You already have an agent policy. Nobody wrote it.

Last month one of our own automated steps graded a company Strong without ever having looked at it.

It had looked at something. The row carried the wrong domain, so enrichment had attached a multinational’s funding history to a small simulation company, and the grader did what it was built to do with the numbers in front of it. A well-formed, completely wrong verdict, written straight onto the record.

Nothing came of it. We found the cell, cleared it, and the afternoon carried on.

What made that step safe to hand write access was the cleanup, not the grading.

Attio shipped MCP write access on February 19. HubSpot’s remote server left beta on April 13, with write on contacts, companies, deals, tickets, line items and activities. Salesforce went generally available on April 29, Enterprise Edition and up, with write that reaches flows and Apex. Pipedrive followed on June 30, native, on every plan.

Whichever one you are on, that page is in your account now, open or not.

It arrived with a setting. Connect an agent to your CRM and the tools come sorted the same way: reads run without asking, writes stop and ask you first. Nobody at your company chose that. It is the default, and for most teams it will be the entire policy they ever have.

It sorts on the wrong axis.

Asking before every write is not a control. It is a rate limiter, and it gives way in two places.

It gives way structurally, because a prompt belongs to the interactive session and not to the tool. The moment that agent runs on a schedule, inside a subagent, or off a queue with nobody at the keyboard, there is no window to put a prompt in. “Needs confirmation” quietly becomes “does it anyway”, and the policy reads the same either way.

It gives way in practice, because a person asked to approve forty writes a day approves the forty-first without reading it. Every prompt spent on something harmless is attention taken from the one that mattered. Blanket approval does not buy careful review. It buys a person clicking yes.

Where an agent app sorts more finely than reads against writes, it reads a flag each server publishes about its own tools. The protocol is blunt about what that is worth: clients “MUST consider tool annotations to be untrusted unless they come from trusted servers”. Your CRM vendor is the trusted server. The label on the gate is written by the thing being gated.

Sort actions by whether they can be undone, let the reversible ones run, hold the irreversible ones for a person. I am not going to pretend that is new. OWASP publishes a tiered version of it, with irreversible actions at the top of the ladder, and some form of it appears across the agent-security literature.

The CRM versions sort by risk class, gating the money fields. Sorting by what can be taken back instead is the harder crossing, because your object model does not line up with the security one. Ask it of each tool instead of each category: if this goes wrong, what undoes it, and how long does the undo stay available? Three answers come back.

Run it. Someone who finds the mistake can undo it. Create a record, add a note, move a list entry, draft an email. A wrong value costs you the time it takes to notice.

Plan it. Defensible, but nothing on your side takes it back, so the agent writes the instruction and stops. Deletions. Merges. Anything whose blast radius it cannot state to you in a sentence.

Withhold it. Not gated, removed. A box you never ticked cannot be reached by a bad retry loop, an injected instruction, or a tired afternoon.

Run that over the grant a CRM agent actually asks for and it comes apart in places the checkbox page keeps together. “Update a field”, the most ordinary write on the list, refuses to resolve at all, because some of your fields are triggers.

The merge. Deletion gets the attention because it sounds final. A merge is filed under editing and is worse. Where two records disagree on a single-value field, the survivor keeps its own and the other value is gone, with no warning and no unmerge, and both original records stop being readable. The documentation covers the precedence rule and nothing else; we measured the rest on our own workspace last week. Our CRM agent had merges on its auto-execute list until two weeks ago, one bullet from a line calling deletion “the one irreversible operation”. Naming one is what hid the other.

The write that fires itself. Reversibility is a property of the write plus everything downstream of it. An agent that may update an automation but never delete or run one looks safe by the sort, and is not: it can write a change into a workflow and let that workflow’s own schedule fire it. The automation then runs with its own permissions, which are usually wider than the agent’s. Denying delete and execute does not close that path. We designed a second, narrower grant for one of our own agents on that theory. It was not safer, and we never built it.

The thing that left. A sent email, a message inside a live sequence, a post in a channel. The record of it stays editable. The fact of it does not. That is why our email layer drafts by default and sending needs its own say-so, and why our chat integration has no posting tool at all rather than a gated one.

The child. An agent that spawns a subagent hands over its own authority unless something stops it. You can narrow the child’s tool list. What you cannot narrow is whose name the write lands under: it reaches your CRM as the parent, and that is the name on the record.

Two signals, and neither is the absence of incidents.

The first is how often you are being asked. If a person is confirming several things a day, the sort is wrong, not the reviewer. A grant that has been thought through produces a small number of real decisions, and each one gets read.

The second is the one the opening story turns on, and it is the half people skip. Reversible in principle is worth nothing if the write is not findable in practice. That cell got cleared because the run left a trace, on a known column, somewhere a person was already looking. So ask it of anything you would let run unattended: if this were wrong, what would show me, and how long would it take? An undo you cannot locate is not an undo.

Nothing has to be connected for any of this. Take a write you would let an agent make and try to finish the sentence that undoes it. Clear the field. Delete the record. Unmerge. Unsend.

The ones where the sentence will not finish are what you had to decide. Everything else can run.

Talk soon,

Marco

Founder / CEO, Novrith