--- title: "Company identity for AI agents, over MCP" summary: "A counterparty check before the agent acts, and a receipt for what it acted on." canonical_url: https://entitybind.com/use-cases/ai-agents last_updated: 2026-10-15 copy: full --- # Company identity for AI agents, over MCP > A counterparty check before the agent acts, and a receipt for what it acted on. Canonical page: https://entitybind.com/use-cases/ai-agents Last updated: 2026-10-15 ## AI agents A counterparty check before the agent acts, and a receipt for what it acted on. The week this usually starts: The first time an agent is about to pay, contract or onboard a counterparty it identified from a string. Point the agent at the same pipeline the HTTP API runs on, exposed as eleven Model Context Protocol tools over local stdio or a remote URL, with the same credentials, the same tenancy and the same credit rule. What comes back is a calibrated decision, an abstention the agent can act on, and a receipt. - Wrong merges observed · 317 GB companies, 2026-08-29: 0 - A record we decline to decide, at any stage: 0 credits - Input shapes covered: 4 - Limits stated on this page: 7 - The standing constraint: We write nothing back Merge Safety Sprint: The audit pack: twelve files, a receipt per decision, and a report that opens offline. [Start free →](https://app.entitybind.com/app?signup=1) Self-service. Create your workspace online and verify your email to start matching company records. Free starts with 300 credits and no card. Paid monthly plans are available in workspace Billing; VAT is added where applicable. Usage is tracked without automatic overage charges. [Trust and security](https://entitybind.com/trust) By [James Rooney](https://entitybind.com/about), founder of Entity Bind · Last revised 15 October 2026 ## Built for Teams building agentic procurement, payments, onboarding or research workflows, and platform engineers deciding what an agent is allowed to act on. ## Wrong for Buying breadth as the product: we hold a fraction of an incumbent’s records and are not building a global company graph. Entity Bind resolves companies and organisations only. It does not resolve people, vessels, bank-account ownership, sanctions exposure, emissions or geolocation, and its results may not be used for eligibility decisions about individuals, including employment, credit and tenancy. [The 7 things this will not do](https://entitybind.com/use-cases/ai-agents#limits) ## How it actually goes wrong What causes it, what it costs when nobody notices, and the part of it a resolver can reach. An agent that acts on a company has to decide which company it is acting on, and that decision is usually invisible. The model is given a name from an email, a supplier portal or a search result, it forms a belief, and the next tool call spends money against that belief. Nothing in the transcript distinguishes a counterparty the agent identified from a register from one it inferred from a plausible-looking website, because both arrive in the context window as the same kind of sentence. The tooling available makes this worse rather than better. A search endpoint that returns candidates hands the disambiguation back to the model, which will pick one, because that is what models do with a ranked list. A matching endpoint that returns a similarity score hands over a number the model cannot calibrate, so 0.72 and 0.91 are both read as "probably yes". And a tool that returns null on failure teaches the agent that failure means absence — so "we could not tell" becomes "there is no such company" one hop later. The blast radius is the part that makes this different from a human doing the same work badly. A person who is unsure asks somebody. An agent that is unsure and has a payment tool available proceeds, at machine speed, across every record in the queue, with a self-reported confidence that has never been measured against an outcome. If that reads like your week, create your Free workspace and upload a company CSV to see which rows match and which need review. Contact us separately if you want a guided first file. [Start free →](https://app.entitybind.com/app?signup=1) ## What we do about it Each of these runs today. Where one needs a column you might not have, or fails in a particular way, the sentence says so. ### 01 An abstention an agent can route on An `unresolved` result is not an error, a null or a non-match. It carries a ranked shortlist with calibrated per-candidate probabilities, a review id, a decision id, and four flags that mean different things: `depth_capped` (you stopped this — a deeper call may resolve it), `escalation_unavailable` (a dependency failed — a retry is worth trying), `more_input_needed` (the paid stages could not separate the shortlist — retrying deeper will not change it, send an identifier), and `no_identifying_signal` (the fields normalised to nothing — the only one the agent can fix by itself). ### 02 Spend the agent can audit Both billable tools return a usage block — credits charged, credits remaining, deep attempts remaining, plan, and whether billing is enforced. A tool call has no response headers, so that block is the only place an agent can learn what a call cost, which is what makes charge-on-success checkable rather than promised. An abstention costs zero, so an agent asking an unanswerable question is not a bill. ### 03 A credential that caps the blast radius Tenancy is derived per call from the credential and is never a request parameter, so a model cannot address another tenant by writing a different id. The credential also caps depth before the cascade runs, so a key pinned to the no-egress stage cannot reach agentic research by choosing this surface. Cross-tenant reads report not-found rather than forbidden, so ids cannot be probed. ### 04 Tools that cannot destroy or provision There is no erasure tool, no batch tool, no catalogue export and no provisioning tool on this surface, and an admin-scoped key is refused before a caller object even exists — so the credential that can mint credentials is structurally unreachable by a model. An erasure obligation is discharged by a person who can be asked why; it is not a step in an agent's plan. ### 05 Untrusted text treated as untrusted Where research runs, fetched page content is fenced as data with its own closing tag stripped, findings are constrained to an attribute allow-list from which registration identifiers are deliberately absent, and web observations rank below your own facts in the source precedence. A poisoned page cannot issue instructions or force a merge. It can supply plausible false content that nudges a genuinely borderline verdict into human review, and that residual risk is recorded as open rather than closed. ## Which of these is your export? One export usually sits in three of these at once. Your rate is set by the columns still standing once the names have been stripped back to a comparable form. ### 01 A name and a website, extracted from an email or a document The most common agent input shape and a strong one. The domain does most of the work, and where the domain and the name disagree, the disagreement is recorded rather than averaged. Measured: 100% (197/197), at zero model spend. Measured separately, at zero model spend, on 197 individually verified company-to-domain pairs. Those companies are large and well known, so this is the tier's behaviour on famous names rather than a register-wide sample. ### 02 A company name, GB, and a sentence naming the registered town Map it into `context` and it reaches the adjudicator as caller-supplied evidence rather than as an identifying field. Be aware of what that means for data handling: the context and the extra map reach the model provider verbatim. Measured: 99.37% (315/317), 95% CI [97.7, 99.8]. Historical 2026-08-29 recording with earlier identifier arrivals seeding the catalogue. This does not measure a business description, email footer or generic verification purpose alone. Two same-stem groups remained unresolved. ### 03 A name the agent has inferred and cannot corroborate Comes back as an abstention with a shortlist and `more_input_needed`, which is the instruction to ask a human or fetch an identifier rather than to retry with a bigger budget. This is the case the surface exists for. No published rate: This shape has not been measured on a published fixture, so the behaviour above carries no rate. ### 04 Two records the agent wants compared The pairwise tool answers is-this-the-same-company statelessly. It persists nothing, so it mints no receipt and there is nothing to fetch afterwards — if the agent's action needs an audit trail, resolve rather than match. No published rate: This shape has not been measured on a published fixture, so the behaviour above carries no rate. ### Where those figures come from - Name and website — A company name and its domain: 100% (197/197). Measured separately, at zero model spend, on 197 individually verified company-to-domain pairs. Those companies are large and well known, so this is the tier's behaviour on famous names rather than a register-wide sample. - Name, country and town prose — A company name, GB, and a sentence naming the registered town: 99.37% (315/317 · 95% CI [97.7, 99.8]). Historical 2026-08-29 recording with earlier identifier arrivals seeding the catalogue. This does not measure a business description, email footer or generic verification purpose alone. Two same-stem groups remained unresolved. Zero wrong bindings were observed across the historical six-shape recording and the separate domain fixture. Observed correctness was 1.0000 on accepted outcomes; this does not guarantee an error-free new workload. 317 live GB companies sampled from the 2026-08-01 Companies House snapshot, with same-name siblings included. Identifier-rich arrivals seed the catalogue before the weaker input shapes are evaluated. Historical results on an internal UK fixture with a preloaded catalogue. The September 5 replay has no full-prompt-verified calls and cannot establish current calibration. No independent customer holdout or global coverage claim. [The whole table, including the shapes this page does not use](https://entitybind.com/accuracy), with the safety results and an account of what none of it demonstrates. Internal fixtures only. The historical 2026-08-29 per-tier recording covers 317 GB companies with identifier-rich arrivals seeding the catalogue first; the context tier includes country and registered-town prose. Its legacy replay has no full-prompt-verified calls and cannot certify current calibration. The September 5 CI reports cover 1,176 labelled pairs and 705 records over 250 companies using offline stubs. These are not independent customer holdouts or live production validation; the 99% minimum-input product target remains unmet. Scope is company and organisation identity only — not people, vessels, bank-account ownership, sanctions or emissions. Results may not be used for eligibility decisions about individuals, including employment, credit and tenancy. Not sure which of these your export is? Create your Free workspace and inspect your own CSV columns. For an assisted composition preview, contact us with the file: we tier each row by its strongest surviving signal before quoting a Sprint. [Start free →](https://app.entitybind.com/app?signup=1) ## An agent about to pay an invoice One pass, in order, including the rows that do not resolve. The interesting rows are always the ones at the end. ### What arrives An invoice PDF has been parsed into a supplier name, an address line and a bank account. The agent has a payment tool and a spending limit. ### What the cascade does, stage by stage 01. The agent calls resolve_company with the name and the country, at the default depth. 02. Two candidates in the register share the name stem and cannot be separated on the evidence supplied, so the call returns `unresolved` with `more_input_needed`, a five-candidate shortlist, a review id and a decision id, at zero credits. 03. `more_input_needed` tells the agent that retrying at a greater depth will not change the answer, so it does not burn budget retrying. It asks for the supplier's registration number instead. 04. With the number supplied, the record resolves deterministically at one credit, and the agent reads the receipt with get_decision — free and unmetered — before it calls the payment tool. ### What comes back A resolved counterparty, a receipt naming the register page the decision rested on, and a payment that happened after an identity check rather than after a guess. ### How to read it Nothing here stops a badly built agent paying the wrong company; it is a tool, not a control plane. What it does is make the difference between a checked and an unchecked counterparty visible in the transcript, and make the unchecked path the one that returns no receipt. That example is ours. The one worth having is the same walk-through on eight rows of yours. [Start free →](https://app.entitybind.com/app?signup=1) ## What this will not do Each of these is a decision we intend to keep. Read them before you scope the work. - A pre-action policy check bound to a specific action with a short-lived receipt is a design-partnership build, not a shipped feature. What ships today is the decision, the calibrated confidence, the abstention and the receipt. - The stateless pairwise tool mints no receipt, no decision id and no audit row. If the agent's action needs to be defensible later, it needs a resolve. - OAuth works only for clients that can be told the authorization server, or for discovery-driven clients behind a shared origin. There is no RFC 9728 protected-resource metadata and no 401 challenge, so a connector that discovers OAuth from a challenge will report a broken server. Static bearer is the path to reach for first. - The tool catalogue is readable without a credential: initialisation and tool listing are unauthenticated, so anyone who can reach the port can read tool names and argument schemas. No customer data is reachable that way, but the port should not be public without a reason. - An OAuth install ticket authorises a tenant, not a person. The consent step carries no end-user identity — no user, session or upstream identity provider takes part in it — so anyone who obtains a ticket authorises as that tenant, and the audit trail records which admin credential minted it rather than who used it. - An empty search result is not a claim that the company does not exist. It means no known entity shares an identifier or a name key with the input, and an agent that reads it as non-existence will be wrong. - Rate limits are shared with the HTTP surface rather than doubled, and without a shared limiter store the published number is enforced once per process. ### We will not tell you how many dangerous merges we will find We do not promise a count of dangerous merges prevented, and you should distrust anyone who does before they have seen your file. Zero is a normal, honest result: two rows carrying contradicting company numbers are refused outright and never reach the guard that would have counted them. What this product does not have — no SOC 2, no external validation of the accuracy figures, no customer holdout — is published in full, with the retention, erasure and tenancy detail a security review asks for. [Read the trust page →](https://entitybind.com/trust) Check these scope limits before integrating. Free signup lets you inspect your own company CSV; if a requirement falls outside the published scope, contact us and we will tell you whether it is supported. [Start free →](https://app.entitybind.com/app?signup=1) ## The method behind this, at length 4 articles that carry the working this page summarises. - [Entity resolution for AI agents](https://entitybind.com/guides/entity-resolution-for-ai-agents) (Guide): An agent about to pay or contract a counterparty needs a decision with a receipt, not a similarity score. Why abstention is the safe default for an autonomous caller, and what the MCP surface exposes. - [Precision, recall and abstention](https://entitybind.com/guides/precision-recall-and-abstention) (Guide): Entity resolution is a three-way trade, not a two-way one. Why abstention is a design choice rather than a failure, what an abstention has to carry to be useful, and how to measure a system that declines. - [Calibration and confidence scores](https://entitybind.com/guides/calibration-and-confidence-scores) (Guide): What a calibrated confidence actually means, how expected calibration error is computed, why a similarity score is not a probability, and why an LLM's self-reported confidence is neither. - [Entity binding failures in AI agents](https://entitybind.com/guides/entity-binding-failures-in-ai-agents) (Guide): An entity binding failure is an agent calling the right tool on the wrong real-world entity. What a 2026 study of 1,800 runs found, and four safeguards. ## The same pipeline, in other people's words One product, described 6 other ways. If your team has a different vocabulary for the same file, start from the page that speaks it. - [Audit company overlap before a CRM migration](https://entitybind.com/use-cases/post-merger-company-data-audit): Review duplicate companies across both exports while every source ID is still intact. - [CRM and RevOps](https://entitybind.com/use-cases/crm-and-revops): Which accounts are one company, which merges to refuse, and a receipt for both. - [Master data management](https://entitybind.com/use-cases/master-data-management): An independent admission policy beside the platform you already run. - [Supplier master and accounts payable](https://entitybind.com/use-cases/supplier-master-and-ap): Duplicate vendors, remittance conflicts and concentration you cannot see. - [KYC and onboarding](https://entitybind.com/use-cases/kyc-and-onboarding): Counterparty identity with a receipt that survives seven years. - [Reference data](https://entitybind.com/use-cases/reference-data): Every identifier a company is known by, each separately cited — and the ones nobody holds. ## Start with your own company records. Create your workspace, verify your email and run your first company file. The Free plan needs no card. Create API keys in your workspace when you need an integration. [Start free](https://app.entitybind.com/app?signup=1) · [Plans and prices](https://entitybind.com/pricing) 300 credits. No card. For a guided review of your file, explore [the Merge Safety Sprint](https://entitybind.com/audit-pack). ## Questions about ai agents ### How do we install it? Two shapes. Locally over stdio, as one process on one machine with no listener and the tenant fixed at startup — correct only where the operator already holds the database credentials, and metered against a distinct key so a laptop evaluation never looks like customer traffic. Or remotely over streamable HTTP, where the `rk_` API key you create in your Entity Bind workspace authenticates unchanged as an `Authorization: Bearer` header. A remote deployment must name the hostname clients put in the Host header, or every call is refused before authentication — and a healthy probe is never evidence that tool calls are being admitted. ### Does an MCP call cost more than an API call? No. It is the same resolve, at the same price, against the same rate-limit bucket — the tools delegate to the same application services as the HTTP surface, so limits are shared rather than doubled. Two of the eleven tools are billable and nine are free and unmetered: reading an entity, reading a crosswalk, discovering enrichment fields, searching, redeeming a receipt, reading usage, and the three review-queue tools. On either surface, 0 credits is the price of an abstention, at any stage, including the ones that spent the most getting there. ### Can the agent see another customer's data? No, and the enforcement is structural rather than a filter. The tenant is derived from the credential on each call and is never a request parameter; the composition root holds no tenant field and no default; every repository method requires a tenant id as a keyword argument with no default; and every branch that does not end in a verified credential fails closed, because there is no least-privileged tenant to degrade to — any fallback would be somebody's data. Two tenants concurrently in flight through one process are proven separate by test. ### What stops a prompt injection in a fetched page changing the answer? Several things, and one residual we have not closed. Fetched content is fenced as data with its own closing tag stripped, findings are constrained to an allow-list that deliberately excludes registration identifiers, web observations rank below your own facts in precedence, and the adjudicator's output is constrained to a schema and abstains below a floor — the model can recommend, never commit. The residual: a poisoned page can supply plausible false content that pushes a genuinely borderline verdict into human review. That risk is open and dated rather than declared solved. ### Can an agent work the review queue? It can read it, and it can settle items only with a separately issued review credential. That separation is deliberate: a resolve credential may poll the queue and cannot settle anything, and the reviewer identity written onto a verdict is the immutable name assigned when the review credential was minted rather than a name supplied in the call. So an agent cannot assert whose judgement a merge represents. ### What should the agent do with a low confidence answer? There is no accepted match below the floor to handle — A match below 0.90 confidence is unrepresentable. The record comes back as an abstention with a ranked shortlist instead. The agent should branch on the decision first: a match to act on, an abstention to escalate or enrich, or a non-match. If your policy requires a stricter threshold, measure its coverage cost on labelled records. Confidence bounds depend on the recorded evidence population; there is no universal score for every match. Read match_confidence_basis and the evidence. A 0.99 filter can return some v8 adjudicated matches while excluding valid identifier matches, so validate its coverage cost on your own inputs. --- The 0.90 confidence floor. It is an acceptance contract, not calibration evidence: it says what we refuse to return, not how often an accepted match is right. Read it with the coverage it costs. The pricing rule, whole: - 1 credit(s): A decision reached by the deterministic or probabilistic stage. CPU only, no egress. - 5 credit(s): A decision that needed LLM adjudication or agentic research. - 0 credit(s): An abstention, at any stage, including the ones that spent the most getting there. - 0 credit(s): A byte-identical replay. Per tenant, per exact content, and with no expiry. - 0 credit(s): An input that normalised to no identifying signal. There was nothing to answer. This is the Markdown copy of https://entitybind.com/use-cases/ai-agents, assembled from the same data the page renders and carrying every sentence, table row, figure and question the page's main content carries. The HTML page is canonical; it adds the layout, the navigation and the interactive parts (the ask panel, the forms), which a copy can name but not run. Every page on the site, with a line on each: https://entitybind.com/llms.txt.