The sharpest point here is that tool calling turns every model response into a side effect, so the design question stops being 'can the agent call tools' and becomes 'what authorizes each call'. Most MCP examples stop at read-only APIs, but the hard cases are writes: paying an invoice, sending a message, mutating state. That is where agents need per-call keys with spend limits and approval gates, more of a wallet and identity problem than a protocol one. CAI's agent wallet work is one attempt at that layer, using session keys to sign and pay for tool calls instead of one blanket API token.
The sharpest point here is that tool calling turns every model response into a side effect, so the design question stops being 'can the agent call tools' and becomes 'what authorizes each call'. Most MCP examples stop at read-only APIs, but the hard cases are writes: paying an invoice, sending a message, mutating state. That is where agents need per-call keys with spend limits and approval gates, more of a wallet and identity problem than a protocol one. CAI's agent wallet work is one attempt at that layer, using session keys to sign and pay for tool calls instead of one blanket API token.