{"resourceId":"permit-io-read-only-trust-level-ai-ops-agents-step-up-20260728","versions":[{"version":"external-5e00d42ccb7ae089d5a46d67d3b26e7cf30345e7b9d9616df67ce4d14bf1153a","resource":{"id":"permit-io-read-only-trust-level-ai-ops-agents-step-up-20260728","title":"Permit.io guidance: treat read-only as a defined trust tier for AI ops agents, require policy step-up for restarts, deploys and permission changes, and keep parameter-level audit chains","organization":"Permit.io","sector":"Authorization and access-control guidance for AI operations agents","geography":"Global","publishedAt":"2026-07-28","publicationDate":"2026-07-28","eventDate":null,"sourceName":"Permit.io blog","sourceLabel":"Permit.io: Read-Only Is a Trust Level, Not a Feeling","sourceUrl":"https://www.permit.io/blog/read-only-trust-level-ai-ops-agents","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement"],"finding":"The guide proposes a T0-T3 taxonomy for MCP tool calls: inspect/read, diagnose/test, draft change, and restart/modify/deploy/delete/change permissions. It argues remediation should be a separate trust boundary, that many incidents should end at 'recommend', that delegation from an SRE must not raise an assistant above its own ceiling, and that audit trails must keep exact tool-call parameters, the evidence used, authorization rationale and approver identity. It includes an example deny-by-default policy requiring approval, fresh MFA and a change ticket for production changes.","sledRelevance":"Why now: NVIDIA's Nov 4 release puts read-only SRE agents in front of research-computing teams. This guide supplies the missing next step: how public IT shops should classify and approve agent actions before any agent touches production systems.","evidence":"Practitioner guidance from an authorization vendor; no empirical evaluation. Published Jul 28, 2026, before NVIDIA's release, and does not mention it.","architectureImplications":"Enforcement sits at the MCP tool-call layer using agent identity, delegating human, intent and environment.","governanceImplications":"Approval prompts are not the same as policy step-up; the latter is an authorization state change.","securityPrivacyImplications":"Parameter-level logging distinguishes reads from destructive actions.","caveats":"Written by a vendor that sells policy tooling; examples centre on Azure/Microsoft tools; older than the window and used as independent framing only.","streamIds":["nvidia"],"roles":{"sales":"Use this guide to steer agent-for-operations conversations away from autonomy claims and toward controls. It argues that read-only diagnosis is valuable in itself and that restarts, deploys and permission changes need a separate approval path. A public-sector buyer can apply this test to NVIDIA's operations agent or any similar tool. The source is a policy-tooling vendor with an interest in the argument, so present it as a framework, not as evidence of outcomes.","engineering":"The technical point is to classify every MCP tool by operation risk, not by server, and enforce at the tool-call layer with deny by default. Production reads and dry runs may be allowed; drafts need attribution; restarts, Terraform applies, secret rotation and RBAC changes need step-up with named approvers, fresh MFA and a change ticket. Log exact parameters, evidence and the reason for each policy decision so an incident can be replayed.","delivery":"In delivery terms, this becomes a governance checklist for any ops-agent pilot. Inventory the tools the agent can call, assign each a tier, and document who may approve higher tiers. Set the delegation rule so an assistant stays capped even when a senior engineer invokes it. Build the audit chain before go-live and review it after the first incidents. These are proposed practices taken from guidance; the source reports no measured outcomes."},"roleDetails":{"sales":{"customerProblem":"Buyers lack a way to judge how much authority an ops agent should hold.","stakeholders":["CISO","IT operations director","Change advisory board"],"discoveryQuestions":["Which agent actions are read-only and which change systems?","Who approves agent-proposed changes?"],"valueHypothesis":"A tiered control model can make agent pilots acceptable to security and change boards.","potentialEngagement":"A trust-tier and approval-policy design for one ops-agent pilot.","unsupportedClaims":["Measured safety outcomes","Vendor-neutral endorsement"]},"engineering":{"fit":"Applies to any MCP-based ops agent.","architectureIntegration":"Policy enforcement at the tool-call layer; deny by default.","prerequisites":["Tool inventory with risk classes","Identity for agents and delegating humans"],"constraints":["Vendor guidance, not a standard","Examples are Azure-centric"],"security":"Step-up with fresh MFA and change ticket for production mutations; parameter-level audit.","proofOfValue":["Attempt a T3 action as a low-trust agent and confirm denial","Replay an incident from the audit chain"]},"delivery":{"work":"Write trust tiers and approval rules into the pilot.","dependencies":["Policy engine or equivalent","Change management process"],"ownership":"IT security governance lead.","skillsAdoption":"Train approvers on step-up decisions.","governanceCheckpoints":["Tool tiers approved","Delegation cap tested"],"acceptanceCriteria":["Proposed: every tool call logged with parameters","Proposed: zero unapproved production mutations"],"risks":["Over-broad credentials","Approval fatigue"]}},"retrievedAt":"2026-11-05T03:56:52Z","enrichedAt":"2026-11-05T03:59:54Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires named approver roles such as incident commander or service owner.","procurementImplications":"Agent tools should be bought with tiered permissions and audit export, not one admin credential.","operatingModelImplications":"Remediation authority stays with humans unless policy allows otherwise.","sourceVerification":{"openedUrl":"https://www.permit.io/blog/read-only-trust-level-ai-ops-agents","referenceExcerpt":"Many incidents should conclude at “recommend” unless policy and approval allow for changes.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}