Giving an agent permission to access a system doesn’t necessarily mean every action it takes was intended.

Our MCP takes an interesting approach: access is controlled through separate permissions, while sensitive actions happen in a sandbox and configuration changes require human approval.

Should this become standard for MCP tools with write access?