Source: https://daphnislabs.com/blog/ai-tool-permissions-read-draft-send Last updated: 2026-09-29T09:00:00+05:30 [All articles](https://daphnislabs.com/blog) # Separate read, draft and send permissions in AI tools 29 September 2026[AI Engineering](https://daphnislabs.com/blog/category/ai-engineering) ![ChatGPT open on a laptop, with its message field visible above the keyboard.](https://daphnislabs.com/images/blog/photos/ai-tool-permissions-read-draft-send.webp) An assistant that can read a customer record does not automatically need permission to change it or send a message. Combining these actions inside one broad tool makes it harder to explain what the assistant is allowed to do. Separate capabilities around the business action and the consequence of getting it wrong. ## Describe capabilities in verbs Start with actions such as search tickets, read an assigned account, draft a reply and send an approved reply. Specify the resource scope for each action. Read-only access can still expose information, so limit it to the records the current user is entitled to view. Keep credentials in the execution layer rather than placing them in prompts or tool descriptions. The [OWASP authorization guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) recommends least privilege and permission checks on every request. Apply those checks in the service that executes the tool. A prompt telling the assistant to behave carefully is not a substitute for a server rejecting an unauthorised action. ![Read and draft actions connect freely to a workspace, while send is separated by an explicit approval gate bound to the final message.](https://daphnislabs.com/images/blog/editorial/ai-tool-permissions-read-draft-send.svg) ## Bind approval to the final payload For a send action, show the recipient, subject, message and attachments together. Bind the approval to that exact payload and the acting identity. If the assistant changes the recipient or text afterward, require a new approval. Avoid a reusable yes token that can authorise a different action later in the conversation. Keep drafting useful even when sending is unavailable. A support worker should be able to edit or discard a proposed reply. When execution fails, report whether anything was sent before offering a retry. An ambiguous network result needs reconciliation, particularly where the receiving API does not support idempotent requests. ## Test the boundary directly Include these cases in an [AI evaluation and guardrails plan](https://daphnislabs.com/services/ai-evaluation-guardrails) : attempt a tool call for an unassigned account, alter a payload after approval and replay an expired approval. The execution service should reject each attempt regardless of what the model says. Record the decision, actor and affected resource without copying unnecessary customer information into logs. Use this action map when scoping [agentic automation](https://daphnislabs.com/services/agentic-ai-automation) or an [MCP server](https://daphnislabs.com/services/mcp-server-development) . For assistants that also retrieve documents, connect it to the separate [RAG permission model](https://daphnislabs.com/blog/rag-permissions-before-vector-search) so search access and action access do not drift apart. ## Related articles [View all blogs](https://daphnislabs.com/blog) AI Engineering ### [Kimi K3.1 Pro API: Pricing, Context Limits and a Multi-File Refactor Test](https://daphnislabs.com/blog/kimi-k31-pro-api-pricing-context-multi-file-refactor-test) Separate Kimi's API and coding-plan limits, budget cache writes correctly, and evaluate a repository refactor against behavior that must survive the change. AI Engineering ### [Mercury 3 API: Launch Pricing, Context Limits and a Support-Agent Latency Test](https://daphnislabs.com/blog/mercury-3-api-pricing-context-support-agent-latency-test) Budget beyond Mercury 3's launch discount, check its streaming and reasoning defaults, and measure how quickly a support agent produces a correct, usable answer. AI Engineering ### [Muse Spark Open: API Pricing, Context Limits and a Self-Hosting Evaluation](https://daphnislabs.com/blog/muse-spark-open-api-pricing-context-self-hosting-evaluation) Separate the model's context from each provider's limits, calculate a coding-pilot budget, and test a mobile layout repair before committing to self-hosted hardware.