WriteGuard: Fine-grained controls for MCP Servers

What this post added

Introduced WriteGuard, a new layer for controlling AI agent interactions with MCP servers. WriteGuard provides shared policy, attribution, and auditing for MCP tools. It defines risk tiers (Read Only, Minimal Impact, Contained Write, Critical) for tools, enabling/disabling them, and configuring labeling for agent attribution. WriteGuard integrates human identity with agent context to attribute actions and generates scrubbed audit events for fleet-wide queryability. Examples demonstrate its application to GitLab tools like `get_merge_request`, `create_mr_note`, and `merge_mr`.