Boston Builds a Governed Front Door for AI Agents

Boston is asking a practical question that every digital government will eventually face: what happens when public systems are used not only by people with browsers, but also by AI agents that can read forms, follow links, repeat actions, and submit requests at software speed. According to Fast Company’s report, the city, under CIO Santi Garces, is exploring the Model Context Protocol as a governed entry point into civic data and services.

This is not another story about adding a chatbot to a city website. It is about building a machine-facing doorway for public infrastructure. If an agent wants to retrieve information, check a status, or eventually submit an official request, the city needs to know which channel it used, what it was allowed to ask for, and how that action was logged. Without that layer, agents will treat public websites as terrain to improvise across: scraping HTML, guessing what forms mean, and relying on patterns learned elsewhere.

Garces framed the risk plainly: agents often try to figure systems out by scraping pages and guessing from previous learning. That can be useful when one assistant helps a resident find a permit record or open-data file. The same behavior becomes a civic problem when thousands of automated visitors reserve scarce appointments, submit fraudulent requests, or load systems designed for human rhythm rather than machine traffic.

The Model Context Protocol, launched by Anthropic, is an attempt to turn that mess into a structured relationship between AI applications, tools, and data sources. The official MCP documentation describes a way for models to connect with external context and tools through more predictable interfaces. In city government, that could make data access, permissions, rate limits, and audit trails part of the design rather than a defensive patch after agents have already found brittle workarounds.

Editorially, this story belongs in AI, not space. Its real subject is public software infrastructure for autonomous assistants. Still, the systems logic is familiar from high-risk operations: when autonomous traffic approaches sensitive infrastructure, opening the door is not enough. You need access control, telemetry, rejection rules, and a clear record of who triggered which action.

The biggest unresolved issue is governance rather than protocol syntax. Boston can test a cleaner interface, but cities still have to decide which agents may act for residents, how user intent is confirmed, when a request is refused, and how public workers can see that an action was agent-mediated rather than performed directly by a person. That is why Boston’s experiment matters beyond one municipal portal. It treats agentic AI not as a novelty interface, but as a new class of traffic arriving at public systems.