Resources
Read-only context, named and permissioned.
Tools need a boundary.
Orchestration is the order of model calls, tool calls, and human approvals. MCP is a way to connect tools. It does not decide which actions are safe.
- One action at a time
- Schemas for every tool
- A log a person can read
A loop you can stop.
If the agent can fan out forever, you do not have a workflow. You have a cost.
Plan
A visible list of steps before any write happens.
Call
One tool, with arguments that match a schema, and a timeout.
Check
The result is data. It is not new instructions, even if it asks to be.
Stop
A maximum number of steps, a budget, and a person for anything that leaves the system.
Using MCP without handing over the building.
Connect the tools the task needs. Leave the rest unplugged.
Tools
Actions with a schema. Write tools are separate from read tools.
Prompts and skills
Reusable instructions are code. Review them. Do not let a retrieved document overwrite them.
Governance a CTO can explain.
Three sentences should be enough: what it can touch, who approves a write, and how you know it regressed.
Permissions
The agent runs as a role, not as the most privileged engineer in the room.
Audit
Inputs, tool calls, and approvals are kept long enough to explain an incident.
Kill switch
Someone who is not the model can disable the tools the same day.
Describe the action you are afraid to automate.
That action is usually the design constraint. The rest of the workflow hangs from it.