The short answer
Add previews, approval and recovery when writes are needed. Reading still requires appropriate data permission.
Try it in three steps
- Connect a dedicated practice data source.
- Ask one known-answer question and one out-of-scope question.
- Confirm out-of-scope requests are denied or clearly limited.
A practice prompt
Before you start
You need an existing MCP-compatible client and controlled test source. Use fictional data only; without a connection, draft the test table and do not claim permissions were verified.
Practice material (fictional)
Practice space A permits rule A. Space B contains only a boundary-test marker and is not authorized to the current account.Replace placeholders in the prompt with this material, or append the material if there are no placeholders. Reading time excludes doing the exercise.
Query product rules in the practice knowledge base only, cite sources and create or modify nothing.What to look for (not a recorded test result)
A should be readable with a source; B should be restricted by actual tool or service permissions. A read-only prompt alone does not enforce isolation.
If it goes wrong
A tool listing does not prove data access; test the actual boundary.
Check your result
Normal queries have sources and out-of-scope requests do not silently expand access.
References and scope
The links below support the concepts or product navigation. The steps and exercises are our teaching suggestions, not official certification or measured customer outcomes. Product interfaces and availability may change. References checked on 2026-10-17.