There is a fundamental difference between a chatbot and an agent.
A chatbot can say something wrong.
An agent can do something wrong.
The moment AI gains access to email, CRM systems, databases, code repositories, financial systems or internal tools, enterprise governance becomes an execution problem.
This is why Model Context Protocol and similar tool standards are important — and why they are only part of the solution.
MCP makes it easier for models and agents to discover and use tools through a common interface.
But a common interface does not automatically answer the questions enterprises care about:
- Which agents can use this tool?
- Which functions may they call?
- Which user are they acting on behalf of?
- What data can leave the organisation?
- Which actions require approval?
- What happened during a particular run?
- How much did the activity cost?
Microsoft has explicitly described this as the missing control plane around agent tool execution.
Permission needs to follow the action
Traditional software permissions are often application-level.
Agent permissions need to become more granular.
For example, an enterprise may be comfortable allowing an agent to:
- read CRM records,
- search email,
- inspect documents,
- create a draft.
The same organisation may not want that agent to:
- modify CRM ownership,
- send an external email,
- delete a document,
- approve a payment.
The tool therefore cannot simply be “available” or “unavailable”.
Capability itself needs policy.
Human approval is a feature, not a failure
Agentic systems are sometimes described as though the ultimate goal is complete autonomy.
For enterprise use, that is often the wrong target.
The optimal workflow may deliberately contain human approval.
A marketing agent can prepare a campaign and stop before publication.
A finance agent can reconcile an invoice and escalate discrepancies.
A legal agent can identify clauses but require counsel to approve changes.
This allows the organisation to automate most of the work without automating the part where judgement or accountability genuinely matters.
The result can still produce enormous efficiency gains.
Governance can actually increase adoption
Controls are sometimes treated as friction.
In enterprise AI, good controls can have the opposite effect.
People delegate more when they understand the boundaries.
A user is more likely to allow an agent into a real workflow if they know:
- what it can access;
- what it cannot access;
- which actions are logged;
- where approval occurs;
- how to stop it.
Governance therefore becomes an enabler of autonomy.
Iridium’s Tools layer
The Iridium model separates Tools from the model itself.
That is deliberate.
Models should be replaceable.
Permissions should belong to the organisation.
An enterprise should be able to decide that an agent may retrieve from Salesforce but not update it, or draft an email but not send it, regardless of which LLM happens to be reasoning about the task.
The intelligence layer should control the boundary.
The model should operate inside it.
Sources
- Microsoft for Developers, Securing MCP: A Control Plane for Agent Tool Execution (2026)
- Microsoft Learn, How do enterprises control what agents can do? (2026)