The agent's write scope outruns its published boundary
Agents gain write access to campaigns, content and configuration faster than vendors publish what that access is limited to.
The pattern so far
From late July 2026 agents stopped only reading. Through MCP servers and built-in agents they began to create content, launch campaigns and change platform configuration, and the volume of write tools grew faster than the published rules about what those tools may touch. August marked the end of the read-only phase, September added writes that go live without anyone opening the platform. Its counterweight is the pattern of vendors writing the boundary down.
Trajectory
Month by month
- Confirmed Reconstructed
Klaviyo Headless lets an agent read, write and go live without opening Klaviyo, Salesforce turned the Agentforce platform on by default, X's Ads MCP server writes to production ad accounts, and Gemini connectors gained new write actions in preview. The write scope kept growing faster than the boundary around it.
- Klaviyo Headless: an agent able to read, write, and go live without opening Klaviyo.
- Agentforce Platform is enabled by default, rolling to existing orgs from September 2026.
- Ten of the 23 X Ads MCP tools write to production ad accounts.
- Gemini Enterprise connectors gain new write actions in public preview.
- Confirmed Reconstructed
The read-only phase ended. Klaviyo added more than 260 MCP tools with write access and no published permission model, Google's GitHub connector reached GA with actions, and writes moved from campaigns to configuration: Tealium's Configuration MCP, BrazeAI Operator in GA with an Auto-approve option, Salesforce's Data 360 MCP server.
- Klaviyo's 260-plus MCP tools give agents full programmatic access, including writes.
- Gemini Enterprise's GitHub connector is GA, with search and actions on repositories.
- Agents can update Tealium's server-side profile configuration in natural language.
- BrazeAI Operator is GA, creating and editing Canvases, with an Auto-approve actions option.
- The Data 360 MCP Server lets agents build on about 200 Data 360 APIs.
Before it became a pattern
Early sightings that did not yet pass the entry rule on their own.