- Every MCP tool maps to a permission the human already has. - Every write goes through the same action class the web UI calls. - MCP gets zero special privileges. I used an abstract base class to ...