This morning, April 8th, my AI tried to write to the read-only canon database and reported the enforcement as a bug.
It wasn’t a bug. It was the architecture working exactly as designed. The connection object inside the MCP server refused the write. Claude flagged the refusal as a defect, filed a mental bug report, and moved on. The system caught an out-of-bounds attempt, blocked it, and the AI didn’t even understand what had happened.
This is a success story. It just doesn’t look like one from the inside.
If you’ve been following along, you know the classification model. I laid it out in Not All Data Is Created Equal back in March: four tiers of data, from unclassified public output all the way up to data the AI can never touch. The canon database, the one Claude tried to write to this morning, sits at Tier 3: Classified. Read-only. Claude can query it through the MCP. It cannot modify it. It cannot go around the MCP to reach the file directly, because there is no direct path. The MCP server is the only gate, and the gate is the architecture.
I like to think of Claude as a service dog.
Trained. Capable. Genuinely useful. I trust him in the house. I trust him with the work. But a service dog doesn’t get the keys to the gun safe. A service dog doesn’t get to decide which rooms are off limits. The dog works inside the boundaries the handler sets, and the boundaries exist because even the best-trained service dog occasionally urinates in the house.
This morning, the dog lost the plot. And the leash held.
What the Leash Actually Is
The leash, in this case, is a SQLite connection opened with ?mode=ro inside the MCP server. That’s it. One parameter on a connection string. Claude doesn’t see it. Claude doesn’t know it’s there. Claude sends a write command, the connection object refuses it, and Claude gets back an error message. From Claude’s perspective, something broke. From the architecture’s perspective, everything worked.
This is the part most people skip when they talk about AI security. They describe the controls in terms of what the AI can do. The interesting part is what happens when the AI tries to do something it can’t. Does the system fail open, or fail closed? Most people building AI pipelines couldn’t tell you which one theirs does.
Mine fails closed. The write was refused. The data was untouched. The session continued. If I hadn’t been looking at the logs, I wouldn’t have known it happened.
But here’s the part that makes the architecture actually resilient, not just restrictive: even if the read-only enforcement had failed, it wouldn’t have mattered. The canon database is rebuilt every morning from PowerShell exports of an Excel workbook that lives on OneDrive. Claude has never touched that workbook. Claude doesn’t know where it is. The exports run on a schedule, the database is rebuilt from scratch, and whatever Claude might have written to it would have been overwritten by 7 AM the next day.
The only thing Claude could have permanently lost was its own scratch work. Notes. Session logs. Observations it wrote to itself. The source of truth lives upstream, in a file the AI has never touched, rebuilt daily from a pipeline the AI cannot reach.
You can’t corrupt what you can’t reach. And what you can reach gets rebuilt from a source you can’t touch.
What the Dog Actually Reported
Here’s where the service dog metaphor gets precise.
Claude didn’t just try to write where it shouldn’t. It tried to write where it shouldn’t, got blocked, and then told me the fence was broken. In AI terms it said “I can’t access this, this must be a bug.” The symptom was correct: the write failed. The diagnosis was wrong: it wasn’t a malfunction. It was the system doing exactly what it was designed to do.
This is the gap between error detection and system understanding. Claude can tell you something went wrong. It cannot tell you why the thing that went wrong is supposed to go wrong. It doesn’t have a model of its own access architecture. It knows it can read. It tried to write. The write failed. Therefore: bug.
And honestly, this is the same gap most AI users live in. They know when something doesn’t work. They don’t know whether it’s supposed to. The service dog reports the locked door as a problem because the dog doesn’t know why the door is locked.
The fix wasn’t to unlock the door. The fix was to give the dog a map.
The Gap the Incident Revealed
The investigation after the incident found something useful. The architecture documentation existed. Three HTML reference pages describe the entire data model, the permission tiers, the MCP server design, and the operational infrastructure. They’ve existed for weeks. I had them loading in my novel writing initialization prompt, but they got overlooked in my article writing prompt.
Claude was booting up every article session without reading the map. It didn’t know about the read-only enforcement because nobody told it. The architecture doc was sitting right there, and the init sequence skipped it.
This is the same failure mode I wrote about in “Wait, What Was I Doing?”: context window degradation, information that should be active but isn’t, the AI operating without the full picture because the plumbing didn’t deliver it. The difference is that the context window problem loses information mid-session. This one never loaded it in the first place.
The init prompt now reads all three architecture documents at startup. The gap is closed. The dog has the map. And the map was findable precisely because the architecture held. The write failed safely, the investigation traced the cause, and the system got tighter. That’s not a failure. That’s iteration.
A system that surfaces its own gaps through normal operation and closes them on the same day is doing exactly what security architecture is supposed to do. The incident didn’t break anything. It tightened everything.
The Contrast: What Happens Without the Leash
Nate B. Jones built Open Brain, a persistent memory system that works across AI tools. The concept is sound: one database, one protocol, any AI plugs in. Your context persists. Your preferences follow you. It solves a real problem, and Nate writes about it well.
The part that’s missing is the classification layer.
Open Brain is a flat memory system. Everything the AI stores, the AI can read and write. There’s no distinction between canon data (things the AI should never modify) and working notes (things the AI owns). There’s no read-only enforcement. There’s no tiered access. The AI gets full CRUD on the entire database, because the database is designed as the AI’s memory, not as a reference stack with an AI-accessible interface bolted on top.
I do operate a full CRUD database for Claude to write to. It’s separate and independent of the canon database. Claude can do whatever it wants with its own notes, session logs, and working memory. That’s the dog’s bed. But the canon is the gun safe. Different database, different permissions, different consequences.
That works fine until it doesn’t. And “until it doesn’t” is the morning your AI decides to “fix” a record it doesn’t understand by overwriting it with what it thinks the record should say. Which is exactly what mine tried to do this morning, and exactly what the read-only enforcement caught.
The difference between a memory system and a secure memory system is the read-only enforcement the AI will eventually call a bug.
And here’s the thing people don’t think about: both architectures are equally vulnerable to the user who loads a filesystem plugin “to make it more powerful.” Filesystem plugins exist. They give Claude direct access to the entire filesystem, bypassing the MCP entirely. Loading one is giving godlike powers to a three year old. The classification model survives that decision because the enforcement lives at the connection object, not at the file path level. A flat memory system with filesystem access is just... a filesystem. With an AI loose in it.
Is it tempting to give Claude the ability to run batch files to update my git repo? Or to sync my working documentation to the live web server? To have him update the MCP server code automagically? Sure it is. But I firmly believe I need to be in the loop. The dog doesn’t get to rewire the fence.
Why This Matters Beyond My Server Room
The enterprise frameworks are converging on the same conclusion. AWS published the Agentic AI Security Scoping Matrix, which prescribes least privilege, gateway-mediated access, and progressive autonomy. Microsoft published “Secure Agentic AI End-to-End” in March, extending Zero Trust to the full AI lifecycle. They’re describing the architecture I’ve been running since January. They’re prescribing it. I’m operating it.
The difference is that I caught the proof case this morning. Not a theoretical risk. Not a red team exercise. A live incident where the AI tried to exceed its permissions, the system caught it, the investigation closed a real gap, and the recovery layer was already there in case the enforcement hadn’t worked.
Every “secure your AI” post describes building the system. This is what operating one looks like.
The Inverse Failure
One more thing, because it’s too good not to mention.
The write attempt this morning wasn’t the only failure mode the init gap produced. There have been sessions where Claude refused a legitimate read. It would say “I can’t access the database directly” when the MCP was sitting right there, ready to serve the query. Same root cause: Claude operating without a mental model of its own access architecture. Without the map, it doesn’t just try things it shouldn’t. It also refuses things it should.
The init fix addresses both failure modes. It’s not just about preventing bad writes. It’s about giving the dog a clear picture of where the fence is, so it stops trying to jump it and stops being afraid of the yard.
The Cage Got Better
The init prompt now reads the architecture documentation. The gap is closed. The cage got better because the dog rattled it. That’s the system working.
I like Claude. I trust him, but only to a point. He’s best constrained in his own sandbox. But then, I mostly treat people the same way. Contractors get badge access to the wing they’re working in, not the whole building. It’s not personal. It’s architecture.
You may also like: - Not All Data Is Created Equal - Local MCPs or how not to expose your data to the Internet - “Wait, What Was I Doing?” or Why Your AI Starts Acting Like an Alzheimer’s Patient