{"id":"AGT-001","section":"Agent & MCP Governance","requirement":"Govern tool calls at read, write and delete scope","acceptance":"Permit a read while refusing write, delete or other destructive actions, with every attempt logged and attributable.","tier":"AT1, AT3, AT4, AT6","whyItMatters":"One agent can read, write and delete in the same workflow. Allow or deny per app is too blunt.","verificationMethod":"LT","verificationTest":"Reads to a connected system are allowed while attempts to change or delete information are blocked.","formerly":null,"alsoIn":["guardrails"],"sort":36,"adoptionContext":"Citizen-built, code-executing and MCP-extended workflows can take consequential tool actions, making operation-level permissions relevant.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Allowing reads while refusing writes, deletes and destructive operations enforces least privilege at the tool-call boundary. Enforce restrictions before the operation and record every attempt with usable attribution, retention, protection and analysis. Warnings or a live view alone are insufficient; runtime refusal does not review or revoke the underlying connector grant.","kind":"framework","references":{"csf":["PR.AA-05"],"soc2":["CC6.3"],"iso27001":["A.8.3","A.8.15"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"A defined, enforced boundary between permitted reads and prohibited destructive actions implements a concrete responsible-use procedure for agents. It contributes to the wider AI-use process without implying that the standard prescribes these exact API scopes.","kind":"framework","references":{"iso":["A.9.2"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Operation-level refusal limits destructive tool misuse and actions attempted through excessive or misapplied delegated identity. Attributable attempts help investigate those failures; the control covers the operations and tool paths where it is enforced.","kind":"framework","references":{"owasp":["ASI02","ASI03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-001","frameworkRefs":{"ISO27001":["A.8.3","A.8.15"],"ISO42001":["A.9.2"],"NIST-CSF":["PR.AA-05"],"SOC2":["CC6.3"],"OWASP-ASI":["ASI02","ASI03"]}}