An assistant should search support cases but must not update them. What should the database MCP design expose?

1. A write tool hidden only from the web UI
2. Only approved read operations with read-only effective permissions
3. Full owner credentials with no tool restrictions
4. Read and update tools with a prompt asking the model not to update