Read-only agent sessions and time-boxed approvals

Read-only agent sessions limit what an AI agent can do before approval. AgentTrust ID starts a runtime session in read_only mode, lets read actions proceed through authorization, and returns an approval_id when the agent asks to write, send, delete, or run another non-read action.

Read-only agent sessions

A read-only session is a runtime authorization context where the agent can inspect data without holding standing write access.

The agent can gather context, read files, inspect state, or query an MCP server. Those actions still pass through AgentTrust ID. The difference is that the session starts with read access as its default state.

When the same session attempts a non-read action, AgentTrust ID does not execute it by default. The check returns an approval request instead. The agent can retry the action after the request is approved.

Standing write access risk

Standing write access turns one injected instruction into an action.

An agent might read a prompt injection. It might misread a task. It might carry stale context. If the session already has write or delete authority, the step can run before a person sees it.

Long-running agents make this worse. A session can last longer than the task that justified the original access. The agent keeps the power even after the reason for it has passed.

Read-only sessions reduce that exposure. The agent can still read. The write step needs a separate decision.

Time-boxed approval example

In this Python example, the agent opens a session and checks a write action before running the tool:

from agenttrustid import AgentTrustClient

client = AgentTrustClient.from_env()

agent = client.agents.create(
    name="report-writer",
    framework="custom",
    capabilities=["files:read", "write_report"],
)

session = client.sessions.init_session(
    agent_id=agent.id,
    server_id="mcp://files",
)

result = client.actions.check(
    agent_id=agent.id,
    action="tool_call",
    tool_name="write_report",
    tool_input_summary="Write approved summary to /reports/q2.md.",
    session_id=session.session_id,
    action_effect="mutating",
)

if result.elevation_required:
    print(f"Approval needed: {result.approval_id}")
    raise SystemExit

if not result.allowed:
    raise PermissionError(result.reason)

if result.allowed:
    write_report("/reports/q2.md")

The point of control is before the write. The tool checks authorization before it writes. If the session is still read-only, AgentTrust ID returns an approval ID instead of letting the write run.

After approval, the grant applies to the approved action for a short window. When the window expires, the session returns to read_only.

Prevention

Time-boxed, action-scoped approval mitigates permission drift.

Permission drift happens when a temporary grant becomes normal. Someone approves access for a task. The task ends. The access remains.

Agent sessions need the opposite default. The session should start with the access the task needs. A non-read action should ask for approval. The approval should cover the requested action, and it should expire without a cleanup task.

That makes read_only the resting state. Write access becomes a short exception.

Solving this with AgentTrust ID

AgentTrust ID tracks runtime sessions, action effect, approval state, and expiry in the authorization layer.

For each action check, the platform knows the agent, session, action name, and effect classification. A read action can proceed if the policy allows it. A mutating or destructive action in a read-only session returns elevation_required: true and an approval_id.

The approval can be handled in the dashboard or through the SDK:

client.approvals.approve(
    result.approval_id,
    decided_by="admin@company.com",
)

The agent then retries the same action. AgentTrust ID allows it only if the approved action is covered by the current session state and the approval window is still active.

The agent can keep doing read-heavy work while write access stays explicit. The grant is scoped to the approved action and expires.

To add read-only sessions and approvals to an agent, start with the SDK guide. To talk through where elevation belongs, join the waitlist.

• Read the SDK guide
• Join the waitlist