A city's 311 resident-service assistant uses two tools: search_service_requests, which only queries the request database, and close_service_request, which marks a resident's case closed. The team wants lookups to run without interrupting the agent while case closures always pause for a human dispatcher. How should the tools be designed to support that policy?
Select an answer to reveal the explanation.
Short Explanation
Let the assistant look things up freely but never quietly close somebody's pothole complaint. Label each tool by its effect on the world and the client can gate the writes automatically.
Full Explanation
An asymmetric approval policy needs a machine-readable property to key on, and the property that matters is a tool's effect: does it observe the world or change it. Without that distinction expressed in the tool definitions themselves, the client has nothing to branch on and must treat a database lookup and a case closure exactly alike.
MCP defines tool annotations for this purpose, including readOnlyHint for tools that make no modifications and destructiveHint for changes that are not easily undone. Marking search_service_requests read-only and leaving close_service_request unmarked lets the client auto-run lookups while pausing for a dispatcher before a closure, keeping the assistant fast on the high-volume path and human-gated on the irreversible one.
Identical definitions plus a nightly log gives only after-the-fact detection, since the resident's case is already closed by the time anyone reads it; a sentence in the description is guidance the model may or may not follow and the client does not enforce, so it cannot guarantee a pause; and a longer timeout creates no approval step at all, because the call still executes and nothing prompts the dispatcher to intervene.
Exam caveat: annotations are hints supplied by the server, so a client should trust them only from servers it trusts, and the 311 backend must still enforce its own authorization rather than relying on a label. Operational check: have the assistant attempt a closure and confirm the client blocks pending dispatcher approval, then confirm a request search runs without interruption.