A water utility exposes SCADA telemetry through an MCP server that must reject write commands from any agent. How should the team enforce this boundary?
Select an answer to reveal the explanation.
Short Explanation
Telling an agent 'please don't do that' is like leaving a note on an unlocked door — well-meaning, but it's not a lock. Scoping Agent Identity permissions on the MCP server's exposed capabilities makes the read-only boundary something the platform enforces, not something the agent has to remember.
Full Explanation
Enforcing least privilege at the identity layer means the write operation simply isn't reachable, regardless of what the agent decides to attempt — the permission boundary sits below the model's reasoning, not inside it. System-instruction wording is a prompt, and prompts can be misread, overridden by adversarial input, or simply forgotten across a long session; it's guidance, not a control. Trusting the agent's own judgment to refuse write-shaped requests has the same weakness: a model's behavior is probabilistic, so a boundary that depends on it holding every time isn't really a boundary. Credential rotation is a good general hygiene practice, but it doesn't change what actions a valid credential is authorized to perform — a rotated-but-still-write-capable credential still lets writes through. Scope note: this pattern generalizes to any sensitive integration — treat the model's output as untrusted input and enforce authorization outside the model. Operational check: attempt a write call using the read-only agent's identity in a test environment and confirm the platform rejects it before the request ever reaches the SCADA system.