# AGT-001: Govern tool calls at read, write and delete scope


- Area: Agent & MCP Governance

- Verification: Live test
- OWASP adoption tier: AT1, AT3, AT4, AT6

- URL: /r/AGT-001

**Acceptance criteria:** Permit a read while refusing write, delete or other destructive actions, with every attempt logged and attributable.

**Why it matters:** One agent can read, write and delete in the same workflow. Allow or deny per app is too blunt.

**How to verify:** Reads to a connected system are allowed while attempts to change or delete information are blocked.

**OWASP adoption context:** Citizen-built, code-executing and MCP-extended workflows can take consequential tool actions, making operation-level permissions relevant.

**Mappings:**
- NIST CSF 2.0: PR.AA-05; SOC 2: CC6.3; ISO 27001: A.8.3, A.8.15 — Allowing reads while refusing writes, deletes and destructive operations enforces least privilege at the tool-call boundary. Enforce restrictions before the operation and record every attempt with usable attribution, retention, protection and analysis. Warnings or a live view alone are insufficient; runtime refusal does not review or revoke the underlying connector grant.
- ISO 42001: A.9.2 — A defined, enforced boundary between permitted reads and prohibited destructive actions implements a concrete responsible-use procedure for agents. It contributes to the wider AI-use process without implying that the standard prescribes these exact API scopes.
- OWASP ASI: ASI02, ASI03 — Operation-level refusal limits destructive tool misuse and actions attempted through excessive or misapplied delegated identity. Attributable attempts help investigate those failures; the control covers the operations and tool paths where it is enforced.