WRITE/LOCAL. Diffs the current task corpus, durably stages deterministic event envelopes, then advances the checkpoint. Returns newly observed events plus the unacknowledged pending spool. Events are observation-only and must be acted on separately under normal ATS intent and security checks.
AI agents use poll_task_events to create or update resources in Agentic Task System — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Agentic Task System environment.
Despite having 'poll' in its name (suggesting a read operation), the tool explicitly stages (writes) event envelopes durably and advances a checkpoint, constituting a Write operation. It is not Destructive since no data is deleted, nor Execute since it doesn't run arbitrary code. The 'WRITE/LOCAL' tag in the description confirms the classification.
From the tool's definition 'durably stages deterministic event envelopes, then advances the checkpoint' — the tool writes staged event envelopes and mutates the checkpoint state, as also indicated by the 'WRITE/LOCAL' prefix
Attacks that exploit this kind of access
WRITE/LOCAL. Diffs the current task corpus, durably stages deterministic event envelopes, then advances the checkpoint. Returns newly observed events plus the unacknowledged pending spool. Events are observation-only and must be acted on separately under normal ATS intent and security checks. It is categorised as a Write tool in the Agentic Task System MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Agentic Task System MCP server in PolicyLayer and add a rule for poll_task_events: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Agentic Task System. Nothing to install.
poll_task_events is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the poll_task_events rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for poll_task_events. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
poll_task_events is provided by the Agentic Task System MCP server (renezander030/agentic-task-system). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →