Let your operators ask, not click.

Your customers' operators live in your product all day, and they have started asking why they cannot just ask for what they need. They want to pull a rent roll, check which units are turning over, or draft a renewal without clicking through six screens.

At the same time their IT and compliance people are asking a harder question: if an assistant can read a rent roll, what stops it reading a portfolio that operator has no business seeing?

The quickest path is to mint one API key, hand it to the assistant, and let it call your API. That works in a demo and fails in production for a specific reason: the key carries your service account's permissions, not the operator's.

Once the agent holds that key, every user of the assistant has the union of everything your API can do. A leasing agent at one management company can ask for another company's data and your API will happily answer, because your API was never told who was asking.

Revocation is no better. Removing an operator's access in your product changes nothing, because the credential the agent is using was never theirs.

1. 01A leasing agent asks their assistant: "Which units at Riverside are vacant next month?"
2. 02The assistant calls the search_units tool on your LockMCP endpoint. It has no API key. It carries a short-lived session belonging to that leasing agent.
3. 03LockMCP verifies the session, resolves the person, and checks their role against the tool. The role is allowed to call search_units.
4. 04The property parameter is narrowed to the property IDs that agent actually manages, so the model never sees Riverside, and cannot ask about it, if it is not theirs.
5. 05Your credentials are decrypted in memory and the call goes to your API. The response comes back, and the request is written to the audit log against that agent's name.
6. 06The next morning their manager can see exactly who asked what, and the compliance team has an answer that does not begin with "the integration".