MCP has become the USB of the agent world: one protocol, and suddenly everything wants to plug into everything. That's exactly why enterprises should be careful. The demo pattern — spin up a server, point it at a database, watch the agent go — answers none of the questions that matter in a bank or an insurer: which agent may call which tool, acting as whom, within what limits, and where's the evidence?
One doorway, not fifty
The first architectural decision is the most important: agents reach enterprise systems through one governed MCP gateway, not through a sprawl of ad-hoc servers each team wires up for itself. The gateway is where identity is enforced, entitlements are checked, calls are logged and limits are applied. Fifty independent MCP servers isn't an agent platform — it's fifty unaudited side doors.
Agent identity is not user identity
The tempting shortcut is to let the agent act on a broad service account "for now". This is the single most common governance failure we see. An agent needs its own identity, with its own entitlement set — and that set should be narrower than the human it assists, scoped per tool: this agent may read policies and create drafts, not approve claims. When an agent acts on behalf of a user, both identities belong in the audit record.
Tools are products, not endpoints
A tool an agent calls needs what any good API needs, plus more: a name and description an LLM can't misread, a flat and explicit schema, versioning, and documented failure modes. The discipline is the same one ODM teams learn building agent-facing decision facades — design the contract once, govern it, and resist the urge to expose raw internals. A confusing tool doesn't just fail; it gets misused confidently.
Curate ruthlessly
The instinct is to wrap everything — 500 operations, available to every agent, just in case. Resist it. Agents choose tools by reading descriptions; a catalog of 500 near-duplicates makes every choice worse and every audit harder. Start from one use case and publish the five to ten tools it actually needs. Grow the catalog the way you'd grow any product portfolio: deliberately, with an owner per tool.
The integration estate is the head start
Here's the good news for anyone running ACE and MQ: the hard part of MCP in the enterprise isn't the protocol — it's having clean, governed operations to expose. If your integration layer already has standardized flows, error handling and logging, your MCP gateway is a thin, well-behaved layer on top. That's the pattern we build in ACE as the tool layer for AI agents — and it's why estates with a real integration framework get to production agents faster than greenfield stacks.