Design an approval-required write tool

A write tool should not treat a generated call as authorization. Separate proposal, approval and execution, and invalidate approval when material arguments change.

Bind to a digest

The MCP contract lab hashes a synthetic ticket proposal.

from mcp_cases import write_approval_case

result = write_approval_case()
assert result["original_authorized"] is True
assert result["changed_authorized"] is False
assert result["external_write_executed"] is False
assert len(result["digest"]) == 64

Changing the summary produces a new digest and invalidates approval. The lab never creates a ticket.

Specify the full action

The proposal contains tool/version, target, material arguments, expected impact, evidence, idempotency key and expiry. The reviewer sees a human-readable diff and authenticates. The server records reviewer, role, time and digest.

At execution, revalidate identity, approval, preconditions and rate limits. Use least-privilege credentials and save a receipt. For high-impact actions, require stronger or multiple approvals.

Test races and retries

Cover changed inputs, expired/revoked approval, duplicate execution, cancellation and uncertain timeout. Retrieved content or another agent cannot approve the call.

The Generative & Agentic AI course connects approval-required MCP tools to durable agent state and audits.

Exercise

Implement a local write simulator with proposal digest, approval expiry and idempotency. Attempt four stale/tampered cases and prove one approved side effect.

Continue learning

This article is part of the MCP and integration contracts sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Test tenant isolation in a retrieval tool.
• Continue with Audit tool invocations without storing unnecessary personal data.

Reference: NIST AI RMF playbook.