“It’s these three people.”
That’s what a consultant in the room hears when he asks clients who will own the AI project his firm has been hired to build. His reply: “Is that how you’re going to run it?”
Three owners, in practice, means no single person is accountable. And that’s usually when the project stalls. The client finishes phase one, gets ready for phase two, then tells the consultant to pause the project until they figure out governance.
When LEAP on Tour rolled into Chicago, the questions were mostly technical: Identity, rate limits, inventory. At our LEAP on Tour stop in New York, the room kept coming back to something harder. Three working groups brought together a global market data provider, a New York bank, a fintech, an investment firm, an AI agent company, a design systems lead from a large web platform, consultants and an early-stage data startup. Some had customer-facing MCP servers in production; one attendee had looked up MCP for the first time after receiving the invite. Wherever they started, every table ended up at the same place.
Here’s what New York wouldn’t let go of.
1. Who actually owns MCP?
Two patterns surfaced. Most traditional enterprises treat MCP as “just another API” and hand it to the platform team that already runs API management. A smaller group, often the most AI-forward, splits it off, with an AI team owning the models, the AI gateway and MCP, separate from the API organization.
LEAP on Tour panelist Kellye Rogers, who led AI enablement for around 17,000 engineers at a major bank, described the first pattern in practice. MCP landed on the desk of the VP of the API platform with little more than “here you go.”
Neither pattern is wrong, but one attendee put it simply: If MCP runs separately from your APIs, you should be able to explain why. Underneath every MCP tool is an API, and the governance you already have for your APIs is the foundation for the MCP governance you need.
The harder split is between business and engineering. AI budgets now sit with the business, while engineering is reluctant to be accountable for probabilistic behavior. Kellye’s answer? The owner is whoever owns the KPI or ROI the agent is meant to move.
2. What does “production-ready” actually mean?
Kellye offered the clearest test of the day. An agent is ready when someone who didn’t build it can tell you what it does, who authorized it, and how to shut it off.
She also explained why banks are ahead: “It’s not because banks are so much braver than everybody else.” The accountability muscle already existed from years of model risk work.
The room had a real example. A New York bank’s first fraud-detection vendor spent months waiting for data access and its pilot ran out of time. The second vendor arrived knowing exactly what identity and access it needed, and that model is now in production. Same bank, same data, same rules. The difference was readiness.
3. Can you see what’s at your front door?
Keynote speaker Kin Lane opened with a simple rule: “You can’t govern what you don’t know about.” His own traffic has flipped from 80% human to 80% bots.
After scanning about 32,000 providers, he found that only around half of the claimed MCP servers could actually be reached and probed, and fewer than 10% handle authorization properly. His bigger point was that agent readiness never rises above the API foundation underneath it. Rate limits, standard error formats, examples, and idempotency are no longer nice-to-haves.
4. Can you trust what comes back?
The most technical table argued that reliability starts with evaluation, and that LLM-as-judge isn’t reliable enough. Instead, they test agents against simulated environments and check real outcomes, like whether the account balance is right. The harness matters more than the model.
Panelist Irene Aldridge took the same view from finance: “We have to fight these probabilistic models with statistics.” Track the distribution of outputs, set bounds, and kill the agent automatically when it drifts.
A market-data provider raised the curation side. When a customer asks for “earnings per share,” which definition should the MCP server return: Diluted, adjusted, unadjusted? That’s why converting thousands of endpoints one-to-one into MCP tools creates a mess, and why curation belongs in generation: Trimming methods, renaming tools for agents, and adding resources and prompts.
5. What does it cost to leave it on?
One attendee had built his own MCP server and then switched it off, worried about runaway costs and malicious traffic. Others are building their own model routing to keep token spend under control.
This is where per-consumer, per-tool rate limits and quotas come in. You can cap a single tool for any one consumer while leaving the rest of the server open. Combined with token exchange, which we ran live, each call carries a scoped token valid for one action and 90 seconds, which shrinks both the blast radius and the bill.
Where this leaves us
Kellye said what surprised her at the bank was what actually held them back. It wasn’t the models or the tooling. “The lack of governance was the thing that was slowing us down.” That’s why she now helps regulated organizations put governance in place first, not to add friction but because it lets people move fast.
Governance builds trust in who owns the agent, what it’s allowed to do, and how to stop it. Once that trust is in place, teams stop waiting for permission and start shipping. In Kellye’s words:
“AI just moves at the speed of trust instead of fear. And fear is super slow.”
That was New York’s answer. The technology to govern MCP exists today. What makes the difference is the trust it lets you build.
Trust has a geography, too. Kin has spent the past few weeks in Stockholm, London, Amsterdam, and Munich, and he’s hearing the same thing everywhere: “Sovereignty is huge.” European teams want to build software and run models in their own countries, and they’re looking hard at open models and open infrastructure to get there.
We’re expecting to pick up this conversation when LEAP on Tour arrives in Paris on Monday, November 30, 2026. Before then, we head to Dallas on November 4. Book your seat for Dallas and bring the question you can’t answer yet. And if you’re going to be in Paris on November 30, join us there.
