A support bot that can only read your FAQ is a search box with manners. The value appears when it can look up an order, issue a credit within policy, or reschedule a delivery. That requires connecting the model to systems, and doing so safely.
We expose systems to the model through typed tools, increasingly via the Model Context Protocol. Each tool declares what it does, what inputs it accepts and what it is allowed to change. The model proposes; the tool layer enforces.
Authorization lives outside the prompt. Limits like maximum refund, allowed customer segments or business hours are code, not instructions the model could be talked out of.
Every action is logged with the conversation that led to it. When the agent is unsure, it hands over to a person with the full context, and that handover is itself a measured outcome.
Start with one flow, measure resolution, satisfaction and cost per case, then expand. That is the whole playbook.