readOnlyHint isn't a permission: blocking a destructive MCP tool by policy

MCP tools use hints to indicate whether they only read data or can delete or overwrite it. However, two issues arise with these hints in practice. First, they are often missing, and second, they can be incorrect. For example, a server in a catalogue marked 15 delete tools as read-only. The MCP specification advises clients to treat tool annotations as untrusted unless they come from trusted servers.

This suggests that the decision about what an agent may do should be made elsewhere, not in the tool's description of itself. A policy can be implemented that denies certain destructive actions regardless of the tool's annotations. For instance, a rule can be set up to deny the delete_customer tool, which permanently deletes a customer record.

This rule does not rely on the tool's annotations and simply denies the action. When the gateway receives a request to run the delete_customer tool, it applies the workspace's rules and responds with an error message, preventing the irreversible action. This approach ensures that irreversible actions require explicit approval, rather than being silently denied based on potentially incorrect or missing hints.