The Model Context Protocol, an open standard introduced in late 2024, gave AI applications a common way to discover and call external tools and data sources. Adoption across model providers and developer tools followed quickly, and connecting an agent to a CRM, a ticketing system or a property management system went from a project to an afternoon.
That is good for builders and a new problem for operators. An agent that can call a tool can call it at 3am, a thousand times, with the wrong guest's reservation number. The model's quality does not change that. The boundary around it does.
What a governed tool layer does
In every Opsian deployment, agents never touch a business system directly. They act through a tool layer that enforces five things on every call:
- Authentication of the agent as a distinct identity, never a shared service account.
- Scope: each agent sees only the tools and records its role and property require.
- Rate limits sized to the job, so a loop fails small.
- Masking: guest-facing agents receive tokens in place of sensitive values such as door codes.
- Logging of every call, argument and result, tied to the conversation that caused it.
On top of that, the operator decides which topics always go to a person and how far an agent may go on its own. Refunds above a threshold, anything involving a minor, a complaint that mentions a lawyer: those route to staff every time, regardless of what the model thinks.
Standards help; boundaries decide
Open protocols are a real improvement. They make tool access consistent, inspectable and portable between models. But a protocol describes how an agent asks for a tool, not whether it should be allowed to. That decision belongs to the operation, and it has to be enforced in code the model cannot talk its way around.
