Agentic AI, AI agents and MCP servers
Business AI architecture explained through Bexio examples, OAuth, permissions, approvals, logging and data protection.
By Ralph Heezen
Agentic AI breaks a goal into steps, selects tools and uses results for subsequent actions. An AI agent implements that pattern. MCP, the Model Context Protocol, standardises tool discovery and calls. Permissions, privacy and approvals require separate enforcement.
‘Find this customer and product and prepare a quote’ illustrates the shift from answering to acting. A controlled agent can search Bexio and create a draft; this is where both value and risk arise.
Chatbot, assistant or agent?#
| Type | Behaviour | SME example |
|---|---|---|
| Chatbot | Answers questions | Delivery FAQ |
| Assistant | Processes supplied content | Summarise an enquiry |
| Agent | Chooses defined tools | Search records and prepare a draft |
| Agentic workflow | Combines AI with deterministic steps | Extract PDF, validate, route exceptions, draft order |
Use ordinary code when inputs and rules are clear. Agents fit language, documents and ambiguity where permitted actions can remain narrow.
Production architecture#
- Identity: an authenticated person or service owns the task.
- AI client: interprets the request and proposes tools.
- Adapter: MCP or direct tool calling maps proposals to defined functions.
- Policy/privacy: enforces roles, fields, minimisation and approval.
- Business system: performs permitted reads or writes.
- Result/audit: returns results and records user, action, approval and outcome.
The model proposes; the application enforces. Prompts alone are not access controls. See our architecture and fictitious-data privacy demo.
MCP or direct APIs?#
| Criterion | MCP | Direct tool calling |
|---|---|---|
| Purpose | Reusable tools for compatible clients | A defined application or workflow |
| Fit | Several clients share functions | One focused process |
| Portability | Reusable protocol contract | Application-specific adapter |
| Control | Requires policy, authentication and logging | Enforced in your backend |
| Complexity | Additional protocol component | Often fewer layers |
MCP sits before the underlying API and does not automatically filter excess data. A direct adapter can be smaller for one stable workflow. AI agents and MCP covers both; system integration covers deterministic connections.
A controlled Bexio workflow#
- State customer, product and quantity.
- Search contacts; resolve multiple matches through a person.
- Search items; do not invent missing prices.
- Summarise proposed records and amounts.
- Require approval for the write where appropriate.
- Create a draft and let the employee review and send in Bexio.
Our administrative copilot demonstrates curated direct tools. The working Bexio MCP server exposes 29 tools with OAuth, stdio and Streamable HTTP. Demonstrations use fictitious data; customer permissions and production setup are scoped separately.
Avoid universal execution tools or unrestricted API/database access when narrow functions suffice.
OAuth and permissions#
The intended Bexio production approach uses OAuth 2.0 authorisation code and refresh tokens, stored server-side. Demo tokens use AES-256-GCM. Personal access tokens are temporary fallbacks.
Review system scopes, user/tenant roles and the concrete action. Reads, drafts, sending and irreversible changes have different risk. Multi-company operation requires tenant-separated token storage and data access; a demonstration is not automatically a finished multi-tenant product.
Human approval#
- Chat confirmation is understandable but insufficient alone for critical actions.
- Server approval tokens can enforce a separate authorisation step.
- Draft-first operation leaves publication and sending in the business system.
Payments, deletions, contract changes and bulk exports require stronger enforcement or should not be exposed as agent tools.
Audit logging#
Record initiator, tenant, tool, time, approval, result, filtered data classes and resulting business IDs. Avoid unnecessary raw personal data. Production logs need persistence, protected access, retention and tenant separation.
Define errors before the pilot#
| Situation | Controlled response |
|---|---|
| Ambiguous contact | Ask for selection |
| Missing item/price | Stop and request details |
| 401/403 | Renew token or deny access |
| Rate limit | Controlled retry where safe |
| Unclear write result | Reconcile before repeating |
| Partial batch failure | Report successful and failed rows |
| Tool loop | Hard round limit |
| Personal data in free text | Content filtering alongside field rules |
Our copilot limits tool rounds and avoids blind parallel writes. Exception behaviour matters as much as the successful demo.
Data protection#
Swiss hosting does not establish compliance by itself. Assess the entire flow: fields, recipients, purposes, storage and access. Minimise retrieval, filter identifiers, separate reads and writes, select suitable providers and document approvals and deletion.
Tokenisation is pseudonymisation, not anonymisation. Read tokenisation in practice and our privacy notice.
Choosing the right tool#
MCP fits shared tool catalogues across clients. Direct integration fits one focused application. No agent may be needed when code, a scheduled job or dashboard solves the task reliably. Compare options in AI tools for SMEs, or test a defined flow with a free prototype.
Understand a controlled AI agent
See how roles, tools, approvals and MCP work together in production.
View AI agents