Your AI agent can't reach your systems. Here is what it can still do

Ask an AI agent to move a customer's appointment and one of two things happens. If it has a connection to your diary, it moves the appointment. If it doesn't, it can only say that it will ask someone to. The model is the same in both cases. The difference is the plumbing.

This is the least glamorous limit on AI agents and, for most businesses, the most important one. It is also the limit that vendors mention least, because the honest answer to "can it update our system?" is very often "not yet".

An agent is only as capable as its tools

A language model on its own produces words. To do anything, it needs tools: defined actions it is allowed to call, such as "look up an order", "list free slots" or "create a booking". Each tool is a connection to a real system, usually through that system's API.

So the agent's abilities are the sum of its tools. No tool for refunds, no refunds. This is why the same AI agent can look brilliant in a vendor's demo, where everything is connected, and limited in your business, where the job-management system was installed in 2014.

Most businesses are barely connected

MuleSoft's 2026 survey of 1,050 IT leaders gives the scale of it. The average organisation runs 957 applications, and 27% of them are connected. 82% named data integration among their biggest challenges in adopting AI, and 86% agreed that without proper integration, agents add complexity instead of value.

Those are large organisations with IT departments. A twenty-person heating firm or estate agency typically has a CRM or job system, a diary, an accounts package, a shared inbox and a spreadsheet nobody admits to. Some have an API. The spreadsheet does not.

Benchmarks reflect the same thing. On tidy, well-specified tasks with the right tools, the best agents now complete around 85 to 88%. On Salesforce's CRMArena-Pro, which simulates messier work across business systems, leading agents managed about 58% of single-turn tasks and about 35% over several turns.

What an agent can do with no integrations at all

Quite a lot, as long as you are clear about where its job ends. With nothing connected but your phone number, your messaging channels and a set of documents, an agent can:

• Answer. Opening hours, prices, areas covered, how the process works, from the web pages and documents you give it.
• Be there. Pick up at 9pm, reply on WhatsApp on a Sunday, call a new enquiry back in seconds.
• Qualify. Ask your questions: what the job is, where, how soon, what budget.
• Capture. Save names, addresses and answers as structured details, not just a transcript.
• Agree a next step. "Someone will ring you tomorrow between nine and ten" is a real outcome, if someone then does.
• Hand over well. Put the conversation in front of the right person with a summary.
• Follow up. Chase the people who didn't answer, across channels, until they reply or decline.

What it cannot do is the final action in your system. A person does that. For many teams this is still most of the value, because the expensive part was never typing the booking into the diary. It was being available, asking the questions and chasing.

What to connect first

You don't need everything. Connections differ a great deal in value and in risk, and it pays to add them in this order.

Stage one often needs no development at all: most CRMs can send a webhook or work through Zapier, Make or n8n. Stage two is where customers start to notice, because "your engineer is booked for Thursday at 2" is a far better answer than "I'll ask someone to check". Leave stage four to people for longer than feels necessary.

What MCP changes, and what it doesn't

The Model Context Protocol is the piece of jargon you will hear most. In plain terms it is a common plug. A system that offers an MCP server describes its tools in a standard way, and any agent that speaks MCP can use them without someone writing custom code for that pairing.

It has caught on quickly. The protocol was donated to the Linux Foundation's Agentic AI Foundation in December 2025, by which point there were more than 10,000 published MCP servers and support from the major AI assistants. In MuleSoft's 2026 survey, 39% of organisations said they were using it.

What it changes: if your booking tool, helpdesk or CRM publishes an MCP server, connecting an agent to it becomes a matter of configuration. More vendors add one every month.

What it doesn't:

• It doesn't help with a system that has no way in. An old on-premises database with no API has no MCP server either.
• It doesn't decide permissions. Someone still has to choose what the agent may see and do.
• It doesn't make the agent reliable. A well-described tool can still be called at the wrong moment or with the wrong details.
• It doesn't settle security. Governance of who can connect what is, by most accounts, running behind adoption.

Questions worth asking a vendor: which of our systems can your agent use today? Read only, or changes too? What does it do when a tool fails mid-conversation? And what does the customer hear while it waits?

Voice makes tools harder

One caution if your agent works on the phone. Using tools over a call is harder than in text, because the details have to be heard correctly first. In Sierra's τ-Voice benchmark, published in March 2026, a text agent completed 85% of service tasks where voice agents in realistic conditions completed 26 to 38%, and the researchers called authentication, capturing names, emails and codes, the dominant bottleneck. Scores have risen sharply since, to about 80% for the best voice model, but spelling a surname over a mobile line remains a weak point.

The practical answer is to play to each channel. Let the call do the talking and send a text to confirm the email address or the booking reference in writing. We cover the technology in how AI phone calls work.

Where there is no tool, there is a person

Put the two halves together and you get a simple rule for designing any customer journey with AI in it. At every step, either the agent has the tool and does the work, or it doesn't and the work goes to a person with everything they need.

What you want to avoid is the third possibility, where the agent has no tool and no route to a person, so it improvises. That is where invented policies and promises nobody keeps come from.

In Unibound this is drawn explicitly. A flow shows each step and what follows it: an AI call here, a request to your calendar there, a "call by a person" step where the decision belongs to your team. As you connect more systems, steps move from people to the agent, one at a time, and you can see exactly which ones have. Agents are given named tools, not the keys to everything.

That is a slower story than "deploy an AI workforce". It is also the one that works with the systems you actually have. For what a good handover looks like, read AI-to-human handoff, done properly, and for the wider picture, what AI agents can't do yet.

Questions people ask