Your own team's tools, safely reachable.

Your own teams are already pasting data into assistants because it is faster than the internal tool. The request arriving on the platform team's desk is to make that path official.

The constraint is that internal APIs were built assuming the caller is a trusted service, not an assistant driven by whoever happens to be typing.

Handing an assistant a service credential collapses every internal role into one. Anyone who can reach the assistant can reach everything the service could.

Worse, the credential tends to end up in a client config on a laptop, where it outlives the person's access to the systems it opens.

1. 01A support engineer asks: "What is the status of order 88213?"
2. 02The assistant calls get_order carrying that engineer's session.
3. 03LockMCP verifies it and checks their role: support may read orders, not refund them.
4. 04The refund tool is not listed to this user at all, so the model cannot attempt it.
5. 05The read executes with credentials injected server-side.
6. 06The call is logged against the engineer, and shows up in the same audit view as everything else.