Write tools & guardrails

​

Which connectors have write tools

​

The three guardrail rules

1. New objects are created paused or as drafts by default. Meta Ads objects are created PAUSED. New LinkedIn Ads objects and posts, Shopify products and HubSpot pages and blog posts are drafts. e-conomic invoices, credit notes and journal entries are unbooked drafts, Uniconta journal lines are unposted, and a new HubSpot marketing email cannot send. A create call that asks for a live status (ACTIVE, or PUBLISHED for a LinkedIn post) needs confirm: true.
2. Spending, destructive and public actions need confirm: true. That covers setting a campaign or ad ACTIVE, changing a budget or bid, changing a price or inventory, publishing to a live website, sending a marketing email, publishing organic social content, booking to the ledger, and archiving or deleting.
3. Without confirm: true, a guarded call is a dry-run. It returns a preview of exactly what would happen and writes nothing at the provider. Nothing changes until a call carries confirm: true. The AI normally shows you the preview and then repeats the same call with confirm: true.

​

Default status: DRAFT / PAUSED

• Meta Ads: create_campaign, create_ad_set and create_ad create the object as PAUSED. It exists, but does not deliver and spends nothing. Passing status: "ACTIVE" (or "ARCHIVED") at creation needs confirm: true; with it, the object is created in that status.
• LinkedIn Ads: create_campaign_group and create_campaign create the object as DRAFT. PAUSED is also applied directly, while ACTIVE or ARCHIVED needs confirm: true. create_organization_post and create_member_post create a DRAFT post, and lifecycleState: "PUBLISHED" needs confirm: true.
• Shopify: create_product creates the product as DRAFT, not published to any sales channel. ACTIVE or ARCHIVED at creation needs confirm: true.
• HubSpot CMS: new pages and blog posts are forced to draft. HubDB row writes land in the table’s draft.
• HubSpot Marketing Email: new emails are forced to state DRAFT, and the create and update tools never accept state, publishDate or sendOnPublish, so they cannot send or schedule an email.
• e-conomic: create_draft_invoice, duplicate_invoice and create_credit_note create unbooked drafts, and create_journal_entries creates unbooked journal entries. Every e-conomic write needs confirm: true, including these.
• Uniconta: create_journal_lines creates unposted lines in the daily journal (kassekladde). Every Uniconta write needs confirm: true, including this one.

​

The confirm argument

• spend money: set a campaign, campaign group, ad set, ad or creative to ACTIVE, at creation or later (Meta Ads, LinkedIn Ads);
• change a budget or bid: Meta Ads update_budget, LinkedIn Ads update_campaign with a budget or unitCostAmount, and update_campaign_group with totalBudgetAmount;
• change a price or inventory: a Shopify variant’s price or compareAtPrice, set_inventory_quantity and adjust_inventory_quantity;
• publish to or withdraw from a live surface: the HubSpot CMS publish tools, HubSpot Marketing Email publish_email and unpublish_email, a LinkedIn post set to PUBLISHED or with changed text, LinkedIn comments and reactions, and Shopify publish_product, unpublish_product or status ACTIVE;
• change or discard saved HubSpot work: HubSpot Marketing Email update_email, reset_email_draft and the two revision restores, and HubSpot CMS reset_hubdb_draft;
• archive or delete an object (LinkedIn Ads delete_reaction is the exception);
• book to the ledger: e-conomic book_journal_entries and Uniconta post_journal_lines.

​

Writes that apply without confirm

• HubSpot CMS: create_page_draft, update_page_draft, create_blog_post_draft, update_blog_post_draft and upsert_hubdb_row_draft. Nothing reaches the live website before a publish.
• HubSpot Marketing Email: create_email, update_email_draft, clone_email and create_email_ab_variation. A draft cannot send.
• Meta Ads: creating campaigns, ad sets and ads as PAUSED, and update_status to PAUSED.
• LinkedIn Ads: creating campaign groups and campaigns as DRAFT or PAUSED, including a budget set at creation; update_campaign_group that changes only the name or end date; update_campaign that changes only the name or targetingCriteria, also on an active campaign; set_campaign_group_status, set_campaign_status and set_creative_status to DRAFT or PAUSED; create_conversion_rule, update_conversion_rule and associate_campaign_conversion; posts created as DRAFT; update_post that only sets lifecycleState: "DRAFT"; and delete_reaction.
• Shopify: create_product as DRAFT; update_product without a status change to ACTIVE or ARCHIVED (on a live product, the new title, description, vendor, type or tags show in the store right away); set_product_status or update_product to DRAFT, which takes a live product off sale; create_product_variant, including its price and also on a live product; and update_product_variant without a price or compareAtPrice change.
• e-conomic: none.
• Uniconta: none.

​

The dry-run preview

{
  "preview": {
    "action": "update_status",
    "summary": "Set object 1203456789012345 to ACTIVE.",
    "request": {
      "method": "POST",
      "path": "1203456789012345",
      "body": { "status": "ACTIVE" }
    },
    "confirmHint": "Re-run the same call with confirm: true to apply this change."
  }
}

{
  "name": "meta-ads__update_status",
  "arguments": {
    "objectId": "1203456789012345",
    "status": "ACTIVE",
    "confirm": true
  }
}

​

Tool annotations

​

Per-user access levels

• tools/list on the user’s endpoints for that connector lists only the read tools (28 on e-conomic, 21 on Uniconta), plus the connect_account system tool.
• A tools/call to a write tool is refused before anything is sent to the provider. The result has isError: true and starts with This tool is not enabled for your user on <id>, so it cannot be used in this session. Nothing was changed. The rest of the text says that an administrator decides which tools are switched on for the organization and which each user may use, under Team in the portal, and that every level costs the same.
• The initialize result carries instructions telling the model that the session can only read, so it does not offer changes it cannot make. A session that sees only some of the tools but still has a write tool (for example a Tilpasset list) gets instructions to treat the listed tools as the complete surface instead.
• The level is set per connector and applies to all of the account’s portals of that connector. It is set per user in Consile and does not change the provider connection, which the whole organization shares.
• A change takes effect within seconds, without a new sign-in. A client that cached tools/list in an open conversation can still show the write tools, but calls to them are refused. Start a new conversation, or call tools/list again, to refresh the list. In the Microsoft 365 Copilot agent (pilot, e-conomic only), a Read only user also still sees the write tools, and calls to them are refused in the same way.

​

e-conomic write tools

​

Booking journal entries

1. Call book_journal_entries with journalNumber and the exact entryNumbers (1-50). Only those entries are booked, never the whole journal.
2. The preview lists every entry (number, type, amount, currency, date and text) with a total per currency, and returns preview.state.expectedState.
3. To book, repeat the call with confirm: true and expectedState set to that value. A confirming call without expectedState is refused.
4. If any entry was changed, deleted or booked after the preview, the call is refused and nothing is booked. Run it again without confirm to see the current state. A number that is not an unbooked entry in that journal is named in the error, and nothing is booked.

​

Uniconta write tools

​

Posting journal lines

1. Call post_journal_lines with journal and the exact lineIds (1-50). Only those lines are posted, never the whole journal.
2. The preview lists every line (id, date, accounts, amount and text) with debit, credit and net totals, says how many other unposted lines in the journal are not included, and returns preview.state.expectedState.
3. To post, repeat the call with confirm: true and expectedState set to that value. A confirming call without expectedState is refused.
4. If any line was changed, deleted or posted after the preview, the call is refused, the changed line ids are named, and nothing is posted. Run it again without confirm to see the current state.
5. After posting, the connector reads the journal again and returns posted, stillUnposted, remainingUnpostedLinesInJournal and, when a selected line is still unposted, a warning.

​

Shopify write tools

• Orders, draft orders, customers and discounts are read-only. graphql_query accepts a single read-only query operation and refuses mutations and subscriptions.
• New products are created DRAFT. Publishing, unpublishing, setting status ACTIVE or ARCHIVED, changing a variant’s price or compareAtPrice, setting or adjusting inventory and deleting variants need confirm: true; without it the call returns a dry-run preview.
• These apply directly, with no confirmation step: create_product_variant (including the price of new variants), update_product without a status change to ACTIVE or ARCHIVED, update_product_variant without a price field, and setting status DRAFT. On a product that is already live, these changes show in the store right away, and status DRAFT takes the product off sale.
• There is no tool that deletes a product.
• A write Shopify rejects (with userErrors) never looks like a success. The result is Tool invocation failed., without Shopify’s message.

​

HubSpot CMS write tools

• Draft writes apply directly and have no confirm argument: create_page_draft, update_page_draft, create_blog_post_draft, update_blog_post_draft and upsert_hubdb_row_draft. A draft never touches the live website.
• Actions that change the live site or discard work need confirm: true: publish_page, publish_blog_post, publish_hubdb_table and reset_hubdb_draft. Without it the call returns a preview and writes nothing to HubSpot.
• HubDB row writes land in the table’s draft and stay invisible on live pages until publish_hubdb_table runs. There is no delete tool.

​

HubSpot Marketing Email write tools

• Draft writes (4): create_email, update_email_draft, clone_email and create_email_ab_variation. They apply directly, have no confirm argument and cannot send. New emails are forced to state DRAFT.
• Confirm-gated writes (7): update_email (changes the live version), publish_email (sends a real email), unpublish_email, delete_email (archives the email), reset_email_draft, restore_email_revision and restore_email_revision_to_draft. Without confirm: true they return a dry-run preview. Email reaches recipients only through a confirmed publish_email.

​

Meta Ads write tools

​

LinkedIn Ads write tools

​

Why read-only connectors are different

• Ordrestyring’s graphql_query takes a GraphQL document, but it accepts only a single read-only query operation; a mutation or subscription is refused. Shopify’s graphql_query works the same way.
• Business Central: Microsoft offers no read-only permission for Business Central, so the consent also covers writing, but the Consile connector only reads, and query_entity accepts only an allow-listed set of standard entities. See the Business Central reference.