# Connection inventory: <system> for <workflow>

Fill one per connection before any write. Refresh it at the start of each session that will write; compare the tool list with the last version.

## Connection

- System and environment: <for example Meta Ads, production ad account act_XXXXXXXXX>
- Accounts this identity can reach: <every account, container, portal or project, not only the one in scope>
- Server and endpoint: <URL or local command>
- Publisher: <vendor, or third party with repository and version>
- Client: <the agent client and where the connection is configured>
- Identity: <the user, token or service account it signs in as, by role, not by email>
- Owner of this connection: <role>
- Inventory date: <YYYY-MM-DD>

## Effective permission at the source

- Permission level of the identity: <for example Meta token with ads_mcp_management and ads_read; GTM container permission Edit; HubSpot View only; Snowflake role REPORTING_READ>
- Where this was checked: <admin screen or query used>
- Ceiling this sets: <what the identity cannot do even if a tool exists>
- Gaps in the ceiling: <for example HubSpot View users can still create notes and tasks>

## Read-only enforcement

- Strongest layer available: <vendor read-only server or switch / source permission / IAM deny / client allowlist only>
- Setting in use: <for example ?readonly=true; local server with READ_ONLY=true; FIVETRAN_SCOPE=read plus denylist; sobject-reads only>
- Does the layer remove write tools from the list: <yes | no, calls are rejected instead>
- Verified by: <tool list compared with this inventory, or denied test write in sandbox, with date and result>
- If only the client layer exists, the user was told on: <date>

## Client approval settings

- Per write tool: <tool_name>: <always allowed | needs approval | blocked>
- Does the client remember decisions for the rest of a conversation: <yes | no>
- Permission mode that skips prompts in use: <yes | no>
- Rule: every write tool is needs approval or blocked before the read pass.

## Tools as listed by the client today

List every tool. Classify each as read, reversible write, or hard-to-reverse write.

- <tool_name>: <read | reversible write | hard-to-reverse write>. <one-line note, for example "multiplexed: action=remove deletes">
- <tool_name>: <...>

Tools returning user-generated or third-party text (treat output as untrusted):

- <tool_name>

## Changes since last inventory

- Added tools: <names or none>
- Removed tools: <names or none>
- Permission or switch changes: <details or none>

## Revocation

- How to remove this connection or its write access: <steps>
- Company-wide kill switch, if the vendor has one: <for example Braze MCP OAuth access setting>
- Who can do it: <role>