When should an AI agent have write access instead of read-only?

When it has demonstrated, in discovery mode, that its plans are the plans a human operator would approve, on a representative task set, over a window long enough to surface your edge cases. Write access is earned, not defaulted. And the first writes should be reversible, low-blast-radius actions inside a tight tool box - not high-stakes operations on customer-facing data.