Short answer
A context layer gives AI agents one permissioned view of your business: CRM records, calls, emails, documents, pricing and buying signals, plus memory and access control. The Model Context Protocol (MCP) is the open standard for exposing those tools and data to AI agents and assistants. Together they turn general-purpose models into agents that act on real, current business context.
Why agents fail without context
A model can write a fluent email, but without your CRM history, last call notes and pricing rules it is guessing. In Salesforce’s 2026 State of Sales research, 51% of sales leaders said disconnected systems were slowing their AI initiatives. Context, not model quality, is usually what separates useful agents from noisy ones.
What goes into a context layer
| Layer | What it holds | Typical sources |
|---|---|---|
| Records | Accounts, contacts, opportunities, cases | Salesforce, HubSpot, Zoho CRM |
| Conversations | Call transcripts, emails, chats | Gong, Gmail, Outlook, chat tools |
| Knowledge | Docs, pricing, playbooks, policies | Google Drive, Notion, Confluence |
| Signals | Intent, web visits, product usage | Intent providers, analytics, product data |
| Memory | What agents did and decided before | Agent state store |
| Permissions | Who and what can see each item | Inherited from the source systems |
What MCP is
The Model Context Protocol (MCP) is an open standard, introduced by Anthropic in November 2024, that defines how AI applications connect to tools and data. An MCP server exposes capabilities such as "search accounts", "summarise last call" or "update next step" with authentication and scoped permissions. Any MCP-compatible assistant or agent can then use them. MCP has since been adopted widely across AI assistants and business software, which means one well-built server can serve many AI tools.
Design principles
- Enforce permissions at query time, using each source system’s access rules.
- Set freshness rules so agents never act on stale data.
- Cite sources in every answer so humans can verify.
- Use least-privilege tools: narrow, well-named actions, not raw database access.
- Evaluate and trace every agent run, and keep regression test sets.
- Defend against prompt injection from emails, web pages and other external content.