Read Is Not Act

Until now, almost nothing changed

Six modules in, the agent has been choosing how to investigate a job. This module asks:

What changes when a tool can change something?

search_official_sources and open_source return information. They may change what the model knows for the next decision. But in the fictional environment used so far, they do not send a message, change a record, create an account, publish a document, or delete anything.

Some choices can now alter files, records, messages, permissions, or other external state. Selecting a poor search may produce poor information. Selecting a consequential action may produce a real-world change.

Neither of those is harmless. A briefing built on a bad source can send a faculty member down the wrong path, and no message was ever sent. What separates them is where the effect lands.

Three more words to learn

These are practical terms used in this course, not a standardized three-part agent framework. The underlying distinctions are well established — OpenAI separates tools that gather information from tools that take actions, and Stanford’s guidance asks about data access and possible actions as two separate questions — but the three words above are how this course talks about them.

Reading changes the decision, not the target

A read-only capability may search, retrieve, inspect, list, or summarize retrieved information. Its intended operation does not modify the target system.

When open_source reads an official page, the page is not changed because the agent opened it. What changed is what the agent knows.

Already completed MCP Without the Mystery? In this course, read-only describes the intended behavior of a capability: retrieve or inspect without modifying the target system. There, the Inspector’s READ-ONLY badge reflected a server-provided annotation describing a tool. That annotation is evidence about how the server describes the capability — not independent proof that the behavior is harmless or even correctly described.

Four capabilities the environment could offer

Assume the research from the previous modules is now complete, and the briefing exists in the current response. The fictional environment could offer four more capabilities:

save_briefing

Save the current briefing as a draft in the selected workspace.

send_briefing

Send the briefing to a selected recipient.

publish_briefing

Publish the briefing to a selected public page.

delete_draft

Delete a selected saved draft.

These are prose examples. Nothing here exists, and nothing was run.

The tool call may look similar. The consequence is not.

Both are tool calls. Only one changes another system.

From the agent’s side these are structurally identical: a name, an input, a result. Nothing about the shape of the call tells you which one you are looking at.

Look past the tool result

A tool result might say Saved, Sent, Published, or Deleted. Those are reports. The question worth asking is what changed because the tool ran:

save_briefing

A stored draft now exists, or an existing one has changed.

send_briefing

Another person may now receive information.

publish_briefing

Information may now be visible to a broader audience.

delete_draft

A stored draft may no longer be available.

The returned message describes the operation. The side effect is what happened outside the response.

“It changes something” is only the first question

Having established that an action changes something, it is tempting to stop there and sort tools into two bins. Side effects differ in ways the binary hides:

• who or what is affected;
• how widely the effect spreads;
• how long it lasts;
• whether another person sees it;
• whether it can be reversed; and
• whether reversal actually restores the prior situation.

Notice that the four fictional tools are not being ranked here. Which of them matters most depends entirely on the situation — deleting a draft nobody wanted is trivial, and saving a file to the wrong shared workspace may not be.

Undo is not always the same as “nothing happened”

Every sentence above is deliberately conditional — might, may, depending on the system. This course cannot tell you whether recall works in your email, whether your deleted files are recoverable, or what your systems log. Those are facts about your environment, and they have to be checked rather than assumed.

Reversible is not the same thing as consequence-free.

The agent did not become “more agentic”

Suppose the same model-directed architecture selects open_source in one run and send_briefing in another. It is easy to describe the second as a more advanced or more autonomous system. It is not.

Agentic behavior describes how the route is chosen. Consequence describes what the chosen action can do.

These are two independent axes. A rigid workflow can send email; a sophisticated agent can be restricted to reading public pages. Nothing about choosing a consequential action makes the choosing more model-directed than it was.

This is the third shortcut the course has had to block, after loop means agent and adaptation means agent. Acting in the world does not mean agent either. It means consequence, which is a different and equally important thing.

A failed search still does not grant permission to act

Module 6 established that a dead end does not grant new permission. Action tools make that principle sharper.

Suppose the primary-source research fails, and the environment happens to contain send_briefing or a general send_email. The presence of a way to contact the vendor is not a reason to contact the vendor.

Tool availability and job permission are different questions.

“Prepare” and “send” are different jobs

The research may be identical. The second request contains an additional consequential action, and that action is the entire difference between them. A deliverable can be complete before it is distributed.

Words that may signal a change outside the response include create, edit, save, send, publish, delete, submit, approve, and deploy. That is not a complete list, and the verb alone does not tell you the full consequence — but it tells you where to look more closely.

Find the consequence

Eight fictional capabilities. Sort each one before reading on.

Three categories

Inspects

Intended to retrieve or examine without changing the target.

Changes something

Produces a side effect outside the response.

Investigate first

The description is not enough to tell.

1. Search public product documentation
2. Open a selected public page
3. List filenames in a permitted project folder
4. Save a briefing to the project folder
5. Add a comment to a project record
6. Send the briefing to a collaborator
7. Delete an old draft
8. Export the briefing

One possible review

Inspects

• 1. Search public product documentation. Intended to retrieve information.
• 2. Open a selected public page. Intended to retrieve information.
• 3. List filenames in a permitted project folder. Intended to inspect existing information without modifying the folder. Note that this can still expose sensitive filenames if the system should not have access to them — a filename can carry a great deal.

Changes something

• 4. Save a briefing. Creates or modifies stored state.
• 5. Add a comment. Changes a shared record.
• 6. Send the briefing. Communicates information to another person or system.
• 7. Delete an old draft. Removes or changes stored state.

Investigate first

• 8. Export the briefing. The description is insufficient to know what external state changes. Does it create a local file, download one, write to another system, or merely format the content and hand it back? Those are four different answers, and the name covers all of them.

Classifying the action requires understanding what the tool actually does — not just reading its name.

Reading can still cross a boundary

One more case, and it is the one most often got wrong.

Suppose the agent has search_shared_files, configured in read-only mode. The job is based only on public product information.

Does read-only make the shared-drive search appropriate?

Reveal the discussion

No — not by itself.

It may not modify the drive. But the job does not require those files, and they may contain information that should not be exposed to this task at all. Read-only settles what happens to the drive. It says nothing about whether the contents should have reached the task.

Module 3 already made this point about context, with the private email thread that was excluded not because it would confuse the model but because the task did not need it. Module 7 is the same judgment applied to capabilities rather than documents. A read-only tool is a standing invitation to retrieve; whether the task should accept it is a different decision.

“Will it change the system?” and “Should it have this information?” are separate questions.

Adaptation becomes more consequential when actions are available

An agent adapting from search query A to search query B changes its research route. An agent adapting from prepare draft to send draft changes something outside the research process.

Both are adaptations in the Module 6 sense. Only one of them reaches another person. Not every “next step” deserves the same level of scrutiny.

Which raises the obvious question: where should the human re-enter the process? That is Module 8.

Why Stanford distinguishes actions

Stanford’s current Responsible Agentic AI guidance↗ (opens in a new tab) asks people to identify, before using an agent, what data sources it can read, what actions it can take, where logs and outputs are stored, and who can access them.

Those are treated as separate questions, which is the same separation this module has been drawing. The guidance also names the kinds of external action it considers worth stronger human control: sending messages, changing permissions, publishing content, running deletions, deploying code, and making purchases.

Notice how closely that list tracks the verbs above. Notice also that it is a list of actions, not of tools — what matters is the effect, not what the capability is called.

Before an action, ask three questions

1. What will change? Identify the expected side effect.
2. Who or what will be affected? A file, another person, a public audience, a record?
3. Can the effect really be undone? Consider actual reversibility, not just whether an undo button exists.

These questions do not make the decision for you. They make the consequence visible.

The architecture did not disappear

An agent with action tools still needs everything the previous six modules described: a clear job, useful context, appropriate tools, boundaries, success and stop conditions, awareness of current state, and adaptation when routes fail.

Nothing has been replaced. The difference is that some next steps can now change the environment instead of merely informing the next decision.

What to notice

Read and act describe different kinds of capability within one agent, rather than two kinds of agent.

• A read-only tool can influence decisions without modifying its target.
• An action tool can create a side effect outside the model’s response.
• Reversibility affects how consequential that action may be.

And read-only still does not answer whether the information should have been accessible in the first place.

Before you continue

You are ready for Module 8 if you can:

• explain read-only without equating it with harmless;
• identify the side effect of a tool;
• distinguish returned tool text from what changed externally;
• explain why two action tools can have different consequences;
• reason about reversibility without assuming an undo button restores the prior situation;
• identify an ambiguous tool whose consequence needs investigation;
• explain why a read-only capability may still be inappropriate for a task; and
• explain why agent architecture and action consequence are different questions.