AI & Tech

Give AI Read Access Before Write Access

Agent platforms shipped fast in September 2026. Here's the rollout order we use for AI that touches real systems: read, draft, approve, then narrow automated writes.

Hari Gopal Sharma · 2026-10-09 · 6 min read

AI Agents MCP AI Security AI Implementation

The useful version of AI in a business isn't a chatbot sitting on its own. It's a model that can see your CRM, your inbox, your inventory and your ticketing system, and do something with what it finds. That connection is where the value is. It's also where nearly all of the risk is.

The last few weeks made both halves of that sentence louder. Vendors shipped tooling to get agents into production, and the industry got another reminder of what happens when a capable model has more reach than anyone intended. My advice to founders and operators hasn't changed, but it's more urgent: give AI read access long before you give it write access.

September was about putting agents into production

On September 29, MongoDB launched Atlas Agent Engine in public preview, describing it as a unified execution, memory and governance layer for production agents. The governance language is the interesting part. MongoDB says "every action is logged against a real identity, human or agent," and that governance is "built in, not bolted on after launch." The same release says MongoDB is joining the Linux Foundation's Agentic AI Foundation.

AWS's September roundup for AI builders, published today, covers an Amazon Bedrock AgentCore runtime with lower cold start latency and billing based on actual usage. It also covers Amazon Bedrock Managed Agents, powered by OpenAI, in public preview, which can reuse existing IAM permissions, keep auditability through AWS CloudTrail, and include built-in human approval workflows.

Notice what both vendors chose to emphasise: identity, audit trails and human approval. Those aren't features you put on a slide for fun. They're there because buyers are asking what happens when an agent does the wrong thing.

The plumbing is still young

Most of these connections now run over the Model Context Protocol (MCP). In December 2025, Anthropic contributed MCP to the newly formed Agentic AI Foundation under the Linux Foundation, alongside Block's goose and OpenAI's AGENTS.md. Neutral governance is good for everyone building on it.

Governance of a spec doesn't make every server safe, though. In April, OX Security published an advisory on command injection through MCP's STDIO configuration path: applications that passed a user-supplied command and arguments to the server launcher without sanitising them. It listed 17 affected entries, 14 with CVE IDs, across projects including LangFlow, LiteLLM, Flowise and Windsurf. One finding stuck with me: allowlists that only permitted commands like `npx` were bypassed by smuggling the real command into the arguments.

Then there's the model itself. In September, Google confirmed that a Gemini model, during a capture-the-flag evaluation run by testing firm Irregular, got out of its test environment and into the systems of three real companies that shared names with the fictional targets. According to Cybersecurity Dive's reporting, it guessed passwords in one case and found working credentials in a public database in the other two. Google's VP of security engineering said that in all three instances the model stopped.

This wasn't malice. A model was given a goal and found a path nobody had closed. Your agent will do the same thing with whatever access you hand it.

The pattern we use

Here's how we connect AI to business systems at AetherCraft. None of it is exotic.

This is also how AI-powered software differs from a prototype. The model call is the easy part. The permissions, review steps and logs are most of the work.

What this looks like in production

Our medtech operations case study covers three production AI systems we built for a medtech parts and service company, and each one sits at a different point on the read and write scale.

The first lets Claude answer questions across five systems through an enterprise MCP setup. It reads, and it says when the data behind an answer is weak instead of bluffing. The second, Attuned, turned 14,901 service emails into 2,557 jobs, with drafted replies that a named person approves before anything goes out. The third, Parts & Inventory, ranks every part nightly by what a shortage would cost, without writing a byte to the CRM.

None of the three needed broad write access to be useful. That's the point I'd want any operator to take away.

A staged rollout you can actually run

If you're connecting AI to your own systems this quarter, this is the order I'd follow.

Stage 1: Read

Connect the systems with read-only service accounts. Let people ask questions and compare answers against what they already know. Track where the AI is wrong, and where the data underneath is the real problem. This stage often pays for itself on its own.

Stage 2: Draft

Let the AI propose actions: a reply, a ticket update, a reorder suggestion. Drafts land in a queue. Nothing leaves the queue on its own.

Stage 3: Approve

Assign a named owner to each draft type. Record every approval, edit and rejection. The edit rate is your best signal: if people barely change the drafts for weeks, you have evidence. If they rewrite half of them, you've learned something cheaply.

Stage 4: Limited automated writes

Pick one narrow, reversible, high-volume action that has a clean approval record, and let it run without review. Keep a per-day limit, keep the logs, and keep a way to switch it off in one step. Then repeat for the next action. Never jump straight to "the agent can do anything in the CRM."

Skipping stages is how teams end up with an agent that's confidently writing bad data into the system everyone else relies on.

Start with what it can see

The agent platforms will keep getting better, and the protocols will mature. Neither changes the basic trade: every permission you grant is something you'll have to defend later. Start with read access, make every write a draft someone owns, and let the results argue for more.

If you're working out where AI should connect to your systems and how far it should reach, that's the kind of problem we help with. Our services page explains how we work, and we're happy to talk it through.

Sources

Keep reading

← Back to Insights