A read-only AI job still needs a real boundary around the grow room
A read-only promise is verified by naming what the analysis task must never change and then checking which layer actually refuses each change. A sentence in the prompt is not enforcement: damage from excessive agent capability traces to excessive functionality, permissions and autonomy (OWASP). Read-only is a permission question, not a description of intent.
Name what must not change
Worked example, illustrative rather than a real case: an agent is asked to read one grow room's climate history and return a summary. Write the boundary as a list of prohibited effects on named objects — the climate setpoints and their schedule, the alarm definitions, the batch and stage records, the operator process log, and the account and role list. A task reading room history has no reason to reach any of them. "Read-only" as an adjective is not auditable; this list is.
Classify each control by what enforces it
In Manna's engineering method — our synthesis from designing agent workflows, not an external taxonomy — every control on that list falls into one of four classes:
- Preventive boundary: the executing environment holds no credential or route able to perform the write at all.
- Application check: the route accepts the request and validates it before acting.
- Detective check: the change is found afterwards and the result is withheld.
- Prompt rule: the model is asked to stay within a stated scope.
The classes are not equivalent. Preventive boundaries and application checks act before the effect occurs; detective checks and prompt rules act after it — or never. The tool-design case is the same principle: OWASP's guidance notes that a mailbox-summarising extension should not contain other functionality such as deleting or sending messages (OWASP). A read-only boundary implements least privilege — each entity is granted the minimum resources and authorizations its function needs (NIST). Layered barriers across multiple levels are recognised practice (NIST), but added layers do not equal the assurance of the strongest one.
Review the routes the process can actually reach
A wrapper that refuses write calls on the main interface is not complete enforcement if the same process can reach a second client with broader authority: another API key, a shared service account, a database login. In a growing operation the shortest unnecessary route is also the consequential one — one alarm delivered to the whole on-call list, or one batch entry that no longer matches the traceability history. Review the reachable routes in an authorised test setup instead of assuming the approved tool name is the only path.
State the tested scope, not a label
Record what is enforced, where it is enforced, which tests passed and what remains unverified. Preventing local file writes says nothing about network disclosure; a post-run scan that catches a leaked secret does not prove the process could never transmit one. "Safe" and "cannot be bypassed" are labels that expire the next time a credential, a tool or an execution path changes. Describe the tested scope and the residual risk instead.
Questions to ask before the next run
Which effects are prohibited? Which layer refuses each one? Which test showed that it does? Who reviews the output when the only protection is detective? And what is the task still allowed to do when the check itself fails?
We treat the granting side of the same problem in our article on agent tools and permissions, the input side in our article on turning email into bounded agent work, and the task side in our article on the agent work task brief.
If you would rather have this boundary designed and configured for you: in Manna MIND, climate and equipment control stays deterministic with the limits the operation agreed — climate grow schedules carry a setpoint audit trail — while the agent reads, analyses and reports inside a defined boundary, and the technical operating owner stays in control. Whether you run MIND today or start from a scoped integration project, the route is the same. To talk through your first scoped agent workflow, contact Manna.
Prepared with AI assistance for Manna Insect Oy.