Tools: The Manifestation of Agency in AI

Enterprise agentic AI is fundamentally different from personal automation. These are not "personal automation toys"—they must operate at scale, adhere to stringent security and governance policies, and manage critical business workflows.

The foundation is the enterprise's existing Systems of Record (SoRs)—Workday, Salesforce, ServiceNow, SAP—the authoritative sources for all business data and operational processes across HR, finance, sales, and support.

From the customer's perspective, connectivity is binary: if the agent cannot utilize the customer's established enterprise tools, the agent is functionally useless. Organizations should not be expected to redesign or change their core systems to accommodate a new AI agent. The agentic platform's ability to integrate seamlessly and securely with the client's current ecosystem is the single most critical factor for adoption and utility.

Agents utilize four essential categories of tools to meet business requirements:

Data Tools handle knowledge retrieval and creation. They ingest documents from SoRs (Workday, ServiceNow) and cloud stores (Google Drive, SharePoint), transforming raw data into a structured knowledge graph that agents can efficiently query for decision-making.

Action Tools enable agents to take read or write actions within SoRs—the agent's hands within the enterprise. Examples: checking an employee's vacation balance or filing sick leave in Workday, updating a lead's status in Salesforce, or creating a new support ticket in ServiceNow. Agents typically use Action Tools to record a decision, execute a transaction, or look up crucial real-time information.

Alert Tools play a reactive role, allowing agents to respond to events (or triggers) happening live within SoRs. When a new high-priority ticket is created in Zendesk, the agent can analyze and potentially auto-respond. When a lead's status is updated in Salesforce, the agent can perform follow-up actions immediately.

Interaction and Visual Tools allow agents to interact with systems lacking formal APIs by analyzing the front-end visually and programmatically. This gives agents web access for both data retrieval and updates—moving beyond the brittle, fixed workflows of traditional RPA by leveraging the agent's intelligent, dynamic reasoning.

Distinguishing these two types is critical for establishing governance models:

Proxy Agentic Systems operate strictly on behalf of a specific human user, inheriting that user's existing permissions. Example: an employee using a conversational agent to check a vacation balance in Workday. The agent's actions are a direct proxy for what the human user could do directly.

Autonomous Agentic Systems operate independently and on their own schedules, performing tasks and making decisions based on business logic without a real-time human trigger. Examples: a support assistant that uses an Alert Tool (via webhook) to analyze a newly created high-priority Zendesk ticket and automatically draft a response or route it to a specialized team; or an SDR agent that follows up with a customer immediately after another system updates the lead's status in the CRM. These systems have their own agency and must be treated as digital employees—with their own identities, audit trails, and specifically scoped permissions separate from any human user.

The governance requirements for these two types of systems diverge significantly.

Governance is a topic many agentic systems overlook, yet it is foundational to enterprise AI adoption. Requirements diverge sharply by agent type.

For Proxy Agents: The mandate is absolute—a proxy agent must never perform any action the human user cannot perform directly in the underlying SoR. The agent's capacity is fundamentally limited to the human's pre-existing permissions. This principle applies universally across all four tool types: Data, Action, Alert, and Interaction/Visual.

For Autonomous Agents: These must be governed as digital employees with a robust framework. They require their own unique identities and specifically scoped permissions mapped to the underlying SoRs. The agentic tooling must maintain a comprehensive audit trail logging what was done, when it was done, and the business logic that initiated it. This requirement for identity, defined permissions, and detailed logging applies to all four tool types.

Passthrough Authentication: Governance Without Provisioning

Consider an agentic system developed for employee assistance using a voice or chat interface. By definition, this is a Proxy Agentic System—it acts on an employee's behalf. In an organization with thousands of employees, the traditional approach would require provisioning every user within the agentic platform itself: creating, managing, and synchronizing their identities. This model is a SaaS-era relic that introduces unnecessary complexity and a new security surface.

Instead, the agentic platform must work seamlessly with the enterprise's existing Identity Providers (IDPs). Passthrough Authentication ensures the agent respects authorizations already set in the SoRs and silently authenticates, authorizes, manages, and refreshes tokens on the user's behalf. Automatic token refresh is critical—especially for proxy agentic systems. If users are forced to re-authenticate every time they access tools, it creates significant usability friction and hinders productivity.

Auditing in Passthrough Systems: Even without user provisioning, the platform must know each user's identity for audit purposes. The verified identity passes through from the front-end—Microsoft Teams, Google Chat, browser, mobile app, or voice system—which has already authenticated against the IDP. Every proxy agent action is logged and tied to the validated human identity.

Auditing in Autonomous Systems: The audit trail tracks the system's own provisioned identity, logging every action with the agent's ID, timestamp, and initiating business logic.

In both cases, every action is fully verified and meticulously audited. This achieves governance without provisioning—drastically simplifying deployment while keeping capabilities aligned with access rights.

Efficient Tooling: Minimizing Latency and Load

Efficiency is critical for both the agentic system and the underlying SoRs it interacts with. When ingesting data from a file store, the agent should only fetch what has changed—new or modified documents—not the entire corpus. When querying a SoR, it should retrieve only the necessary fields and records.

Achieving this precision requires the agentic system to first introspect the available APIs and intelligently select the most efficient ones for the specific task. Without this careful approach, agents fetch and process excessive amounts of data, leading to unnecessary load on both the underlying system and the agentic platform—ultimately impacting performance and cost.

The underlying technology of enterprise tools is highly diverse. Agents must work with any form—REST APIs, GraphQL, introspectable protocols like MCP, API specifications (Swagger/OpenAPI), and custom or legacy systems without documented APIs. The platform must handle this full spectrum: auto-generating tools from API specs where available, and supporting custom tooling for on-premise or undocumented systems.

Multi-Step Tools

Most SoR APIs expose only basic, single-step operations. But practical business use cases require sequences of actions. A simple instruction like "Close Jira ticket XYZ-100" is actually a multi-step workflow: first, the agent must check the available transition states and their unique IDs for the ticket via the Jira API; then, it must call the specific transition function with the correct transition ID to close it.

Two approaches enable this intelligent tool chaining:

Static: Pre-built multi-step functions created during tool development—AI suggests popular tool combinations, which are tested, validated, and stored in the catalog. Highly reliable for common workflows.

Dynamic: The agentic system combines single-step tools on the fly using intelligent orchestration, addressing novel requests not covered by the static catalog.

The Role of Model Context Protocol (MCP)

MCP is a key architectural layer that sits atop all available tools, imbuing the agentic system with enhanced intelligence for tool use. It enables agents to:

Introspect capabilities—dynamically querying what each tool can do, what data it needs, and what it produces. This eliminates reliance on static, pre-programmed assumptions.

Select optimally—intelligently choosing the best tool for a specific purpose at any given moment. If both a dedicated Salesforce Action Tool and a generic Interaction Tool can update a lead, MCP guides the agent to choose the more reliable Salesforce Action Tool.

Orchestrate dynamically—facilitating the combination of single-step tools into complex, multi-step workflows. This is the intelligent orchestration layer that solves novel problems not covered by the pre-built catalog.

Manage the agentic lifecycle—MCP is not merely a mechanism for tool selection and orchestration. It can also function as the foundational layer that allows users to fully manage the agentic lifecycle—including creation, validation, and secure deployment of agentic systems.

By providing this layer of context and capability, MCP ensures that agents utilize the enterprise ecosystem as efficiently and effectively as possible.

Analytics Tools

Enterprises often prefer to keep agents away from core SoRs for analytical workloads. Analytical queries require integrated, historical, and aggregated data that typically lives in a Data Warehouse or Data Lake.

Agents access this analytical data through two mechanisms:

Pre-built Reporting Tools: Agents leverage existing reports and dashboards via APIs for standardized information. An MCP layer atop these analytics stores lets agents intelligently select the right report—bypassing resource-intensive queries by utilizing pre-computed analytics.

Ad-Hoc Query Tools: NL2SQL technologies let agents generate custom SQL from natural language, enabling exploratory analysis. Instead of being limited to predefined questions, agents can ask novel questions, generate complex joins, and iterate through hypotheses to surface deeper insights.

Platform Requirements for Tool Development

No-Code Tool Generation: The platform must provide all required tools out-of-the-box for common systems. Critically, for proprietary or custom systems, it must offer a no-code mechanism to generate new tools. This drastically lowers barriers to adoption and allows non-developer domain experts to extend the agent's reach quickly and securely.

Tools Catalog: A comprehensive catalog of all available single-step and multi-step tools is essential for managing complexity at scale. The catalog must version tools properly for safe updates and rollbacks, and isolate common tools (shared across all tenants) from tenant-specific tools (custom-built for a single organization). This isolation is essential for security and efficient maintenance.

Sandbox Systems and Mock Servers: Development must be decoupled from production SoRs—some are expensive or difficult to procure, and developers should not touch live systems. The platform must provide mock servers that emulate real APIs and behaviors with industry-specific data. Once development is complete against the mock server, the system can be tested with a sandbox instance of the real SoR before production deployment.

In a true Enterprise Agentic Control Plane, tools are not static assets—they are managed production systems with a defined lifecycle. To ensure reliable and governed execution, the platform must provide capabilities to version and snapshot tools for safe updates, rollbacks, and historical tracking; promote changes safely from development to staging to production with preview-and-execute visibility; and validate tools against enterprise policies and security guardrails before deployment to ensure they act within defined permissions.

Ema's Agentic Platform is designed from the ground up to meet these enterprise requirements. It includes ready-made, battle-tested agents that are highly configurable and purpose-built. These core agents can be customized in millions of combinations, enabling the creation of a vast array of specialized AI Employees. Crucially, Ema's agents are capable of using all four tool types—Data, Action, Alert, and Interaction/Visual—in any underlying technical form, ensuring maximum compatibility and utility across your entire enterprise ecosystem.

Ema transforms agentic AI from disconnected pilot projects into a reliable, repeatable operating platform layer for the enterprise. Tools serve as the crucial link between AI's potential and tangible business performance. By offering a governed, managed lifecycle for these digital limbs, AI ceases to be a novelty. Instead, it functions as the standardized infrastructure for a dependable, scalable digital workforce.

Ready to lead the Agentic Business Transformation? Book a demo to see how Ema is building the workforce of the future.