MCP Permissions
Platform MCP separates permissions from resource grants so a client can have the right tool without automatically reaching every object.
MCP Permissions
Platform MCP separates permissions from resource grants so a client can have the right tool without automatically reaching every object.
The permission answers: "Can this client use this kind of tool?" The resource grant answers: "Can this client target this resource ID?"
Permission Presets
Presets are shortcuts for normal permissions. They do not include destructive permissions.
| Preset | Intended user | Includes |
|---|---|---|
| Full Admin | Trusted admins and automation | All normal MCP permissions. No destructive permissions by default. |
| Agent Builder | Agent and product builders | Agents, agent config, skills, custom tools, MCP servers, playground, docs. |
| Operator | Support and operations | Agent reads, chat, conversations, end users, sources read, interceptors read, feedback, channels read, docs. |
| Content Manager | Knowledge and content owners | Sources, media, retrieval, skills, feedback, docs. |
| Analytics | Reporting and finance viewers | Usage, analytics, billing, docs. |
| Custom | Advanced admins | Starts with docs:read; choose exact permissions manually. |
Normal Permissions
Normal permissions are enough for reads, non-destructive writes, chat, and configuration changes.
agents:read
agents:write
agent_config:read
agent_config:write
chat:write
conversations:read
conversations:write
sources:read
sources:write
retrieval:read
media:read
media:write
end_users:read
end_users:write
skills:read
skills:write
custom_tools:read
custom_tools:write
mcp_servers:read
mcp_servers:write
credentials:read
credentials:write
api_keys:read
api_keys:write
users:read
users:write
organization:read
organization:write
usage:read
analytics:read
billing:read
voice:read
voice:write
interceptors:read
interceptors:write
feedback:read
channels:read
channels:write
playground:read
playground:write
docs:read
Destructive Permissions
Destructive permissions are reviewed separately. A broad write grant never implies delete, revoke, deactivate, or archive access.
agents:delete
conversations:delete
sources:delete
media:delete
end_users:delete
skills:delete
custom_tools:delete
mcp_servers:delete
credentials:delete
api_keys:revoke
users:deactivate
interceptors:delete
Only enable destructive permissions for automation that is expected to remove or disable tenant data. The dashboard requires an extra destructive-permission toggle before these can be selected for org API keys.
Resource Grants
Each resource area can use one of three grant modes:
| Mode | Meaning |
|---|---|
all | The principal can target tenant resources in that area. |
selected | The principal can target only the listed IDs. |
none | The principal cannot target resources in that area. |
If an org API key or OAuth connection has no explicit grant for an area, the default is all. Agent API keys are different: they are selected to their own agent and cannot freely manage org-wide data.
Tool Families
| Area | Example tools | Permissions |
|---|---|---|
| Organization | get_organization, update_organization | organization:read, organization:write |
| Agents | list_agents, get_agent, create_agent, update_agent | agents:read, agents:write |
| Agent config | get_agent_configuration, update_agent_prompt, update_agent_model, export_agent_configuration, import_agent_configuration | agent_config:read, agent_config:write |
| Chat and playground | chat_with_agent, test_agent, chat_playground, delete_playground_session | chat:write, playground:read, playground:write |
| Conversations | list_conversations, send_conversation_message, takeover_conversation, release_conversation, assign_conversation, close_conversation | conversations:read, conversations:write |
| Sources and retrieval | list_sources, create_source, sync_source, search_knowledge_base | sources:read, sources:write, retrieval:read |
| Media | list_media, create_media_upload_url, update_media | media:read, media:write |
| End users | list_end_users, update_end_user, set_end_user_memory | end_users:read, end_users:write |
| Skills | list_skills, create_skill, attach_skill_to_agent, install_skill_recipe | skills:read, skills:write |
| Custom tools | list_custom_tools, create_custom_tool, test_custom_tool | custom_tools:read, custom_tools:write |
| MCP servers | list_mcp_servers, activate_catalog_mcp_server, create_custom_mcp_server, test_mcp_server | mcp_servers:read, mcp_servers:write |
| Credentials and providers | list_credentials, get_credential, create_credential, update_credential, test_credential, list_providers | credentials:read, credentials:write |
| API keys | list_api_keys, create_api_key, update_api_key | api_keys:read, api_keys:write |
| Users | list_users, create_user, update_user, reset_user_password | users:read, users:write |
| Usage and billing | get_usage, get_analytics, get_billing_summary | usage:read, analytics:read, billing:read |
| Voice | list_voices, list_voice_sessions, sync_voice_agent, clear_voice_tool_calls | voice:read, voice:write |
| Channels | list_channel_configs, update_channel_config | channels:read, channels:write |
| Interceptors | list_interceptors, create_interceptor, update_interceptor | interceptors:read, interceptors:write |
| Feedback | list_feedback, get_feedback | feedback:read |
| Docs | list_docs, search_docs, get_doc, get_openapi_spec, list_mcp_tool_docs, get_mcp_tool_doc | docs:read |
Destructive Tools
| Tool | Destructive permission |
|---|---|
delete_agent | agents:delete |
delete_conversation | conversations:delete |
delete_source, batch_delete_sources | sources:delete |
delete_media | media:delete |
delete_end_user, delete_end_user_memory | end_users:delete |
archive_skill | skills:delete |
delete_custom_tool | custom_tools:delete |
delete_mcp_server | mcp_servers:delete |
delete_credential | credentials:delete |
rotate_api_key, revoke_api_key | api_keys:revoke |
deactivate_user | users:deactivate |
delete_interceptor | interceptors:delete |
Safe Setup Rules
- Start with a preset that is narrower than you think you need.
- Add exact permissions after the client fails with a clear missing-permission error.
- Keep destructive permissions empty until a workflow explicitly needs them.
- Use selected resource grants for automation tied to specific agents, sources, users, or keys.
- Review Recent Audit Events after the first real run.
Related Docs
MCP Org API Keys
Create service keys with presets and destructive permissions.
MCP Workflows
Use permissions in real autonomous operating patterns.