Outcome
By the end of this lesson, you will be able to run the decision to leave write tier none as a deliberate org choice, name the gates that decision should clear, and describe exactly what changes in your threat model when it does.
| Tier | Engineer |
| JTBD | ”Decide whether to enable MCP writes for my org, and be able to defend the answer either way.” |
| Personas | Platform Engineer · Security/Compliance · CISO · Engineering Manager |
| Prerequisites | M6.5.L1 (the tiered write surface) · M6.5.L2 (choosing the right surface) |
| Time | 9 minutes |
| Bloom verb | Run (Apply), Name (Remember), Describe (Understand) |
1. Concept
Every org arrives at this question eventually, usually about six weeks after the first person wires up an agent and gets tired of copying resource ids into the UI. The question is not “is it safe.” The question is “can we name the write we want, and is MCP the right surface for it.”
Most orgs that work through this honestly stay at none, and that is a good outcome rather than a failure to adopt.
Start from the write, not the tier
THE WRONG QUESTION "Should we turn on MCP writes?" -> unanswerable. It is a capability class, not a workflow.
THE RIGHT QUESTION "Which specific write does someone do 10+ times a week, through the UI, where the agent already did all the reasoning that led to it?" -> answerable, and it either produces a name or it does not.
IF IT DOES NOT PRODUCE A NAME: stay at none. You are beingasked for a capability, not for a solution to a problem.The workflow that most often produces a real name is override management during an incident: the agent has already found the resource, confirmed the schedule that is about to stop it, and drafted the reason. The remaining click is mechanical. That is a tier 2 (reversible) case with a genuine argument behind it.
The request that most often turns out to be the wrong one is “let the agent apply recommendations”. That job already has a home. Auto-remediation does it, with its own approval gate, its own allowlist, its own safety gate and its own audit trail (M2.3). Routing it through an agent instead swaps a purpose-built control for a general-purpose one.
The gates
Before a tier change, these should all be answered, and answered by name rather than by role:
1. NAMED WRITE The specific tool or tools, and the workflow they serve. "Reversible writes" is not an answer.
2. LOWEST TIER THAT WORKS Does the named write need tier 2, or does tier 1 cover it? Never move two tiers because one was awkward to justify.
3. WHO IS IN SCOPE The tier is org-wide, but the effect is per-caller: tier ∩ role ∩ token. List the roles that would actually gain something, and confirm you meant to give it to all of them.
4. OWNER One person accountable for the setting, by name.
5. REVIEW DATE When you will re-ask whether it is still earning its place.
6. ROLLBACK TRIGGER The specific observation that would make you set it back. Write it down before you need it.
7. AUDIT BASELINE What normal looks like in the MCP audit trail today, so an anomaly after the change is visible against something.
8. THE UI ALTERNATIVE Confirm the write is genuinely faster through an agent, not just newer. If the UI path is two clicks, the agent is not the constraint.Gate 3 is the one teams skip and regret. The tier is a property of the organisation, not of the person who asked for it.
What changes in your threat model
Be precise here, because the honest answer is smaller than people fear and larger than advocates admit.
WHAT DOES NOT CHANGE The never-exposed list. RBAC, user management, org and cloud-account deletion, credentials and bulk actions stay unreachable at every tier. Nobody gains a capability they lacked in the UI. Enforcement stays in one place, at the gateway. Reads stay audited.
WHAT DOES CHANGE Prompt injection acquires an executable path. Before the change, a malicious tag was inert. After it, the ceiling on that attack is the caller's RBAC role rather than the absence of a tool. A hallucinated parameter becomes a real action on the wrong resource. Single-target tools bound this to one resource, which is exactly why no bulk tool exists. Your audit trail becomes load-bearing rather than informational.The second item is the underrated one. Agents do not usually fail by doing something forbidden; they fail by doing the right thing to the wrong id.
If you do raise it
ROLLOUT SHAPE THAT WORKS Week 0 Tier 1 (metadata-only), one team, named owner. Nothing that alters what runs. Week 2 Read the audit trail. Any surprises? Any call nobody can account for? Week 4 If and only if the named write needs it: tier 2. Same team, same owner. Week 8 Review. Did the workflow actually get faster, or did people go back to the UI anyway?
Tier 3 is not part of a normal rollout. It requires anorg-bound token, and the destructive operations it reacheshave better homes: the UI for one-offs, IaC for anythingrepeatable.2. Demo
Two orgs, same question, different answers, both correct:
ORG A: 40 engineers, heavy incident load Named write: set a force-on override during an incident Frequency: ~12/week, always during a page UI path: find resource, open drawer, set expiry, save (~90 seconds while the incident is live) Agent path: the agent already has the resource and the schedule in context; the override is one call Lowest tier: 2 (an override is reversible and expires) In scope: Editors only. Viewers gain nothing. Owner: platform lead Rollback: any override set on a resource the requester could not name when asked DECISION: move to tier 2 for the platform org.
ORG B: 12 engineers, steady state, no on-call rotation Named write: "apply recommendations" Frequency: ~4/week BETTER HOME: auto-remediation. It has an allowlist, an approval gate, a safety gate that fails closed, and per-step audit. All four are things a general-purpose agent surface does not have. DECISION: stay at none. Enable auto-remediation for two low-risk rules instead.Org B’s decision is the more common one, and the more useful example. The request was real; the surface was wrong.
3. Hands-on (6 min)
Run the decision for your own org, whether or not you intend to change anything:
1. Name the write. If you cannot, stop here; the answer is "stay at none" and you are done. Write: ________________________________________
2. Frequency per week: _______3. Current UI path, in seconds: _______4. Lowest tier that covers it: _______5. Roles that would gain something (not "everyone"): ______________________________________________6. Owner, by name: _______________7. Review date: _______________8. Rollback trigger, written as an observation: ______________________________________________9. Is there a purpose-built surface for this? (auto-remediation? a schedule? IaC?) Y / N If Y, use it instead.
An honest run of this usually ends at step 1 or step 9.4. Knowledge check
Q1
A team asks to enable MCP writes so their agent can apply cost recommendations. The best response:
A. Enable tier 2, since applying a recommendation is reversible
B. Enable tier 3, since some remediations are destructive
C. Route it to auto-remediation instead
D. Refuse without explanation
Show answer
Correct: C. That surface already has an allowlist, an approval gate, a safety gate that fails closed on missing evidence, and per-step audit. An agent surface has none of those four, so moving the workflow to MCP would trade a purpose-built control for a general-purpose one. The request is legitimate; the surface is wrong. This is the most common tier request and it almost always has a better home. Note that auto-remediation’s safety gate is resource-aware while its allowlist is only rule-aware, which is a distinction no agent surface reproduces.
Q2
An org moves from tier none to tier 2. Which statement about its threat model is accurate?
A. Nothing changes, because RBAC still applies
B. Prompt injection acquires an executable path
C. The agent can now escalate its own permissions
D. Bulk deletion becomes possible
Show answer
Correct: B. Before the change an injected instruction was inert because no tool was advertised or permitted; after it, the ceiling on that attack becomes the caller’s RBAC role. The never-exposed list is unaffected, and nobody gains a capability they lacked in the UI. C and D are both on the never-exposed list and no tier reaches them. A is the comfortable answer and it is wrong: RBAC bounds the damage, it does not prevent the class. Being able to state the change precisely, in both directions, is what makes the decision defensible.
Q3
Which of these is the strongest reason to stay at tier none?
A. Writes are inherently unsafe, and no configuration or approval process makes an agent-driven mutation acceptable in production
B. The org worked through the decision and could not name a specific write, done frequently, where an agent is genuinely the faster surface
C. The security team has not approved it, and the review has been open for two quarters with no decision expected any time soon
D. Nobody has asked for it yet, so the capability sits unused rather than being a decision the organisation has actually made
Show answer
Correct: B. Being asked for a capability rather than a solution to a problem is a complete answer. A overstates the case and will not survive a conversation with someone who has read the tier model. C and D are both “not yet”, which invites the question again next quarter with no better information. B is a finished argument, and it is the outcome of an honest run of the decision more often than not.
5. Apply
Run the eight gates for your own org and put the output somewhere durable, even if the answer is “stay at none.” A written decision with an owner and a review date is what stops this being re-litigated every quarter by whoever most recently discovered the setting.
Check the current value at Settings → Organization → Access → MCP, and baseline your MCP audit trail at Settings → Audit Log filtered to source = mcp before you change anything.
Related lessons
- L1: The tiered write surface
- L2: Choosing the right write surface
- M6.3.L2: The org-level MCP toggle
- T2.M2.3.L3: The approval gate
Glossary terms touched
Write tier · Org-bound token · Prompt injection · Rollback trigger · Auto-remediation
Complete M6.5 → 10-question quiz. Track 6 complete.