When you connected that AI assistant to your CRM, you clicked one button. It never asked which actions you were comfortable with. It asked whether you wanted the integration, and it took read and write in the same grant. Reading your data is a different kind of risk from changing it, but many AI integrations still make that distinction easy to overlook.
On August 5, 2026, Cloudflare put a private beta called WriteGuard in front of AI tool access. The product matters less than the sorting it published. Cloudflare (2026) puts every action an AI tool can take into one of four tiers.
Read only. Search issues, read a merge request, view pipeline status.
Minimal impact. Add a reaction, mark a notification as read, subscribe to an issue.
Contained write. Add a comment, create a merge request, update an issue field.
Critical. Merge a merge request, trigger a production deployment, bulk-delete records.
Those examples are developer tools because Cloudflare started its beta on GitLab. Translate them into the systems you run and the tiers hold. Read only is pulling an open invoice or a customer’s service history. Minimal impact is tagging a record. Contained write is drafting a quote, adding a note to a job file, updating a field on a lead. Critical is sending that quote to the customer, posting a journal entry, changing a price list, emailing your install base, or closing a work order as complete.
The reversibility test
Contained write and critical look identical on a permissions screen. Both change data. What separates them is whether you can put it back.
Two questions do the work. If this fires wrongly at two in the morning, can one person undo it before it reaches a customer, a regulator, or a bank? And does undoing it need someone outside your company to cooperate? If that second answer is yes, treat it as critical until you have a good reason not to.
Here is the shape of it. A manufacturer running three plants gives an assistant write access to the ERP. “Update a field on a production order” reads as contained write all day long. Then you find out one of those fields is the ship date, and changing it fires a customer notification. Reversible inside the ERP. Not reversible inside the customer’s inbox.
A log records after. A policy check decides before.
Audit logs are useful, and they solve a different problem. A log tells you what happened. It does not decide whether it should have happened.
The people who maintain the Model Context Protocol are direct about this. Writing on tool annotations, the maintainers (2026) say hints like readOnlyHint are advisory and nothing more: “An untrusted server can lie. A server can claim readOnlyHint: true and delete your files anyway.”
So a vendor’s own label is not a control. The tier has to be your judgment, and the check has to sit somewhere the tool cannot talk its way past. That is the same design point AWS made by putting an agent’s spending cap at the infrastructure layer instead of in its instructions, which we wrote about last week.
What to gate first
In the first week of September 2026, the OWASP GenAI Security Project released its 2026 Top 10 for LLM Applications with Excessive Agency at number three, plus a new Agent Control Standard aimed at runtime enforcement. Their framing matches: “the work is to contain what a fooled agent can reach before it acts.” You don’t need to wait for a new security product to use the principle. You can run the sort yourself this week.
- List every AI tool holding a credential to a business system, including the ones a department signed up for on a company card.
- Pull the scope actually granted to each. It sits under connected apps or API tokens in your admin panel, and it is usually broader than the sales conversation suggested.
- Sort each action into the four tiers.
- Run the reversibility test on everything you filed as contained write, and move what fails into critical.
- Anything in critical with no approval in front of it goes on your Q4 list.
If the critical column comes back longer than you expected, the sort is doing its job. The sorting exercise costs an hour and stays useful regardless of which tools or vendors you use.
When we build an approval step, we build it against that company’s actual workflow, in their systems, on their data, because “requires approval” means something different for a ship date than for a journal entry. The tier list tells you where it goes.
P.S. Run step three. If your critical column comes back longer than you expected, the tools got adopted faster than the approval paths did. Bring the list to an AI Workforce Review. In 45 minutes we will look at the work behind those actions, where approval belongs, and which AI role is worth defining first. Nothing to prepare. If the column is empty, you do not need us this quarter.
Sources: Cloudflare, WriteGuard private beta (Aug 5, 2026) · Model Context Protocol, Tool Annotations as Risk Vocabulary (Mar 16, 2026) · OWASP GenAI Security Project, 2026 Top 10 for LLM Applications and Agent Control Standard (Sep 2026)