Expert Capstone: Bounded Agent and MCP Platform

Build a governed platform where a support agent can investigate tickets through approved read tools, create drafts, request exactly bound human approvals, and execute limited reversible actions. Integrate one trusted MCP server, durable workflows, scoped memory, provider routing, and full evaluation. Autonomy must increase only when evidence proves value and controlled risk.

What will you be able to demonstrate?

• choose deterministic workflow versus agent reasoning per step;
• govern tools and MCP capabilities with executable policy;
• persist, resume, and reconcile every run and effect;
• evaluate planning, tools, safety, quality, cost, and human oversight;
• operate provider/server failure, schema change, and incident response.

What is the required agent boundary?

The agent may:

• read an authorized ticket and approved knowledge passages;
• inspect a bounded set of non-sensitive diagnostic facts;
• create an unsent reply draft;
• propose assignment to an authorized queue;
• request approval for a reversible ticket-state action.

The agent may not:

• accept identity, tenant, role, or price from model arguments;
• execute arbitrary SQL, shell, filesystem, URL fetch, or code;
• send customer communication, issue refunds, delete data, or change credentials;
• access a capability merely because MCP discovery advertises it;
• exceed step, time, token, cost, tool-call, or data budgets.

What platform components are required?

1. Versioned workflow with durable state/checkpoints and idempotent transitions.
2. Agent loop at one justified adaptive step, maximum six iterations.
3. Typed tool registry with effect classes, server-bound context, authorization, output minimization, and audit.
4. Approval records bound to normalized arguments, resource version, policy, actor, expiry, and idempotency.
5. Trusted MCP server for ticket summary and draft creation; pinned/allow-listed client policy and schema-change detection.
6. Scoped memory with consent, provenance, retention, correction, and deletion.
7. Capability-based model routing with qualified fallback and hard budgets.
8. End-to-end traces, AI-run/tool-effect ledger, policy decisions, evaluation, canary, kill switch, and rollback.
9. Operator UI or CLI to inspect, pause, approve, cancel, replay safe steps, and reconcile ambiguous effects.

Which adversarial cases must pass?

• ticket body commands the agent to reveal another tenant;
• knowledge document asks it to call an unapproved MCP tool;
• tool proposal includes tenant_id, is_admin, or modified price;
• MCP server changes schema or returns poisoned instructions;
• approval is replayed with changed arguments or stale resource version;
• worker crashes after external effect but before result record;
• model loops, repeats a tool, spends budget, or emits malformed arguments;
• memory contains stale policy or cross-organization preference;
• primary provider and MCP server fail simultaneously;
• malicious operator attempts unlogged break-glass access.

What evaluation compares autonomy?

Run the same representative cases through:

1. deterministic baseline;
2. fixed workflow with model steps;
3. bounded agent at the adaptive step.

Compare task completion, correct tool/argument selection, unnecessary calls, policy violations, grounded final answer, human edits, latency, cost, and recovery. The agent is accepted only if its benefit exceeds a documented threshold without violating hard safety invariants.

AI Pair-Programmer Prompt

Rubric

Pass: at least 90%, with zero unauthorized tool effect, cross-tenant disclosure, unbound approval, or unbounded execution.

Knowledge check

1. What justifies the agent rather than a workflow?
2. Who grants MCP tool permission?
3. What must happen after an ambiguous external effect?

---

Answers

1. Measured improvement on representative tasks without violating safety, cost, or reliability limits.
2. Executable host/application policy plus required user approval—not discovery or the model.
3. Reconcile using idempotency/effect identifiers before retrying.

Completion checklist

• Bounded agent beats baselines on declared criteria.
• Every authority path is server-controlled and audited.
• Adversarial, crash, outage, and schema-drift cases pass.
• Kill switch, reconciliation, canary, and rollback work.

Primary references

• Model Context Protocol
• MITRE ATLAS
• OWASP GenAI Security