The first agent we shipped in 2024 lived in a chat bubble and answered questions. The last one we shipped checks CargoWise, drafts a customer email, books a slot in Cal.com, and posts a summary to Slack — and nobody calls it a chatbot. The difference is the integration stack underneath.
The shift
Two protocols matured at once. WhatsApp Business Cloud API made the Gulf's default channel programmable — with quirks worth respecting: 24-hour session windows, template-approval delays, strict opt-in rules. And MCP (Model Context Protocol) standardised how models reach tools, so an agent's capabilities become declared, auditable surface area instead of bespoke glue code.
An agent that can only talk is a FAQ. Value starts when it can act — safely.
How we assemble it now
Channel layer: WhatsApp/web/voice normalised into one conversation model, session windows handled explicitly.
Reasoning layer: the model (Claude or GPT per use case) with the guardrail wrapper — PII redaction, refusal rules, escalation triggers.
Tool layer via MCP: calendar, CRM, order systems exposed as typed tools with allow-lists. Every action is logged; destructive actions require human confirmation. n8n still earns its keep for orchestration between systems that predate all of this.
The allow-list is the security model: an agent that can do anything is an incident report waiting for a timestamp. Ours can do exactly what's declared, nothing else.
When to skip it
If one channel and zero actions solve the problem — a docs-grounded FAQ — skip the stack and ship the simple thing. Integration depth is for when actions, not answers, carry the value.
- Treat WhatsApp's session rules as architecture, not trivia.
- Expose tools via MCP with explicit allow-lists.
- Log every action; gate destructive ones on humans.
- Match stack depth to the value of actions.