Give an agent read-only access

The goal is one agent that can read a chosen resource without gaining write or export access. Use illustrative tool names that correspond to your registered server; there is no universal read tool name across MCP servers.

Assemble the access boundary

1. Register the server and review its actual tool schemas.
2. Register the agent with a verified identity relationship.
3. Create a credential binding restricted to that agent and target. Prefer an upstream account whose own permissions also exclude writes.
4. Author a policy permitting only the required read action and resource. Validate deny cases before publication.
5. Confirm runtime acceptance, then connect the agent’s actual MCP client.

Set filtering / decision traceAM / 06

Discovery is a policy decision

Scroll the diagram sideways to see the full flow →

↻ Replay

01020304

4 / 4

Discovery returns only the permitted read tool. Calls are evaluated again when invoked.

Read the full explanation

1. The registry has three example tools. Registration alone does not grant access.
2. Policy evaluates the authenticated principal, tool, action, and request context.
3. An explicit deny overrides an allow. A tool without an applicable allow is denied too.
4. Discovery returns only the permitted read tool. Calls are evaluated again when invoked.

Prove the result

Test	Expected result
Discover tools as the agent	Only permitted tools are visible.
Call the allowed read tool	A valid result and traceable audit decision.
Explicitly call a write tool	Denied before upstream execution.
Call with an unrelated agent	No reuse of this agent’s credential authority.

Use the actual tool names and input schemas for these tests. Record decision metadata, not upstream secrets or customer records.

If it fails

Compare identity claims, policy version, binding subject and target, and active projection. Do not broaden the allow just to make the first test pass. Read agent-scoped credentials for the credential boundary.