Read-only-first with permission-denied by design is a sensible default, because it changes the question from "what can the agent do" to "what has it been explicitly allowed to do". In my view the practical test is how write access gets added later: one narrow, logged grant per workflow is much easier to review than a broad role. The glass-house idea supports that, since a readable record of every action is what makes a grant revocable in practice.