Connecting an AI agent to a content system looks simple until it isn’t: a loose schema causes hallucinated field values, no draft/published boundary lets an agent push unreviewed edits live, and no versioning turns one bad write into a permanent one.

This talk is a case study of what actually broke, in order, when we gave an MCP-connecated agent write access to a real content system, and the fixes that held up: typed, composable schemas instead of freeform blocks; scoping agent write access the same way you’d scope any automated actor; and building rollback in before an incident forces the issue.

No idealized architecture diagram – the failures, the near-misses, and what we’d do differently. Attendees leave with a concrete pattern for making an MCP server’s underlying data layer as production-ready as the protocol layer itself, applicable to any system exposing structured data to agents, not just content specifically.