Making those agents safe enough to actually use is the harder problem.
Workato is now pushing MCP further in that direction with Enterprise MCP, a governed layer that lets AI agents perform real actions across business applications while restricting exactly what those agents are allowed to do. Instead of handing an AI agent unrestricted API access, businesses can expose predefined actions through Workato recipes and connectors. An agent might be allowed to create a CRM opportunity, update a support ticket or trigger an employee onboarding workflow without being given general access to everything behind those systems.
Workato then adds the boring things that become extremely important once agents leave the demo environment: authentication, role-based permissions, identity tracking, audit logs, rate limits and centralized governance.
That might sound like enterprise IT infrastructure, but the underlying idea matters for smaller businesses too.
We are rapidly moving from AI that answers questions to AI that performs actions.
An agent connected through MCP could potentially read an incoming lead, research the company, update the CRM, create a proposal, schedule follow-ups and notify the sales team.
The technical ability to do that already exists. The problem is deciding what happens when the agent makes a mistake or when someone manipulates its instructions, or when an employee who normally has limited CRM access suddenly gains access to administrative actions because the agent is running through one shared API credential.
Workato’s approach is to make MCP an execution layer where agents operate through approved skills rather than improvising directly against raw APIs. Every action can be logged, attributed to a user and restricted according to that user’s permissions.
Workato says its MCP infrastructure can connect agents including ChatGPT, Claude and Cursor to thousands of applications through its existing automation platform.
You probably don’t need Workato specifically to apply the lesson, though. If you are building AI automations with n8n, custom MCP servers or other agent platforms, start treating agent permissions the same way you would employee permissions. Give agents the minimum access required. Separate read and write capabilities. Put approval steps around destructive or expensive actions. Log what agents do. Avoid handing a general-purpose agent one powerful service account.
MCP solved an important connectivity problem.
The next problem is making sure the AI connected to your business cannot accidentally run the whole thing.