Cowally MCP
Give people and AI agents safe access to your operation.
MCP (Model Context Protocol) is the open standard that lets AI assistants and agents work with software. With Cowally's MCP, you decide exactly who can reach what: your teams, partners, your clients' own staff, or the AI agents working for them. You choose which data and which records each one sees, which fields stay hidden, which actions they can take and what needs a person's approval, across your Cowally data and the systems you choose to connect. Everything is logged.
You set the rules. MCP follows them, every time.
Every user and every agent gets a set of rules. Six settings decide what they can see and do:
People (your teams, partners, your clients' staff) and AI agents, one by one or by group.
Which sources they can reach: Cowally's products and tools, and any of your own systems you've connected.
Only one branch, only a partner's own customers, only loans in collections, only this year's applications.
Shown or hidden for each role. Marketing can study customer behaviour while names, ID numbers and phone numbers stay hidden.
Read only, or also create, update, request a document correction or record a payment promise, each with its own limits.
Actions above a limit, or of a certain type, go to an approver before anything changes.
DataApplications, Loans
RecordsBranch = North
Hiddennone
Actionsread, request a correction
Approvalnot needed
DataCustomers, Loans, Savings
Recordsall
HiddennameID numberphone · shownphone
Actionsread
Approvalnot needed
Toggle a field and the preview updates before anything goes live.
One governed layer over Cowally and your own systems
MCP isn't limited to Cowally's data. Connect your own systems, such as your CRM, your data warehouse or your ERP, choose exactly which tables and fields to share, and the same roles and rules apply to them. Your people and agents ask in one place, and get only what they're allowed to see.
Sources
People and agents
How access works
Who you can give access to
A branch manager
“How many applications are waiting in my branch?”
Sees only her branch.
A partner business
“How many of my customers' loans were approved this week?”
Sees only its own customers.
A collections agent
“Who's on my list today?”
Can record a payment promise; can't change a loan's terms.
Your risk team's AI agent
Prepares a weekly loan book summary every Monday.
Read only.
Your marketing team
“Which customers opened a savings account this month after taking a loan?”
Sees customer profiles and behaviour; names and ID numbers stay hidden.
Your AI agents, working inside your rules
Summarize today's applications waiting for review.
Approve the two consumer loans.
Logged for audit · Agent acting for M. Gómez
The agent can do what its user is allowed to do, nothing more, and every action is recorded.
How your data stays safe
Access by role and by record: each user or agent reaches only the data and records its role allows.
Sensitive fields hidden: fields you mark as hidden are never shown to that role.
Approvals: sensitive actions still go to a person before anything changes.
No back door: MCP applies the same permissions as the back office; it never goes around them.
A full audit trail: who, or which agent, asked or did what, and when.
Revocable at any time: remove a user's or an agent's access in one click.
Private connectivity: connections to your systems run over private links, with fixed IP addresses for your access lists.
Your data, your country: data can stay in your country when your regulation requires it.
Questions about MCP
It works with any AI assistant or agent that supports MCP.
All the data you have in Cowally, plus any data from your own systems that you choose to map and share with your users.
Yes, for example to one branch, a partner's own customers, or loans in collections.
Yes. For each role, you choose which fields stay hidden. For example, your marketing team can work with customer profiles while names and ID numbers stay hidden.
Yes, each with their own role and rules, seeing only what concerns them.
Only if its user's role allows it and your approval rules are met; otherwise it sends the request to a person.
Yes, at any time, for any user or agent.
A first setup can take about a week.
Decide who can reach what
In a technical session, we'll connect one of your systems, set up roles and rules for a few of your users, and show an AI agent working inside them.