When you connect an AI assistant to a work system through the Model Context Protocol (MCP), you usually face one decision before any other: may it only read, or may it also change things? Read-only lets it answer questions about your projects, leave and files. Write access lets it act: file the bug, log the hours, share the folder. Both are useful. They carry different risks, and the right answer is rarely the same for every tool or every person. This post sets out how to choose.
What read-only and write access actually mean
An MCP server offers an assistant a list of tools, and each tool either reads data or changes it. A read tool lists your open issues or totals your logged hours. A write tool creates, updates, moves, shares or approves something. The protocol lets a server mark a tool as read-only, and OpenAI’s guide to custom MCP servers says ChatGPT respects that marker and treats every tool without it as a write action.
The split matters because the failure modes differ. A read tool that goes wrong gives the assistant information it should not have, or a wrong answer. A write tool that goes wrong changes your records: an issue closed that was still open, time logged to the wrong project, a folder shared with the wrong person.
Read-only is not risk-free
It is tempting to treat reading as safe. It is safer, not safe. Whatever the assistant reads ends up in the conversation, so it sits wherever your assistant keeps chat history. And text written by colleagues, such as an issue description or a note, can contain instructions aimed at the assistant. With read-only access, the worst a planted instruction can usually do is steer the answer. With write access, it can try to steer an action. That is why the controls below are worth setting even for reading.
When write access is worth it
Write access earns its place where the action is routine, easy to check and easy to undo. Good candidates:
- Turning notes into tickets. “File these five bugs from my notes” saves typing, and every issue is visible on the board straight away.
- Logging time. Hours are reviewed before they are billed, so a wrong entry gets caught. See an AI timesheet assistant for agencies.
- Requesting your own leave. It only affects you, and a manager still decides.
Keep it off, or think twice, where an action is visible to people outside the team, hard to reverse or touches pay. Sharing a file, approving someone else’s request and changing a salary all fall here. They are not wrong to allow; they deserve a deliberate choice by the person who owns that work.
What the assistants do about writes
Both main assistants add a safety step for write actions, and both let you loosen it. OpenAI’s guide says write actions require confirmation by default, and that you can tell ChatGPT to remember your approval for a tool for the rest of a conversation. It advises doing that only for an application you trust to make further writes without asking. Anthropic’s help article gives the same advice for Claude’s “Allow always” option, and suggests switching off any tools you do not want Claude to use in a conversation.
One mode deserves special care. Anthropic’s article says that during Research, Claude can call tools from your connectors automatically without further approval, and recommends disabling any tools that can take write actions. If your team uses Research with a connector, that is the place to keep things read-only.
How Orbiz splits reading from changing
In Orbiz MCP the choice is made per tool on the consent page that opens when you connect. Each tool has a reading tick and, where it has write actions, a separate changing tick, so you can let an assistant read your Cadence board without letting it move a single issue. You can untick anything before you approve, and the assistant can never go beyond what your role could already do on the web. The table shows what each tool exposes.
| Tool | Reading actions | Changing actions | What changing allows |
|---|---|---|---|
| Cadence | 7 | 11 | Create, update, move and close issues; comment; run sprints |
| Trackline | 5 | 7 | Create and update projects and milestones; log time |
| AMS | 7 | 3 | Request or cancel leave; approvers decide requests |
| HRMS | 9 | 5 | Complete a task step; add or move a candidate |
| Notely | 2 | 3 | Create, update and archive notes |
| Filespace | 3 | 3 | Create folders, save text files, share |
| Ledgr | 5 | 2 | Payroll managers only: propose or change a salary |
| Grabr | 2 | 0 | Nothing: read-only |
Three details are worth knowing. In Ledgr, changing pay is its own tick with its own warning on the consent page: only tick it if you run payroll. In Filespace, sharing is a changing action, so a read-only connection cannot share a file with anyone. And Grabr is read-only throughout: list your recordings and get one, with its share link.
Some things have no action at all, read or write. There is nothing for the Vault, nothing that clocks a person in or out, and nothing that deletes. So the riskiest changes stay human actions in the app whatever anyone ticks.
A checklist for choosing
- Connect read-only first, for every tool.
- After a week, list the jobs you kept doing by hand that the assistant could have done. Switch on changing only for those tools.
- Leave sharing, approvals and pay off unless that work is yours.
- Keep the assistant’s write confirmations on. Remember an approval only for a tool you trust.
- Keep write tools off in research modes that run tools without asking.
- Check your activity in Settings → Connected AI apps now and then. To change what an assistant may do, disconnect it and connect it again with different ticks.
If you are the admin, the companion piece is AI connector admin controls: a checklist for admins. For a worked example of a careful write action, see approving leave requests with an AI assistant.
Sources, checked 2026-10-13: OpenAI, “Add custom MCP server” (developers.openai.com); Anthropic, “Getting started with custom connectors using remote MCP” (support.claude.com). Orbiz behaviour is described from the Orbiz web app; the full list of actions is on the Orbiz MCP page.
Built for your industry
