Writes from agents

Write tools are annotated readOnlyHint: false:

Tool	Effect
`visitor_note_add`	Adds a visitor note
`conversation_disposition_set`	Sets a conversation’s disposition
`ai_feature_execute`	Runs offline language detection on supplied text
`subscription_create`, `subscription_replace`, `subscription_delete`	Manage event subscriptions

config_plan only previews a change, so it’s marked read-only.

Retry safely

Write tools need an idempotency_key argument.
If the outcome is unknown, retry with the same key and arguments. Never let the agent invent a new key for the same change.
Write results include an operation_id. Call operation_get with it and the website_id to check the receipt.

See safe writes and retries for conflict codes and receipts.

Keep a person in the loop

In Codex, set default_tools_approval_mode = "writes", or list write tools in disabled_tools.
In other clients, require approval for tools that aren’t read-only.
Or simply don’t grant write scopes.