An MCP write can execute immediately, return a single-use proposal for human confirmation, or remain completely unavailable to automation. The boundary follows the effect of the specific capability, not a global “write mode.”
Runs
Changes work that is not yet governing.
- Create or edit a Standard draft
- Patch a Standard clause
- Upload a file
- Permission checked at call time
Waits
Changes live or governing state.
- Publish or unpublish a Standard
- Publish a Metric
- Create or change Knowledge, or change an Area
- Side-effecting Connector tool
- Permission checked again at confirmation
Proposed is not failed
A proposed result contains an id, platform-written summary, and expiry. It has validated the arguments but has not executed the action.
Confirmation is explicit
AI proposes. The human decides. Clients with form elicitation can ask in their own interface. Other clients show the summary and call proposals.confirm only after the person approves. The model must never approve on the person’s behalf.
Proposals are bounded
They expire after fifteen minutes, belong to the requester, are single-use, and consume even when downstream execution fails. A proposal raised through API or MCP is audited when it is made and again when it executes.
Some work is never automated
Hard deletes, access and employee changes, credentials, settings, and Connector configuration remain human-only in the web app. There is no proposal path to build around.