Read-only vs write tools: why agents should start read-only

#Read vs write in a recipe

Each recipe has an effect field, either read or write. find_recipe returns the field, so an agent can tell the two apart before it runs anything.

A write recipe adds three things:

• a confirm.summary, a sentence that shows the user what will happen, filled in with the values and what the recipe found;
• steps marked write: true, which are the only steps that change data;
• an Allow window that opens before the first write request.

Reads that come before the first write run as usual. That lets the summary name the item the agent found.

#The count from the registry

The registry lists 41 recipes for 29 sites as of 7 November 2026:

• 39 are read;
• 2 are write: doctolib.de/book-slot and kleinanzeigen.de/message-seller.

The Doctolib booking recipe is untested with a logged-in recording as of the same date. Test it yourself before you rely on it, and always read its Allow window.

#Why start read-only

A read can be repeated and checked. If the result is wrong, nothing outside your computer has changed. A write is a real change. A booking or a message to a seller cannot be taken back by Wield.

Start with find_recipe and run on read recipes. Add write recipes only for a task that needs one, and approve each Allow window after you read it. Each Allow covers one run, so approval for one booking does not carry over to the next.

#Organization policy

An admin can set writes to deny for a whole organization. Write recipes then stop appearing in results and cannot run. Any attempt returns policy_denied, and nothing is sent. The setting is in the policy, not in the agent's instructions, so an agent cannot switch it back on. See set organization policies for AI agents.

#What the Allow window shows

Before the first write request, the window lists:

• the site and the task;
• the recipe's summary, filled in with your values;
• each request that will be sent, with its method, path and body. Tokens in the body are masked.

Deny is the default button. Esc denies too. Two minutes without an answer also count as a deny.

#FAQ

#How does an agent know a recipe writes?

find_recipe returns the effect field for each result. A write recipe also has effect set to write, and the agent should treat that as a signal to ask first.

#Can one Allow cover several writes?

One Allow covers one run. A run that makes several write requests still needs a single approval, but each new run needs a new one.

#Can I make an agent read-only for my whole team?

Yes. Set writes to deny in the organization policy. That is a paid-plan feature, see pricing.

#What if a write looks wrong?

Deny the Allow window. Nothing is sent, and the run returns confirmation_denied. Approve a write only after you have read every request in the window.