Permission schemes get complicated quickly and complicated schemes don't get followed. Three categories is enough to make every decision you need to make.

Category	Definition	Default Handling	Example
Read	Changes nothing anywhere	Let it run freely	Look up a shipment, search documents
Reversible write	Changes something you can undo	Run it, log it, make undo easy	Draft a message, add an internal note
Irreversible	Can't be undone, or is seen by someone outside	Require approval, always	Send a customer email, cancel a booking, issue a refund

'Seen by Someone Outside' Counts as Irreversible

You can delete a sent email from your system. You cannot unsend it from the customer's inbox. Anything that reaches a person outside your company is irreversible in the only sense that matters, regardless of what your database can undo. This single reclassification catches most of the actions teams wrongly treat as safe.

Agentic AI and MCP for Product Managers

Module 1What 'Agentic' Actually Means

Module 2How an Agent Actually Works

Module 3MCP: What It Is and Why You Should Care

Module 4Designing the Tool Layer

Module 5Permissions and the Human in the Loop

Module 6Evaluating Agents

Module 7Cost, Latency and Unpredictability

Module 8Designing What the User Sees

Module 9Risk and Blast Radius

Module 10When an Agent Is the Wrong Answer

Module 11Final Project: Design One Real Agent End to End

Module 12Appendix: The Prompt Library

Three Categories, Not Five