For two years the ceiling on AI in design practice has been the same. The model can reason about a structural problem perfectly well, and then it has to hand a paragraph of instructions to a person who opens the software and does the work. All the intelligence sits on one side of a gap that nothing crosses.
Model Context Protocol closes that gap by giving models a standard way to call tools. In a design context that means an agent can open the model, query it, make a change, and read the result, without a person in the loop for each step.
What is actually operable
Not everything, and the split matters for anyone scoping a deployment. The tasks that automate cleanly are the ones with deterministic success criteria. The tasks that do not are the ones requiring design judgement, which is the correct division.
The governance problem arrives immediately
An agent that can modify a live federated model is a different risk category to an agent that writes a summary. The first serious deployment question is not what the agent can do. It is what happens when it does something wrong at three in the morning.
- Every action writes to an audit trail that names the agent, the trigger, the tool called and the state before and after. Without this, nothing else on this list is enforceable.
- Agents operate on a branch, never the shared model. Changes merge through the same review the practice already uses for human work.
- Action scope is declared and bounded. An agent authorised to audit is not authorised to modify, and the boundary is enforced by the tool layer rather than by the prompt.
- Every autonomous run is reproducible. Same model state and same instruction produces the same result, or the run is treated as failed.
A practice that cannot reconstruct why a model changed has not automated its workflow. It has lost control of it.
Where the throughput comes from
The gain is not that any single task gets faster. It is that the option space a team can afford to explore gets wider, because the marginal cost of testing an alternative falls close to zero.
Review does not compress much, and again that is the point. Reviewing agent output is real work, it requires a qualified person, and any vendor claiming otherwise is selling something that will produce a defect nobody caught.
A realistic first project
Model auditing. It sits at the top of the operable list, it has an unambiguous right answer, failure is harmless, and it produces immediate visible value because every practice has a model standards problem it has given up on policing.
It also builds the audit trail infrastructure that everything more ambitious depends on. Practices that start with generative massing and try to add governance afterwards generally end up rebuilding from the beginning.