Vendors start writing the agent boundary down
Engagement and AI vendors publish what their agents may read, write and keep, next to the capability itself.
The pattern so far
From July 2026 a growing number of vendors publish the limits of their agents in the same release as the capability: session lifetimes, create-only write scopes, read-only connectors, token durations, tenant rules enforced on API writes. By September the boundary was in shipped products, not only in documentation, and it had become something a buyer can compare across vendors. It moves together with the growth of agent write scope, as its counterweight.
Trajectory
Month by month
- Accelerating Reconstructed
The boundary moved into shipped products. Treasure AI's voice connector is read-only by design, X's Ads MCP issues tokens that last about two hours, and HubSpot enforces admin validation rules on every CRM API write. Braze documented its MCP server in full, 71 tools of which 34 write, with permission changes applied on the next request.
- The AI Voice Connector is read-only and no agent can delete, retag or export a recording.
- X Ads MCP access tokens last roughly two hours, with refresh tokens rotating on use.
- Admin-configured validation rules are enforced on all CRM API write paths.
- The Braze MCP server is documented with 71 tools, 34 of them write.
- The vendors who write the boundary down are the ones you can actually buy from.
- Confirmed Reconstructed
Three more publishers wrote the boundary down. MoEngage published MCP session lifetimes, Optimove stated that its MCP creates Gamify missions only as drafts and cannot edit or delete them, and OpenAI's Admin plugin shipped with five written guarantees about what it can and cannot change.
- Emerging Reconstructed
OpenAI built Presence around policies, guardrails and approved actions, and three engagement vendors shipped agent features with their limits stated in the same release: Braze exposes no profile PII over its MCP server, Bloomreach's Loomi only uses voucher pools that already exist, and Optimove's MCP session lasts one day by default.