write customer success plans. Six months and four architectures later, we shipped a compiler that calls LLMs in four places.

Each architecture was the right fix for the previous one's failure. The single skill could not enforce quality. The subagents drifted across stages. The scripted prompts hit determinism walls. Only when we accepted that "agentic" was the wrong frame did the output become reviewable, replay-able, and trustworthy enough to ship to real customers.

The talk is a tour of the architectural moments where we learned what LLM-driven systems can and cannot own. Specific failures: a real customer plan shipped with the wrong rows, a quality firewall the LLM kept violating until we made it structural, and "temperature=0" arriving as a footnote rather than a solution.

You leave with three things. A maturity curve from skill to engine. A working distinction between pipeline work and agent work. And a vocabulary for the conversation with stakeholders who keep asking when the agent will be ready, when what they actually want is a compiler with an agentic UI.

Every agent framework reinvents context management differently: scratchpads, artifacts, or memory stores. This creates distinct storage problems (system config, user memory, thread scratch, task state, shared workspaces, external data, and inter-agent messaging) collapsed under "agent context", with no shared vocabulary and a lack of interoperability.

In an attempt to close this gap for the industry at large, we present a production architecture that models agent context as scoped virtual filesystems. Agents interact through standard filesystem tool calls (read, write, and list), while the agentic AI platform enforces scope, lifecycle, and access control per mount.

The talk covers three layers. First, scoped state: how four filesystem scopes (system, user, thread, and task) compose across collaborating agents, using file modes and mount isolation to prevent cross-scope leakage. Second, external data as mountpoints: turning retrieval into navigable directory trees with ls/cd/cat semantics instead of opaque vector search. Third, protocol implications: how this maps to the MCP spec today and the case for filesystem operations as a first-class agent interoperability primitive.