The sharpest point here is that tool calling turns every model response into a side effect, so the design question stops being 'can the agent call tools' and becomes 'what authorizes each call'. Most MCP examples stop at read-only APIs, but the hard cases are writes: paying an invoice, sending a message, mutating state. That is where agents need per-call keys with spend limits and approval gates, more of a wallet and identity problem than a protocol one. CAI's agent wallet work is one attempt at that layer, using session keys to sign and pay for tool calls instead of one blanket API token.