AI agents should never run arbitrary GraphQL operations against production systems. The recommended pattern is to use an open-world setup in development — full schema introspection and ad-hoc queries — so agents can discover useful operations, then promote those to named, reviewed persisted operations exposed as tools via the Cosmo Router MCP Gateway in production. Five governance rules are outlined: no arbitrary execution in production, no default schema visibility, higher bar for mutations, intention-revealing tool names, and treating the safelist as a public API contract. The safelist bounds the failure surface, enabling rate limits, scopes, and human-approval gates to be applied to a finite set of reviewed operations rather than an open-ended graph.
