Giving an agent write access can make a workflow look complete. It can also turn a useful assistant into an unreviewed operator with access to production.
Read-only access is often introduced as a cautious starting point. For some jobs, it should remain the permanent design. If the workflow is still being scoped, begin with the broader AI-agent permission framework.
When the action is difficult to reverse
Deletion, public publication, permission changes and financial transactions can create consequences that outlive the original task. Let the agent prepare the action and evidence, then require a person to approve it.
When the source data is ambiguous
If two systems disagree about a customer, invoice or deployment, an agent may choose the wrong source of truth confidently. Reading and comparing is useful. Writing the conclusion back before the conflict is resolved is not.
When the account controls other accounts
Domain registrars, identity providers, organisation owners and primary billing accounts sit high in the control chain. Compromise or error at that layer can spread across the business. Keep agent access narrow or absent.
When the workflow is new
Run a new automation in observation mode first. Compare its recommendations with what an experienced operator would do. Record failure patterns before enabling execution.
When nobody watches the result
Automation without monitoring is deferred discovery. If there is no reliable log, alert destination or person responsible for exceptions, the agent should not be making production changes.
A human approval step does not defeat the purpose of an agent. It places judgment at the point where judgment is expensive to automate badly. That approval step only works when the surrounding agent platform treats permissions as infrastructure, not as wording hidden inside a connection screen.