# Audit your tool permissions

> **What you will learn**
> Not a chapter to read but one to **do**. List every tool you have enabled,
> sort it three ways, and find the dangerous combinations yourself.

## What you need

```
□ 30 minutes
□ Workspace admin rights
□ No tools attached yet? Practise on the example list below
```

---

## Step 1 — List everything (5 min)

Open [turning tools on and off](/guide/cn-tool-settings) and write down
**everything enabled**, leaving nothing out. Built-in tools included.

| Tool | What it does | Who enabled it | Last used |
|---|---|---|---|
| | | | |

**Fill in the last column.** If "no idea" covers more than half, that is itself
the finding.

> Practice list: `read_file` · `web_search` · `internal_doc_search` ·
> `send_email` · `create_calendar_event` · `repo_write` · `customer_db_query` ·
> `slack_post`
>
> If you have [attached a database](/guide/cn-database), add these too —
> `db_select` · `db_query` · `db_insert` · `db_update` · `db_delete`

---

## Step 2 — Sort into three (10 min)

Judge each tool **only** on whether it is reversible. Whether it is useful is
not the question right now.

| Group | Criterion | Your tools |
|---|---|---|
| **Read** | changes nothing | |
| **Reversible write** | can be deleted or rolled back | |
| **Irreversible** | cannot be recalled once sent | |

Answers for the tricky ones:

```
create_calendar_event → reversible write (you can delete it)
                        unless invitees were notified → irreversible
slack_post            → irreversible (deleting it doesn't unsee it)
repo_write            → reversible write (where a revert exists)
customer_db_query     → read. But see step 3
```

**The second line is the technique.** Judge by **"has someone already seen it?"**
rather than "can it be deleted?"

---

## Step 3 — Look at the read tools again (5 min)

Not every read is safe. Sort them once more by **what they read.**

| What it reads | Example | Handling |
|---|---|---|
| Public / general | web search, public docs | as is |
| **Internal confidential** | contracts, HR files | narrow the reach |
| **Personal data** | customer DB, contacts | check basis and retention |

```
□ Do any tools fall into the two bold rows?
□ If so, does that workspace also hold an inbound route (widget, channel, email)?
```

**Yes to both means split them now.**

---

## Step 4 — Find the combinations (10 min)

This is the core of the exercise. Each tool is safe; **joining two** creates a
path.

```
[tool that reads something sensitive]  +  [tool that reaches outside]  =  exfiltration path
```

Join them for real, from your own list.

| Reads | Sends | Path created | Approval? |
|---|---|---|---|
| internal_doc_search | send_email | internal documents to outside | □ |
| customer_db_query | slack_post | personal data into a channel | □ |
| | | | □ |

**Finding three or more is normal.** Combinations grow with the square of the
tool count, which is why reducing tools is the strongest control available.

### The conclusion is one of two

```
1. Put human approval on the outbound side   ← usually this
2. Split the two tools across workspaces     ← when there is no approval point
```

---

## Step 5 — Write the action list (5 min)

```
[Now]
  □ Turn off tools unused for three months
  □ Irreversible tools without approval — add approval or turn them off

[This week]
  □ Place approval on the bold combination paths
  □ Plan a split if an inbound route shares a workspace with internal material

[Quarterly]
  □ Refill this table — tools only ever accumulate
```

---

## Three common outcomes

### "There are tools I didn't know were on"

The most common one. It was needed when attached, and nobody turned it off when
it stopped being needed. **The real problem is having no turn-off routine** — put
the quarterly review in the calendar.

### "We have no approval point at all"

Then the right answer is **not to attach irreversible tools.** Drafting and
letting a person send beats enabling send_email with nothing in front of it.

### "I found more than ten combinations"

You have too many tools. As [when there are too many
tools](/guide/mcp-too-many-tools) showed, selection accuracy is probably
suffering too. **Start by turning off what nobody uses.**

---

## Check yourself

**1. What is the criterion when sorting tools into three groups?**

<details>
<summary>Answer</summary>

**Reversibility.** Not usefulness, not frequency. And **"has someone already
seen it?"** is more accurate than "can it be deleted?" — a deleted Slack post was
still read.
</details>

**2. Why check combinations separately when each tool is safe?**

<details>
<summary>Answer</summary>

**Because a tool that reads something sensitive joined to a tool that reaches
outside becomes an exfiltration path.** That is why approval belongs on
"actions that leave the building" rather than on individual tools, and why
reducing tool count is the strongest control.
</details>

**3. What should an organisation with no approval point do?**

<details>
<summary>Answer</summary>

**Not attach irreversible tools.** Have it draft and let a person send. An
irreversible tool enabled with no approval in front of it is the worst
combination there is.
</details>

---

That is this part. Next, the methodology that turns all of this into **how you
work every day** → [What agile solved and what still blocks](/guide/ha-agile-limits)