Read-only MCP was easy. Here's what changed once our agents could write back

For months our agents only read through MCP: search, fetch, summarize. Nothing broke that a retry couldn't fix. The day we let them write (update tickets, edit rows, send things) the rules had to change. What we ended up with: Separate read and write scopes per tool. Never one token for both. If the agent only needs to read the CRM, it can't touch it. Every write shows a dry-run diff first. A human sees exactly what will change before approving, at least until that action has a clean track record. Cap the blast radius. Max rows or files per call, and it fails closed above the cap instead of "probably fine". Log who approved what, with the exact payload. "The agent did it" isn't an answer when something goes wrong. No undo path, no unattended write. If we can't reverse it in one step, a human stays in the loop. The surprise was that most of our incidents weren't the model being dumb. They were scopes that were too wide and writes nobody could see. What's the first write action you let your agent do unattended, and what made you trust it?