What you will learn Not a chapter to read but one to do. List every tool you have enabled, sort it three ways, and find the dangerous combinations yourself.
Open turning tools on and off and write down everything enabled, leaving nothing out. Built-in tools included.
| Tool | What it does | Who enabled it | Last used |
|---|---|---|---|
Fill in the last column. If "no idea" covers more than half, that is itself the finding.
Practice list:
read_file·web_search·internal_doc_search·send_email·create_calendar_event·repo_write·customer_db_query·slack_postIf you have attached a database, add these too —
db_select·db_query·db_insert·db_update·db_delete
Judge each tool only on whether it is reversible. Whether it is useful is not the question right now.
| Group | Criterion | Your tools |
|---|---|---|
| Read | changes nothing | |
| Reversible write | can be deleted or rolled back | |
| Irreversible | cannot be recalled once sent |
Answers for the tricky ones:
The second line is the technique. Judge by "has someone already seen it?" rather than "can it be deleted?"
Not every read is safe. Sort them once more by what they read.
| What it reads | Example | Handling |
|---|---|---|
| Public / general | web search, public docs | as is |
| Internal confidential | contracts, HR files | narrow the reach |
| Personal data | customer DB, contacts | check basis and retention |
Yes to both means split them now.
This is the core of the exercise. Each tool is safe; joining two creates a path.
Join them for real, from your own list.
| Reads | Sends | Path created | Approval? |
|---|---|---|---|
| internal_doc_search | send_email | internal documents to outside | □ |
| customer_db_query | slack_post | personal data into a channel | □ |
| □ |
Finding three or more is normal. Combinations grow with the square of the tool count, which is why reducing tools is the strongest control available.
The most common one. It was needed when attached, and nobody turned it off when it stopped being needed. The real problem is having no turn-off routine — put the quarterly review in the calendar.
Then the right answer is not to attach irreversible tools. Drafting and letting a person send beats enabling send_email with nothing in front of it.
You have too many tools. As when there are too many tools showed, selection accuracy is probably suffering too. Start by turning off what nobody uses.
1. What is the criterion when sorting tools into three groups?
Reversibility. Not usefulness, not frequency. And "has someone already seen it?" is more accurate than "can it be deleted?" — a deleted Slack post was still read.
2. Why check combinations separately when each tool is safe?
Because a tool that reads something sensitive joined to a tool that reaches outside becomes an exfiltration path. That is why approval belongs on "actions that leave the building" rather than on individual tools, and why reducing tool count is the strongest control.
3. What should an organisation with no approval point do?
Not attach irreversible tools. Have it draft and let a person send. An irreversible tool enabled with no approval in front of it is the worst combination there is.
That was the part that does not care about the shape. The two remaining chapters look at one of the three shapes in detail — the protocol for attaching outside programs → MCP — the common protocol for attaching tools
HyperTeams□ 30 minutes□ Workspace admin rights□ No tools attached yet? Practise on the example list belowcreate_calendar_event → reversible write (you can delete it) unless invitees were notified → irreversibleslack_post → irreversible (deleting it doesn't unsee it)repo_write → reversible write (where a revert exists)customer_db_query → read. But see step 3□ Do any tools fall into the two bold rows?□ If so, does that workspace also hold an inbound route (widget, channel, email)?[tool that reads something sensitive] + [tool that reaches outside] = exfiltration path1. Put human approval on the outbound side ← usually this2. Split the two tools across workspaces ← when there is no approval point[Now] □ Turn off tools unused for three months □ Irreversible tools without approval — add approval or turn them off[This week] □ Place approval on the bold combination paths □ Plan a split if an inbound route shares a workspace with internal material[Quarterly] □ Refill this table — tools only ever accumulate