Banking and insurance: read-only is the feature

The instinct in a regulated business is to refuse the category outright. It is the wrong call, and the reason is that the valuable half and the risky half separate cleanly.

Nobody is asking you to let an agent bind a policy. They are asking whether a customer can find out what their policy covers without navigating a portal at eleven at night.

A surface that passes review

find_my_policy()                      readOnlyHint: true
explain_coverage(policyId, scenario)  readOnlyHint: true
get_claim_status(claimId)             readOnlyHint: true
list_required_documents(claimType)    readOnlyHint: true
locate_form(topic)                    readOnlyHint: true
get_next_payment()                    readOnlyHint: true

prefill_claim_draft(...)              // prepares only; the human submits

Six read tools and one that prepares without submitting. Every one of them replaces a phone call or an abandoned portal session, and none of them changes state.

The argument for the compliance meeting

1. No new credential exists. Tools run in the visitor's own authenticated browser session. Nothing is minted, nothing is stored in a model's context, and revocation is logging out. This is materially better than issuing an API key so an assistant can read customer data.
2. Read-only is declared and enforced. readOnlyHint: true tells the agent. Your server-side authorisation enforces it. The annotation is advisory — the authorisation is not, and that distinction belongs in the submission.
3. Nothing is enumerable. Tools scope to the session. There is no tool that accepts an arbitrary policy number.
4. Anything consequential stops for a human, in your own UI, with your own confirmation copy.
5. Scope is bounded by policy. The tools permissions-policy feature defaults to an allowlist of ['self']; a cross-origin iframe needs an explicit allow="tools".

Do the boring pillars first

Banks and insurers usually fail agent readiness long before WebMCP is relevant, and for prosaic reasons: portals rendered entirely client-side, consent walls in front of public product pages, PDFs where a page should be, and forms with no labels.

Those are worth more than tools and they carry no regulatory weight. A public product page that renders server-side with valid Service markup is a week of work and improves every channel you have.

The knowledge layer, further out

For institutions, the machine-readable knowledge layer eventually matters as much as the action layer. An agent answering a coverage question needs facts that are current, sourced and approved — not a paragraph scraped from a marketing page.

The direction of travel is visible in emerging enterprise formats that wrap documents with provenance and freshness metadata — who generated this, from which sources, verified by whom, stale after when — and index them under existing access controls. That is a 2027 project for most institutions, and worth knowing exists while you are scoping the 2026 one.